Identity and access management
Factorial to Active Directory integration: domain accounts from Factorial
With an integration between Factorial and Active Directory, every new employee from Factorial gets a domain account in the OU of their legal entity and team, with the right groups, and the account expires on the end date in Factorial. For Microsoft, Factorial only offers an Azure app for sign-in, not an integration with on-premises Active Directory; KoppelHet provides it with a small program in your domain.
What the integration does
Organisations that use Factorial for HR and have their own Active Directory create accounts after a form from a manager. Temps who join permanently get a second account.
- HR records a new employee in Factorial with legal entity, team, job and start date.
- Factorial reports the hire; KoppelHet instructs the program in the domain to create a new account.
- The account is created disabled in the OU of site and team, with the groups of the job.
- On the start date the account is enabled; on a team change it moves to the new OU.
- The end date is set straight away as the account expiry date; after departure the account is disabled.
What to watch for with Factorial and Active Directory
- For Microsoft, Factorial offers an Azure app for single sign-on and mentions no integration with on-premises Active Directory. KoppelHet fills that gap with a program in the domain that fetches instructions over an outbound connection, without an open firewall port.
- Factorial reports changes per type, such as hire, contract change and termination. KoppelHet translates each type into an action in the domain - create, move or expire - instead of overwriting the whole account every time.
- KoppelHet sets the end date from Factorial straight away as the account expiry date. If the connection drops for a day, the account still expires on time.
- When a temp becomes permanent, they get a new contract in Factorial. KoppelHet recognises the person and re-enables the existing domain account, so the colleague keeps their logon name and files.
- Teams in Factorial can be named freely. Per team and site we record the OU and groups, so that, for example, a warehouse gets access to the scanners and an office to the finance folders.
- Factorial retries a failed notification up to twenty times in 48 hours and then switches the subscription off. KoppelHet monitors that and compares active employees with the domain every day.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
What has to run in our network?
A small KoppelHet program on a Windows server in the domain, with an outbound connection. No open port.
What about audit logging, GDPR and our integration platform?
Every action in the domain is in the audit logging of the KoppelHet platform. You are the controller and KoppelHet is the processor, under a data processing agreement; salary and absence from Factorial do not go to the domain. An existing integration platform is left alone.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- KoppelHet reads Factorial through the Factorial API (version 2026-07-01 in the path) with OAuth 2.0 - employee updates (new hires, contract changes, terminations) filtered on legal_entities_ids, employees, contract versions and teams. Webhook subscriptions with up to twenty attempts in 48 hours, then switched off.
- A KoppelHet agent on a Windows server in the domain writes employeeID (at most 16 characters), sAMAccountName (at most 20 characters), userPrincipalName, givenName, sn, displayName, title, department, company, manager and accountExpires, and moves accounts between OUs.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Factorial | Field in Active Directory | Notes |
|---|---|---|
Employee id | employeeID | |
first_name | givenName | |
last_name | sn | |
Naamgevingsregel | sAMAccountName en userPrincipalName | sAMAccountName at most 20 characters |
Functie (contract version) | title | |
Team | department en OU | |
Legal entity | company | |
Manager | manager | |
Einddatum (termination) | accountExpires |
Related
Factorial → 4PS Construct
Factorial to 4PS Construct integration: fitters and site managers with their cost centre as a dimension in 4PS
Factorial → ADP iHCM
Factorial to ADP iHCM integration: contract versions and terminations of the Dutch entity to ADP
Factorial → AFAS Profit
Factorial to AFAS integration: employees and contracts from Factorial in AFAS Profit Payroll
Factorial → AllSolutions
Factorial to AllSolutions integration: employees per legal entity with their main cost centre in AllSolutions