Identity and access management
HiBob to Active Directory integration: accounts in your own network, automatically
With an integration between HiBob and Active Directory, a new colleague in HiBob automatically gets an account in your Active Directory with the right groups, and that account is disabled on departure. HiBob does not need to reach the internal network for this, and no firewall ports are opened.
What the integration does
Organisations that use HiBob and still have Active Directory for workstations, file servers and printers cannot connect them directly, because HiBob is in the cloud and cannot reach the internal network. IT therefore retypes new colleagues, and leave or departure only reaches Active Directory after an email from HR.
- IT installs a small KoppelHet program once on a server in the own network.
- HR enters a new colleague in HiBob. KoppelHet derives the username and decides which folder the account belongs in.
- The account then appears in Active Directory, with manager, title, department and groups.
- If someone goes on long-term leave, the account is temporarily disabled if you want that, and re-enabled on return.
- On departure the account is disabled and moved to the leavers.
What to watch for with HiBob and Active Directory
- HiBob cannot reach the internal network, and does not need to. The change arrives at the KoppelHet platform, and the program in your network collects it from there. If it is briefly down, the instruction waits until it reconnects.
- HiBob only reports temporary leave when the leave starts. That way an account can be disabled during long-term leave and re-enabled on return, if you want that.
- If HR deletes an employee in HiBob, for example after a hire entered by mistake, the record is gone. HiBob does include the email address, and KoppelHet uses it to find the account.
- A custom field in HiBob, such as a cost centre, is not included by default. KoppelHet requests it separately, and the integration needs rights to that field's category in HiBob.
- HiBob holds employees of every country, but only the Dutch sites belong in this domain. The site decides whether anything happens and which folder the account goes into, so the policy of the right office applies.
- HiBob retries a notification that does not arrive for up to three days. Together with the check round, a short outage does not lead to a missed departure.
- A change with a future date, such as a new department from next month, only goes through on that date. Until then the account stays in the old folder and groups.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Does HiBob need to reach our server?
No. HiBob sends the change to the KoppelHet platform in Amsterdam. The program in your network collects the instruction there itself.
Is an account disabled during maternity leave?
Only if you want that. Many organisations keep the account enabled so the employee stays reachable; we set it per type of leave.
What happens to colleagues in other countries?
Their changes arrive too, but the integration does nothing with them if their site does not belong to this domain.
Can the work email address go back to HiBob?
Yes. That happens after Microsoft has carried the account over to Entra ID, so the address really exists by then.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- HiBob is read through employee data webhooks (including employee.temporaryLeave and employee.deleted, with email address) and the People API (people search). Webhooks are signed with their own secret; HiBob retries failed webhooks for up to three days.
- Custom fields must be requested explicitly; the service user needs permissions per category.
- A KoppelHet agent in the domain collects instructions through an outbound connection and writes to AD.
- AD attributes include employeeID (root.id, at most 16 characters), sAMAccountName (at most 20 characters), userPrincipalName, mail, title, department, manager (distinguished name) and physicalDeliveryOfficeName; organizational unit (OU) per site.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in HiBob | Field in Active Directory | Notes |
|---|---|---|
root.id | employeeID | Fits within the 16 characters of employeeID |
Naamgevingsregel | sAMAccountName | At most 20 characters, with a sequence number for duplicates |
Naamgevingsregel | userPrincipalName en mail | |
root.firstName en achternaam | givenName, sn en displayName | |
work.title | title | |
work.department | department | |
Leidinggevende (reports to) | manager | Distinguished name of the manager's account |
work.siteId | OU en physicalDeliveryOfficeName | Through a lookup table per site |
internal.lifecycleStatus | Account aan of uit | For temporary leave only if agreed |
Related
Ashby → HiBob
Ashby to HiBob integration: a hire from Ashby straight in as an employee in Bob
Bullhorn → HiBob
Bullhorn to HiBob integration: an approved placement as a new employee in Bob
Carerix → HiBob
Carerix to HiBob integration: successful match becomes a new employee in Bob
Greenhouse → HiBob
Greenhouse to HiBob integration: from a hire in Greenhouse to a new employee in Bob