Identity and access management
Hailey HR to Active Directory integration: domain accounts from Hailey, expiring on the last working day
With an integration between Hailey HR and Active Directory, every new employee from Hailey gets a domain account with job title, department, teams and manager, and the account expires on the last working day HR records in Hailey. KoppelHet builds the integration with a small program in your network.
What the integration does
Organisations that use Hailey HR and still have their own Windows domain often still create domain accounts by hand. They are then created after an email from HR, and the work address has to be entered back into Hailey by hand.
- HR records the new employee in Hailey, with department, title, teams and manager.
- Hailey sends a webhook; the KoppelHet platform fetches the full employee.
- The program in the domain creates the account in the department's OU and adds it to the teams' groups.
- KoppelHet writes the new address back to the work address field in Hailey.
- As soon as HR fills in a last working day, the account gets that date as its expiry date.
What to watch for with Hailey HR and Active Directory
- If an organisation has its own domain with Entra Connect behind it, KoppelHet puts the accounts in the domain and Entra Connect carries them to the cloud.
- The work address has its own write operation per employee in the Hailey API. The program first creates the domain account according to your naming rule, and the platform then puts the address in Hailey. HR therefore never retypes the address.
- Besides the end of employment, Hailey keeps a separate last working day, which falls earlier when someone takes remaining holiday. KoppelHet uses the last working day as the expiry date of the domain account, so no weeks of access remain during holiday taken.
- Someone can belong to more than one team and hold more than one title in Hailey. Each team becomes a security group in the domain; for the title attribute we agree at the start which title takes precedence.
- A webhook from Hailey only contains the ID of the employee or company. The platform then fetches the employee and sends the program in the domain a complete instruction, so the domain itself never connects to Hailey.
- Hailey's personal access token expires after a year, but extending it keeps the same token value. The platform extends it before it runs out; without extension, expiry dates in the domain would silently stop being updated.
- Which fields the API returns follows the rights of the user behind the token. That user gets no rights on salaries in Hailey, so no pay data can reach the program in the domain.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Does anything need to be opened in the firewall?
No. The program in the domain only makes an outbound connection to the KoppelHet platform.
What does the integration write in Hailey?
Only the work address. Everything else KoppelHet reads from Hailey.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Hailey HR API (v1) with a personal access token (valid for a year, extend through POST /PersonalAccessToken/Extend without a new value). GET /Employees with companyEmail, departmentId, titleIds, teamIds, managerEmployeeId, employmentStatus, lastWorkingDay and lastDayOfEmployment; PUT /Employee/{employeeId}/CompanyEmail for the work address. Webhooks with only employeeId or companyId.
- A KoppelHet agent on a Windows server in the domain fetches instructions through an outbound connection and writes employeeID, sAMAccountName, userPrincipalName, givenName, sn, displayName, title, department, manager and accountExpires, manages group membership and moves accounts between OUs.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Hailey HR | Field in Active Directory | Notes |
|---|---|---|
Personeelsnummer (Hailey) | employeeID | At most 16 characters |
Naamgevingsregel | sAMAccountName en userPrincipalName | sAMAccountName at most 20 characters |
First name en last name | givenName, sn en displayName | |
titleIds (leidende titel) | title | |
departmentId | department en OU | |
teamIds | Lidmaatschap van beveiligingsgroepen | |
managerEmployeeId | manager | |
lastWorkingDay | accountExpires | |
userPrincipalName (domein) | companyEmail (Hailey) |
Related
Hailey HR → ADP iHCM
Hailey HR to ADP iHCM integration: approved salaries and end of employment to Dutch ADP payroll
Hailey HR → AFAS Profit
Hailey HR to AFAS integration: employment, scope and salary to Dutch payroll
Hailey HR → Arbodienst (SIVI)
Hailey HR to the occupational health service via SIVI: sick days from the Hailey calendar as absence reports
Hailey HR → DATEV
Hailey HR to DATEV integration: German employees and salaries from Hailey HR to the tax adviser