Identity and access management
HiBob to Entra ID integration: Microsoft accounts that follow HR
With an integration between HiBob and Microsoft Entra ID, every new colleague in HiBob automatically gets a Microsoft account with groups and licence, and that account is blocked on departure. The new work email address then goes back to HiBob, so IT no longer has to change it by hand.
What the integration does
Organisations that use HiBob for HR and Microsoft 365 for mail and Teams hire new colleagues in Bob with their personal address, because the work address does not exist yet. IT creates the account, updates the address in Bob by hand and regularly forgets to block the account on departure.
- HR hires a new colleague in HiBob, often still with a personal email address.
- KoppelHet derives the work address from the agreed naming rules and has the Microsoft account ready before the start date, with manager, groups and licence.
- The work address goes back to HiBob, so HiBob's invitation and notifications go to the work address.
- When someone gets a new department or manager in HiBob, their details and groups in Entra ID follow.
- On the leaving date sign-in is blocked. The licence is removed after the agreed period.
What to watch for with HiBob and Microsoft Entra ID
- HiBob asks for an email address for a new employee, while the work address only comes into being in Entra ID. HR therefore often enters a personal address. KoppelHet then writes the work address back to HiBob; HiBob sends a confirmation to the new address if needed.
- Someone hired but not yet started is listed as inactive in HiBob and is left out of search results by default. KoppelHet deliberately includes these colleagues, otherwise they only get an account on their first day.
- HiBob also reports garden leave as a departure. Whether someone on garden leave is blocked straight away or only on the contract end date is agreed up front.
- If the integration has no right to a piece of data in HiBob, HiBob leaves it out without an error. KoppelHet therefore checks that everything expected is there, so a missing department does not silently become an empty department in Entra ID.
- Sites in HiBob are in different countries. The site's country decides which licence is possible, and only employees at sites that belong to this Microsoft environment get an account.
- KoppelHet only processes notifications that verifiably come from HiBob, so nobody can have an account created or blocked with a forged message.
- The employment type from HiBob, such as permanent, temporary or freelance, goes to Entra ID. IT can set groups and access rules differently based on it.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
How quickly does a change in HiBob reach Entra ID?
KoppelHet processes a normal change as soon as HiBob reports it. HiBob only reports a start or departure on the day itself, not when HR enters it.
What if a notification does not arrive?
HiBob tries again. The check round also compares HiBob with Entra ID, so a missed change is still processed.
Does the integration see salaries in HiBob?
No. The integration may only read personal and work data and change the email address. Salary and bank details are excluded.
Does this also work with on-premises Active Directory?
Yes, through a small program in your own network.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- HiBob is read through signed webhooks (including employee.created, employee.updated, employee.joined and employee.left) and the People API (people search with showInactive for employees who have not started yet).
- The work address goes back through the People API email endpoint (root.email). The service user has read access to root, work and employment and write access to the email address; no salary or bank.
- Entra ID is written through Microsoft Graph. Fields include employeeId (root.id), jobTitle, department, manager, usageLocation (country of work.siteId), officeLocation, employeeType (employment.type) and employeeHireDate.
- Lifecycle events such as joined and left only fire when the lifecycle entry takes effect.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in HiBob | Field in Microsoft Entra ID | Notes |
|---|---|---|
root.id | employeeId | Fixed key, also on a name change |
root.firstName | givenName | |
Achternaam | surname | |
Naamgevingsregel | userPrincipalName en mail | Then goes back to root.email in Bob |
work.title | jobTitle | |
work.department | department | |
Leidinggevende (reports to) | manager | |
work.siteId | usageLocation en officeLocation | The site's country decides usageLocation |
employment.type | employeeType | |
Startdatum | employeeHireDate |
Related
Ashby → HiBob
Ashby to HiBob integration: a hire from Ashby straight in as an employee in Bob
Bullhorn → HiBob
Bullhorn to HiBob integration: an approved placement as a new employee in Bob
Carerix → HiBob
Carerix to HiBob integration: successful match becomes a new employee in Bob
Greenhouse → HiBob
Greenhouse to HiBob integration: from a hire in Greenhouse to a new employee in Bob