Identity and access management
HoorayHR to Entra ID integration: Microsoft 365 account on the start date from HoorayHR
With an integration between HoorayHR and Microsoft Entra ID, a new employee from HoorayHR automatically gets a Microsoft 365 account with job title, team, entity and manager. After the end date of the employment in HoorayHR, KoppelHet blocks sign-in in Entra ID, so mail, Teams and the apps behind Microsoft close.
What the integration does
Organisations that do HR in HoorayHR and use Microsoft 365 for mail and Teams create accounts when HR asks for them. HoorayHR itself only sends notifications to Teams and creates no accounts, so a new colleague waits for IT and a leaver sometimes stays active for weeks.
- A HoorayHR administrator creates an API key with read-only rights for employees, teams, contracts and entities.
- KoppelHet retrieves the employee list and compares it with the previous state.
- For a new employee KoppelHet creates the account according to the naming rule, with job title, team and entity.
- The contract type and the team decide groups and licence in Entra ID.
- After the end date KoppelHet blocks sign-in; the licence is removed after the agreed period.
What to watch for with HoorayHR and Microsoft Entra ID
- HoorayHR has no integration with Entra ID or single sign-on; the only Microsoft integration is notifications in Teams. The account in Entra ID is therefore not created automatically, and KoppelHet creates it based on the employee in HoorayHR.
- The HoorayHR API can only filter employees by ID, not by change date. KoppelHet therefore retrieves the full list every run and compares it with Entra ID itself, so an end date that HR fills in retroactively is also picked up.
- HoorayHR has no fixed field for department, but it has teams with team leaders, and an employee can be in several teams. We agree which team decides the department in Entra ID; the leader of that team becomes the manager. If someone leads that team themselves, we choose a fixed other source for the manager, so nobody becomes their own manager.
- A HoorayHR environment in its trial period can contain demo data, and those employees appear in the API like any other. KoppelHet skips them, so no Microsoft accounts are created for made-up colleagues.
- With an inactive HoorayHR subscription or an overdue payment, every request is refused. KoppelHet treats that as an outage and not as an empty list, so nobody is blocked in Entra ID because of it.
- Contracts in HoorayHR are fixed-term, permanent or internship. KoppelHet sets that as the employee type in Entra ID, so an intern gets different apps and a lighter licence than a permanent employee through a dynamic group.
- The HoorayHR API cannot update an existing employee, so the new Microsoft address does not go back automatically. The API key also has a fixed expiry date; KoppelHet warns well in advance, so the integration does not stop on that day.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Can employees then sign in to HoorayHR with Microsoft?
HoorayHR does not mention single sign-on with Microsoft. This integration handles the Microsoft account; signing in to HoorayHR stays as it is.
Which name does the account get?
The display name follows the employee's choice in HoorayHR, for example with the partner's name. We build the email address from the own name, so it does not change if that choice changes later.
Does this also work with Active Directory in our network?
Yes, that is a separate integration through a small program in your domain. We start with one target; the other can follow later as an extension.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- HoorayHR is read through api.hoorayhr.io with a personal API key (pk_…, admin role, scopes and expiry date cannot be changed afterwards) as Bearer token: GET /users (filter only id[$in]; fields employeeNumber, firstName, nickName, insertion, lastName, lastNameUsage, displayName, jobTitle, entityId, teams, isDemoData, companyStartDate, companyEndDate), /teams-information (teamLeadersIds, teamMembersIds), /contracts (type, status) and /entities. A 403 with INACTIVE_COMPANY or PAYMENT_OVERDUE stops the run.
- Entra ID is written through Microsoft Graph (user) with employeeId (at most 16 characters), givenName, surname, displayName, userPrincipalName, mailNickname, jobTitle, department, companyName, employeeType, manager, usageLocation, employeeHireDate, employeeLeaveDateTime (requires User-LifeCycleInfo.ReadWrite.All) and accountEnabled.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in HoorayHR | Field in Microsoft Entra ID | Notes |
|---|---|---|
employeeNumber | employeeId | At most 16 characters in Entra ID |
firstName of nickName | givenName | |
insertion + lastName | surname | |
displayName (volgens lastNameUsage) | displayName | |
Naamgevingsregel | userPrincipalName, mail en mailNickname | |
jobTitle | jobTitle | |
Team (teams-information) | department | |
Teamleider van het team | manager | |
Entiteit (entityId) | companyName | |
Contracttype (1, 2 of 3) | employeeType | |
companyStartDate | employeeHireDate | |
companyEndDate | employeeLeaveDateTime en accountEnabled = false |
Related
HoorayHR → Active Directory
HoorayHR to Active Directory integration: domain account from the personnel file
ASHoorayHR → Arbodienst (SIVI)
HoorayHR to occupational health service via SIVI: sickness dossiers and their phases from HoorayHR to the health service
HoorayHR → Google Workspace
HoorayHR to Google Workspace integration: a Google account from the start date
HoorayHR → Okta
HoorayHR to Okta integration: HoorayHR as HR source for Okta users and groups