Identity and access management
HR2day to Active Directory integration: accounts per school or location from HR
With an integration between HR2day and Active Directory, a new employee in HR2day automatically gets an Active Directory account, at the right school or location and with the groups that belong to the job. After the last working day the account is disabled, and through Microsoft the account also reaches Microsoft 365, without the IT coordinator doing anything by hand.
What the integration does
Organisations with HR2day for staff and payroll and their own Active Directory, linked to Microsoft 365, often create accounts one by one by hand. When many contracts begin on the same day, such as at the start of the school year, that gets stuck, and substitutes on temporary contracts linger in Active Directory.
- IT installs a small KoppelHet program once in your own network, and gives the integration read access in HR2day.
- HR enters a new employee in HR2day. KoppelHet derives username and email address from the agreed naming rules.
- The account then appears in Active Directory in the folder of the right school or location, with job title, department and manager.
- The employee joins the groups for job and department, and through Microsoft also gets a Microsoft 365 account and licence.
- After the last contract ends, the account is disabled and moved to the leavers.
What to watch for with HR2day and Active Directory
- HR2day and the internal network cannot reach each other directly. KoppelHet reads from HR2day, and the program in the internal network carries out the changes in Active Directory.
- Properties such as cost centre or the school's BRIN number are set on the account in Active Directory. Microsoft carries them over to Entra ID, but there they are read-only, so changes always happen in Active Directory.
- If the manager from HR2day has no account of their own, for example an external board member, the field stays empty and HR gets a notice, rather than a wrong manager.
- Substitutes often get several short contracts in a row. Between two contracts the account stays disabled and is enabled again with a new contract, so the substitute keeps the same username and files.
- An account's email domain must also be known in Microsoft 365. For a foundation with its own domain per school we record per location which domain applies.
- In HR2day the integration may only read employees, contracts and departments. It cannot see salary or absence.
- At the start of the school year many contracts begin on the same day. KoppelHet creates the accounts in advance, disabled, and enables them all on the start date.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Does a port need to be opened in the organisation's firewall?
No. The KoppelHet program makes an outbound connection to the platform itself.
Can student accounts be included?
Students are not in HR2day, so not through this integration. They come from the student information system.
What if we have several domains?
Per location or employer in HR2day we record which domain and folder the account goes to. One program per domain is enough.
What happens to existing accounts?
Before go-live we link them to HR2day on employee number or name. Whatever cannot be linked, the IT coordinator reviews first.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- HR2day runs on Salesforce and is read through the Salesforce REST API, on last modified date. Access through a connected app with an integration user and a permission set with read-only access to the HR2day objects for employees, employment relationships and departments.
- A KoppelHet agent in the domain carries out the changes in AD through an outbound connection.
- AD attributes include employeeID, sAMAccountName, userPrincipalName, givenName, sn, title, department, manager and physicalDeliveryOfficeName. Cost centre or BRIN in an extensionAttribute; read-only in Entra ID for synced accounts (onPremisesExtensionAttributes).
- Organizational unit (OU) per school or location; disabling through userAccountControl. The UPN suffix must be verified in Entra ID. Entra Connect syncs to Entra ID.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in HR2day | Field in Active Directory | Notes |
|---|---|---|
Personeelsnummer | employeeID | |
Roepnaam | givenName | |
Tussenvoegsel + Achternaam | sn en displayName | Position of the name prefix per the customer's convention |
Naamgevingsregel | sAMAccountName | |
Naamgevingsregel | userPrincipalName en mail | |
Functie | title | |
Afdeling | department | |
Locatie of school | OU en physicalDeliveryOfficeName | |
Leidinggevende | manager | |
Kostenplaats | extensionAttribute (per klant te kiezen) | |
Einddatum laatste arbeidsrelatie | userAccountControl (uitgeschakeld) |
Related
Exact Online → HR2day
Exact Online to HR2day integration: cost centres and cost units to HR2day, payroll journal per division
HR2day → Microsoft Entra ID
HR2day to Entra ID integration: Microsoft 365 accounts for care, education and childcare
HR2day → Google Workspace
HR2day to Google Workspace integration: one Google account per employee, also with several employment relationships
HR2day → Jira Service Management
HR2day to Jira Service Management integration: customers, organizations and onboarding requests per employment relationship