Identity and access management

HR2day to Entra ID integration: Microsoft 365 accounts for care, education and childcare

With an integration between HR2day and Microsoft Entra ID, every new employee in HR2day automatically gets a Microsoft 365 account, with the groups of their location and the licence that belongs to their job. When the last contract ends the account is blocked, including for on-call staff with many short contracts.

Discuss your integration How the integration works

Written by Marcel van Beek, founder and integration specialistLast updated: 9 November 2026

What the integration does

Organisations that run HR and payroll in HR2day and work with Microsoft 365 often have the service desk create accounts from a form filled in by the team leader. With on-call staff and interns joining every month that is slow, and people who finish an on-call contract often keep access for months.

HR enters the new employee and contract in HR2day, with department, job and start date.
KoppelHet derives the email address and sign-in name from the agreed naming rules.
The account is ready in Entra ID, with manager and the groups for location and job.
The job decides the licence. A frontline worker gets a different licence from someone in the office.
When the last contract ends, sign-in is blocked on the end date and the licence is removed after the agreed period.

Out: User with name, employee number and work address · Contracts with start and end date · Department, job and manager · Groups per location or school · Microsoft 365 licence per job

What to watch for with HR2day and Microsoft Entra ID

HR2day runs on the Salesforce platform. KoppelHet therefore reads the data through Salesforce, with a separate integration user your administrator creates in your own HR2day environment.
The technical names in HR2day differ from what HR sees on screen. KoppelHet works with the technical names, so a renamed field in HR2day does not break the integration.
HR2day shares a daily maximum of integration requests with other integrations. KoppelHet only requests what changed since the previous round.
On-call staff in care and childcare often get a series of short contracts. If a new contract follows within an agreed period, the existing account reopens instead of a new account each time.
In care, many staff do not work at a desk. The job from HR2day decides whether someone gets a frontline licence or a full Microsoft 365 licence.
KoppelHet can write the data directly into Entra ID or through Microsoft's API-driven inbound provisioning; the latter has a daily limit that depends on your Entra licence.
Because the first working day is in Entra ID, an organisation with Entra ID Governance can have actions start automatically on that day, such as a one-time access code for the manager.

This integration is also part of joiner, mover, leaver.

How we build and run it

The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
Every sync and every error is visible in the functional log; on an error your administrator is notified.
A change that cannot go through is not half-applied but queued for another attempt.
KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
After go-live we manage the integration and adjust it when your process changes.
The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.

Implementation, architecture and compliance

Implementation and price

This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.

A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.

Price indication · Basic

Customer cases

How it runs at customers

How these organisations use the integration. The configuration differs for each customer.

Tabijn

Education

Tabijn uses HR2Day as the source for Entra ID, and Entra ID as the source for ESIS. New staff get an account automatically, leavers are deactivated, and in ESIS everyone gets access to the schools where they work.

Read the customer story

Budget Thuis

Energy

A change in HR2Day creates or updates the user in Entra ID, with job title, department, employer, employment type and manager.

Frequently asked questions

What about interns and volunteers?

If they are in HR2day they can get an account with their own employment type and limited groups. If they are not, they stay outside the integration.

What does our HR2day administrator need to arrange?

An integration user with read-only access to employees, contracts and departments. We do this together; nothing changes in how HR2day itself is set up.

Does this also work with on-premises Active Directory?

Yes, through a small program in your network.

Technical details for IT

For those who want to know how it works under the hood: APIs, fields and sources used.

HR2day is read through the Salesforce REST API on the HR2day objects (custom objects with a namespace), filtered on last modified date, through a connected app with a read-only integration user. API calls count towards the Salesforce org's daily limit.
Entra ID is written through Microsoft Graph, or through API-driven inbound provisioning (bulkUpload endpoint, daily limit per tenant depending on the Entra licence).
Fields include employeeId, givenName, surname, userPrincipalName, mail, mailNickname, jobTitle, department, manager, employeeType, employeeHireDate and accountEnabled.
With employeeHireDate a Lifecycle Workflow in Entra ID Governance can send a Temporary Access Pass on the first working day.

Which fields are transferred

The key fields. The full mapping is agreed per customer.

Field in HR2day	Field in Microsoft Entra ID	Notes
`Personeelsnummer`	`employeeId`
`Roepnaam`	`givenName`
`Tussenvoegsel + Achternaam`	`surname`
`Naamgevingsregel`	`userPrincipalName, mail en mailNickname`
`Functie`	`jobTitle`
`Afdeling`	`department`
`Leidinggevende`	`manager`
`Soort arbeidsrelatie`	`employeeType`	For example permanent, on-call or intern
`Begindatum arbeidsrelatie`	`employeeHireDate`
`Einddatum laatste arbeidsrelatie`	`accountEnabled = false`

Sources