Identity and access management
Loket to Entra ID integration: Microsoft accounts from payroll
With an integration between Loket and Microsoft Entra ID, a new employee in Loket gets a Microsoft account with the right name, department, employer and photo, and sign-in is blocked after the end of employment. IT no longer waits for a message from payroll.
What the integration does
Employers that have a payroll bureau process salaries in Loket and work in Microsoft 365 often pass new colleagues to IT by email, sometimes only after the first working day. Leavers keep their account until someone goes through the list.
- A user with the right permissions in Loket grants the integration access once; that access is renewed afterwards.
- KoppelHet fetches the changes per employer since the previous round.
- For a new employee KoppelHet creates the Microsoft account, with the employer's domain, the name as the employee uses it and the department from Loket.
- If there is a photo in Loket, it goes onto the account, so colleagues see it in Teams and Outlook.
- After the end of employment KoppelHet blocks sign-in and removes the employee from the groups.
What to watch for with Loket and Microsoft Entra ID
- Loket has no notifications to other systems; event messages only go to people by email. KoppelHet therefore requests the changes Loket has recorded per employer since the previous round.
- Loket keeps name prefix, surname and partner's name separately, and also provides a formal form such as "Wiel - van Bergen S.L. van de". That suits a payslip, not Teams. KoppelHet composes the display name as the employee calls themselves, for example "Susan van de Wiel - van Bergen".
- Loket has a photo per employee, intended as a profile picture. KoppelHet puts it on the Microsoft account, so the photo from the personnel records also appears in Teams and Outlook.
- Access to Loket runs through a one-off consent from a Loket user, which is then renewed. We have that consent given by a separate user with read-only rights, so the integration does not stop when a payroll staff member leaves.
- Employee numbers in Loket are per employer. With several employers in one environment KoppelHet puts an employer code in front of the number in Entra ID, so employee 156 of one employer does not merge with 156 of another.
- A new employee can first exist as a concept in Loket. KoppelHet only creates the account once payroll has converted the concept, or already at the concept stage if you agree, so a withdrawn hire does not produce an account.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
A payroll bureau manages our Loket. Is that possible?
Yes. The bureau or your own administrator grants the integration read access to your employers; the bureau's other clients stay out of view.
Does the integration see salaries in Loket?
It only reads personal and employment data and the photo. Pay, BSN and bank details do not go to Entra ID.
Does this also work with Active Directory in our own network?
Yes, we build that integration too.
What about the GDPR?
You are the controller and KoppelHet is the processor, under a data processing agreement. Every action of the integration is in the audit logging.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Loket is read through the Loket REST API with OAuth (authorization code flow with refresh token), per employer through the mutations on the employee and employment tables. Fields include employeeNumber, firstName, prefix, lastName, prefixPartner, lastNamePartner, formattedName, photo, organisational entity and start and end date of employment. Event notifications in Loket are email recipients only.
- Entra ID is written through Microsoft Graph (user with employeeId, givenName, surname, displayName, userPrincipalName, jobTitle, department, companyName, employeeHireDate and accountEnabled; profile photo through PUT photo/$value, at most 4 MB, with ProfilePhoto.ReadWrite.All).
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Loket | Field in Microsoft Entra ID | Notes |
|---|---|---|
employeeNumber (per werkgever) | employeeId | With employer code; at most 16 characters |
firstName | givenName | |
prefix, lastName, prefixPartner en lastNamePartner | surname en displayName | According to name usage, not the formal form |
Naamgevingsregel met domein per werkgever | userPrincipalName en mail | |
Functie | jobTitle | |
Organisatorische eenheid | department | |
Werkgever | companyName | |
photo | Profielfoto | At most 4 MB |
Begindatum dienstverband | employeeHireDate | |
Einddatum dienstverband | accountEnabled = false |
Related
ADP Workforce Now → Loket
ADP Workforce Now to Loket integration: hires, pay, hours and bonuses from ADP to the Dutch payroll run
AlexisHR → Loket
AlexisHR to Loket integration: employees of the Dutch company from AlexisHR into payroll
BambooHR → Loket
BambooHR to Loket integration: HR changes from BambooHR for Dutch payroll
Bullhorn → Loket
Bullhorn to Loket integration: placement as a concept employee in the right payroll administration