Identity and access management
HoorayHR to Active Directory integration: domain account from the personnel file
With an integration between HoorayHR and Active Directory, a new employee in HoorayHR automatically creates a domain account, in the right OU per entity and with job title, team and manager. After the end date of the employment in HoorayHR, KoppelHet's program disables the account in Active Directory and moves it to the leavers OU.
What the integration does
Organisations with HoorayHR as HR system and an Active Directory on their own server, often synchronised to Microsoft 365, type in new employees twice. After a team change someone keeps the folders of the old team, because HoorayHR does not pass the change on to the domain.
- IT installs KoppelHet's program once on a server in the domain; it only makes an outbound connection.
- KoppelHet reads the employees, teams, contracts and entities with a HoorayHR API key.
- For a new employee the program creates an account in the OU of their entity, with a unique logon name.
- With a different team or contract the program updates department and group memberships.
- After the end date the account is disabled and moved to the leavers OU.
What to watch for with HoorayHR and Active Directory
- HoorayHR does not create accounts in a directory. KoppelHet's program in the domain applies the changes, so no port needs to be opened for a connection from outside.
- Every HoorayHR environment has at least one entity, even without several employers. The program uses the entity for the OU and the company field, so group policy can differ per employer as soon as a second entity is added.
- Teams in HoorayHR become groups in Active Directory. Because an employee can be in several teams, membership follows all teams, while the department field gets one agreed main team.
- A logon name in Active Directory may have at most 20 characters and must be unique in the domain. HoorayHR stores prefix, surname and partner's name separately; the program builds the logon name from the own name and shortens it, so long Dutch names fit.
- Employees in HoorayHR cannot be requested by change date. KoppelHet reads all employees in every run and compares per person, and disabling happens based on the end date, not at the moment HR fills it in.
- Demo employees from the trial period also appear in the HoorayHR API. The program creates no domain account for them, so no accounts with rights on the file shares are created for people who do not exist.
- The program does not turn a refusal caused by an inactive HoorayHR subscription or an open payment into disabling. The run stops and KoppelHet gets an alert, so the domain is not emptied by an administrative problem.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Do any firewall ports need to be opened?
No. The program in the domain makes its own outbound connection to the KoppelHet platform.
Who determines the manager?
The team leader of the agreed main team in HoorayHR. We agree on that at the start, because HoorayHR has no separate field for the manager.
Can the new email address go back to HoorayHR?
The HoorayHR API cannot update existing employees. The address is in Active Directory and therefore in Microsoft 365.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- HoorayHR through api.hoorayhr.io with a personal API key (pk_…) of a user with the admin role, read scopes only: GET /users (filter only id[$in]), /teams-information, /contracts and /entities. Fields include id, employeeNumber, firstName, insertion, lastName, displayName, jobTitle, entityId, teams, isDemoData, companyStartDate and companyEndDate. A 403 with INACTIVE_COMPANY or PAYMENT_OVERDUE stops the run.
- A KoppelHet agent in the domain writes, through an outbound connection, the AD attributes employeeID, sAMAccountName (at most 20 characters), userPrincipalName (unique in the forest), givenName, sn, displayName, title, department, company, manager, an extensionAttribute with the HoorayHR ID and userAccountControl; an OU per entity and groups per team.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in HoorayHR | Field in Active Directory | Notes |
|---|---|---|
id (HoorayHR) | Eigen attribuut als vaste sleutel | Stays the same if the employee number changes |
employeeNumber | employeeID | |
Naamgevingsregel | sAMAccountName | At most 20 characters, unique in the domain |
Naamgevingsregel met domein | userPrincipalName en mail | |
firstName, insertion, lastName | givenName en sn | |
displayName | displayName | |
jobTitle | title | |
Team | department en groepen | |
Entiteit | company en OU | |
companyEndDate | userAccountControl (uitgeschakeld) |
Related
ASHoorayHR → Arbodienst (SIVI)
HoorayHR to occupational health service via SIVI: sickness dossiers and their phases from HoorayHR to the health service
HoorayHR → Microsoft Entra ID
HoorayHR to Entra ID integration: Microsoft 365 account on the start date from HoorayHR
HoorayHR → Google Workspace
HoorayHR to Google Workspace integration: a Google account from the start date
HoorayHR → Okta
HoorayHR to Okta integration: HoorayHR as HR source for Okta users and groups