Identity and access management
Nedap ONS to Active Directory integration: accounts per care location, automatically
With an integration between Nedap ONS and Active Directory, a care worker in ONS automatically gets an Active Directory account, at the right location and in the groups of their teams. After the last contract the account is closed, and every location works by the same rules instead of each its own way.
What the integration does
Organisations that schedule shifts in Nedap ONS and have their own Active Directory, linked to Microsoft 365, already have employees and teams in ONS. Still, a key user per location often manages the accounts, and every location does it slightly differently.
- IT installs a small KoppelHet program once in the own network.
- A new employee is assigned to a team in ONS. KoppelHet derives the username.
- The account then appears in Active Directory at the main team's location, and in the groups of every team the employee works in.
- When someone changes team or location, the account moves along and the groups follow on the date from ONS.
- After the last contract the account is disabled, also in Microsoft 365.
What to watch for with Nedap ONS and Active Directory
- The key for access to ONS stays on the KoppelHet platform and never sits on the server in your network. The program there sees no client data, only the account instructions.
- ONS keeps teams and locations separately. The main team's location decides where the account sits, and each team becomes a group. Someone working at two residential locations has one account with the groups of both.
- When an employee is deleted in ONS, the integration does not delete the account itself. It is disabled and flagged to IT, because a deletion in ONS can also be the correction of a duplicate entry.
- The same integration can also assign roles in ONS itself based on team or job. The care organisation decides in ONS which roles are allowed for this, and manually assigned roles are left alone.
- ONS does not report back which roles the integration assigned before. KoppelHet therefore keeps its own record of which roles it set per user.
- The username follows the birth name from ONS, not the name someone uses. Someone who starts using their partner's name after marriage keeps the same login and only gets a new display name.
- Agency workers and freelancers in ONS go into a separate folder. Different rules apply to them, and IT sees at a glance which accounts do not belong to own staff.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Can the integration access client records?
No. The integration only requests employee and team data, and the program in your network only receives the account instructions.
Can roles in ONS be automated too?
Yes. You decide in ONS which roles the integration may assign; the content of a role stays configured in ONS.
What if a stand-in works only one shift?
You decide whether they get an account. Per contract type or team we record who needs an account.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Nedap ONS is read through the Ons API with webhooks, complemented by the date-based updates and deletes endpoints. Access with a client certificate that only lives on the KoppelHet platform.
- A KoppelHet agent in the domain carries out the changes in AD. Organizational unit (OU) per main team location; separate OU for type 1 External; security group per TeamAssignment.
- AD attributes include employeeID (identificationNo), sAMAccountName and userPrincipalName (on birthName), givenName, sn, displayName, department (teamName) and userAccountControl. Entra Connect syncs to Entra ID.
- Roles through the Ons Autorisatie provisioning API, with a whitelist. That API always overwrites the integration's full set of roles and cannot read them back.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Nedap ONS | Field in Active Directory | Notes |
|---|---|---|
identificationNo | employeeID | |
firstName | givenName | |
lastName en prefix | sn en displayName | Per the name usage in Ons |
birthName | sAMAccountName en userPrincipalName | On the birth name, so the login stays stable |
Locatie van het hoofdteam | OU en physicalDeliveryOfficeName | |
teamName | department | |
TeamAssignment | Groepslidmaatschap per team | |
type (1 External) | OU voor externen | |
Contract endDate (laatste) | userAccountControl (uitgeschakeld) |
Related
HR2day → Nedap ONS
HR2day to Nedap ONS integration: employment relationships, collective agreement and contract hours automatically in care scheduling
Nedap ONS → Microsoft Entra ID
Nedap ONS to Entra ID integration: Microsoft accounts and team groups for care staff
Nedap ONS → Google Workspace
Nedap ONS to Google Workspace integration: Google accounts and team groups for care staff
Nedap ONS → JumpCloud
Nedap ONS to JumpCloud integration: care staff and teams as the source for JumpCloud