Identity and access management
Keka to Entra ID integration: accounts from the joining date, blocked on the exit date
With an integration between Keka and Microsoft Entra ID, a new employee from Keka gets a user with job title, groups and manager that is only switched on on the joining date and is blocked on the exit date. KoppelHet builds that integration on Keka's API and writes to Entra ID through Microsoft Graph.
What the integration does
Organisations that use Keka and have Microsoft 365 as their workplace often enter new colleagues in Keka weeks before they start. The account should not work yet, and on an exit it must close on a fixed date.
- We record what must happen to accounts on joining and exit.
- KoppelHet creates the account blocked and switches it on on the joining date, with groups per Keka group.
- On the exit date KoppelHet blocks the account; if HR withdraws the exit, it opens again.
What to watch for with Keka and Microsoft Entra ID
- Anyone who enters new colleagues in Keka weeks before they start does not want them to have a working account yet. KoppelHet creates the account blocked and only switches it on on the joining date.
- A new account in Entra ID needs a first password or a Temporary Access Pass. We agree in advance how that reaches the new colleague.
- On a name change after a marriage KoppelHet can change the UPN and keep the old address as an alias, so IT does not have to change the address by hand in Entra ID.
- An exit in Keka has an exit date and an exit status, and the API shows whether someone is in their notice period. KoppelHet blocks on the exit date and switches the account back on if Keka reports a cancelled exit.
- Besides the direct manager, Keka also knows a second-level manager and a dotted-line manager. Entra ID has one manager field; KoppelHet fills it with the direct manager and does not pass on the other relationships.
- If the accounts come from your own Windows domain that synchronises to the cloud through Entra Connect, KoppelHet writes to that domain instead of directly to Entra ID.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Does salary data from Keka go to Entra ID?
No. KoppelHet only reads the employee data for the account; Keka's Employee API contains no salary.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Keka API (https://{company}.keka.com/api/v1) with a token from login.keka.com/connect/token (client_id, client_secret, api_key, scope kekaapi). GET /hris/employees with lastModified, employmentStatus (Working, Relieved) and inNoticePeriod; fields email, jobTitle, groups, reportsTo, l2Manager, joiningDate, exitDate, exitStatus and countryCode. Fifty requests per minute. Event triggers as webhooks, including exitCancelled. To Entra ID through Microsoft Graph or API-driven inbound provisioning.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Keka | Field in Microsoft Entra ID | Notes |
|---|---|---|
employeeNumber | employeeId | At most 16 characters |
firstName, lastName en displayName | givenName, surname en displayName | |
email | userPrincipalName en mail | |
jobTitle | jobTitle | |
groups | department en groepslidmaatschap | |
reportsTo | manager | |
countryCode | usageLocation | |
joiningDate | employeeHireDate en accountEnabled = true | |
exitDate | employeeLeaveDateTime en accountEnabled = false |
Related
Keka → Active Directory
Keka to Active Directory integration: domain accounts per office, with expiry on the exit date
Keka → ADP iHCM
Keka to ADP iHCM integration: salary structure, variable payouts and leavers of the Dutch pay group to ADP
Keka → AFAS Profit
Keka to AFAS integration: Dutch employees from Keka in payroll
Keka → Arbodienst (SIVI)
Keka to the occupational health service via SIVI: sickness leave requests as absence reports