Identity and access management
Lucca to Active Directory integration: accounts in your own domain based on Lucca
With an integration between Lucca and Active Directory, a new employee from Lucca gets an account in your own domain, in the folder of their business establishment and with job title, department and manager. As soon as the employment in Lucca ends, the account is disabled and expires on the end date.
What the integration does
Organisations with Lucca as their HR system and their own Active Directory, often with Entra Connect to Microsoft 365, have the service desk create accounts based on a form or email. A branch in France and one in the Netherlands then each develop their own habits, and leavers remain until someone notices them.
- In Lucca the administrator creates an OAuth client for KoppelHet; the domain gets a KoppelHet agent with rights on only the integration's folders.
- Lucca reports new employees and changes to the KoppelHet platform; the agent collects the tasks there through an outbound connection.
- An employee with status upcoming gets a disabled account in their establishment's folder, which is enabled on the start date.
- The email address from the domain goes back to Lucca.
- At the end of the employment the agent disables the account and moves it to a folder for leavers.
What to watch for with Lucca and Active Directory
- Lucca cannot connect to a server in your network. Notifications from Lucca therefore arrive on the KoppelHet platform, and the agent in the domain collects them there. No inbound port has to be opened.
- A username in Active Directory may have at most 20 characters and no characters such as / or [. Lucca is widely used for French colleagues with names such as Benoît or Anaïs. KoppelHet converts accents for the username and keeps the display name as Lucca has it.
- Lucca gives each employee the status upcoming, active or deactivated, calculated from their employments. KoppelHet creates the account disabled at upcoming, enables it at active and disables it at deactivated, so IT never has to compare dates itself.
- An employment in Lucca has an end date, and one employee's employments never overlap. KoppelHet sets that end date as the account's expiry date. Active Directory then refuses sign-in itself after that day, even if the agent cannot be reached at that moment.
- In Lucca the establishment is attached to the job position, not to the employee. A transfer to another establishment is a new position with its own start date. KoppelHet moves the account to the new establishment's folder on that date, so group policy per location changes on time.
- Lucca keeps notifications for two months, even if they were not delivered. After an outage of the agent or the network, KoppelHet still collects missed notifications, and the nightly comparison catches the rest.
- Lucca has a unique field per employee for a number in another system. KoppelHet puts the objectGUID or account number from Active Directory there, so HR can see in Lucca which account an employee is linked to.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Does a port have to be opened in our firewall?
No. The agent only makes an outbound connection to the KoppelHet platform.
Does this also work if we only have Entra ID?
Yes, then KoppelHet writes directly to Entra ID without an agent.
What rights does the agent have in our domain?
Only on the integration's folders: creating, changing and disabling accounts. No domain administrator.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Lucca API (v5, header Api-Version 2024-11-01) with OAuth 2.0: employees (status, email, remoteId unique up to 100 characters), employments (start.date, end.date, legalEntity), job-positions (jobTitle, department, businessEstablishment, manager). Webhooks employee.* and employment.*; events kept for two months. Limit 50 requests per minute per tenant.
- A KoppelHet agent in the domain collects tasks through an outbound connection and only has rights on the integration's OUs. AD attributes employeeID, sAMAccountName (at most 20 characters), userPrincipalName, mail, title, department, physicalDeliveryOfficeName, company, manager, accountExpires and userAccountControl. Entra Connect then takes the account along to Entra ID.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Lucca | Field in Active Directory | Notes |
|---|---|---|
employee.id | employeeID | |
givenName | givenName | |
familyName | sn | |
Naamgevingsregel zonder accenten | sAMAccountName | At most 20 characters |
Naamgevingsregel | userPrincipalName en mail | |
applicableJobPosition.jobTitle | title | |
applicableJobPosition.department | department | |
applicableJobPosition.businessEstablishment | physicalDeliveryOfficeName en OU | |
applicableJobPosition.manager | manager | |
employment.legalEntity | company | |
employment.end.date | accountExpires en userAccountControl |
Related
Lucca → ADP iHCM
Lucca to ADP iHCM integration: fixed and variable pay from Lucca Compensation to Dutch ADP payroll
Lucca → AFAS Profit
Lucca to AFAS integration: employees and pay of the Dutch entity from Lucca in AFAS
ASLucca → Arbodienst (SIVI)
Lucca to the occupational health service via SIVI: confirmed sickness per half day as absence reports
Lucca → DATEV
Lucca to DATEV integration: German joiners, leavers and master data from Lucca to DATEV