Identity and access management
Nedap ONS to Entra ID integration: Microsoft accounts and team groups for care staff
With an integration between Nedap ONS and Microsoft Entra ID, every care worker scheduled in ONS automatically gets a Microsoft account for Teams and Outlook, in the groups of their teams. An agency worker or stand-in gets an account that stops by itself when the contract ends.
What the integration does
Anyone who schedules and records care work in Nedap ONS already has new employees, flex pool substitutes and agency workers there before their first shift, with their team. The team leader requests an account for Teams and Outlook separately from ICT, and after a team change the groups in Microsoft 365 are soon out of date.
- Planning adds a new care worker in ONS, with contract and team.
- KoppelHet picks up the change straight away and fetches employee, contracts and teams.
- The Microsoft account is ready, with the name as the employee uses it in ONS, and in the group of every team they work in.
- When a team assignment starts or ends, the groups follow on the date from ONS.
- After the last contract sign-in is blocked and after an agreed period the account is cleaned up.
What to watch for with Nedap ONS and Microsoft Entra ID
- Nedap issues a separate digital key per care organisation for the integration. KoppelHet requests and manages it per customer, and Nedap reviews the integration before it goes live.
- ONS holds a birth name, a partner name and a name usage preference per person. The sign-in name follows the birth name and the display name the name usage, so a marriage or divorce does not affect the login.
- A care worker can be in several teams at once, each with its own start and end date. Every team assignment becomes an Entra ID group membership with the same duration, so a stand-in also leaves the team group after their last period in that team.
- ONS distinguishes own and external staff. Externals, such as agency workers, are marked as external in Entra ID, so IT can restrict their access with separate groups and rules.
- The email address in ONS is a contact address, sometimes private. KoppelHet does not use it as the sign-in name; the work address is created in Entra ID according to your naming rules.
- Nedap advises always checking periodically alongside instant notifications. KoppelHet therefore regularly requests what changed since the previous round, so a missed notification is still processed.
- Expertise profiles in ONS state which procedures someone is qualified for. Groups based on them give only qualified staff access to apps and SharePoint sites for those procedures.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Is ONS really the source, rather than our HR system?
It depends on where an employee appears first. If stand-ins and agency workers are only in ONS, ONS is the best source for accounts. If everyone is also in the HR system, that can be the source and we add the teams from ONS.
Can staff sign in to ONS with their Microsoft account?
ONS supports single sign-on per user. Whether the integration can set that up in ONS, we look at per customer together with Nedap.
Who arranges access to ONS?
The care organisation gives KoppelHet permission, and Nedap reviews the integration before it goes live. KoppelHet requests and manages the access.
Does this also work with on-premises Active Directory?
Yes, through a small program in the care organisation's network.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Nedap ONS is read through the Ons API, with webhooks for employees and team assignments and the date-based updates endpoints as a safety net. Access with a Nedap-signed client certificate carrying the customer code, requested through the Ons API Dashboard.
- Entra ID is written through Microsoft Graph. employeeId from identificationNo; UPN on birthName and birthNamePrefix; employeeType Employee or Contractor from type (0 Regular, 1 External); group membership per TeamAssignment and ExpertiseProfileAssignment; accountEnabled = false after the last contract.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Nedap ONS | Field in Microsoft Entra ID | Notes |
|---|---|---|
identificationNo | employeeId | The employee number from Ons |
firstName | givenName | |
lastName en prefix | surname | Ons already applies the chosen name usage |
birthName en birthNamePrefix | Basis voor userPrincipalName | So a change in name usage does not change the login |
type (0 Regular, 1 External) | employeeType | Employee or Contractor |
TeamAssignment (teamObjectId, beginDate, endDate) | Groepslidmaatschap per team | |
ExpertiseProfileAssignment | Groepen voor deskundigheid | For example access to an app for nursing procedures |
teamName (hoofdteam) | department | |
Contract beginDate | employeeHireDate | |
Contract endDate (laatste) | accountEnabled = false |
Related
HR2day → Nedap ONS
HR2day to Nedap ONS integration: employment relationships, collective agreement and contract hours automatically in care scheduling
Nedap ONS → Active Directory
Nedap ONS to Active Directory integration: accounts per care location, automatically
Nedap ONS → Google Workspace
Nedap ONS to Google Workspace integration: Google accounts and team groups for care staff
Nedap ONS → JumpCloud
Nedap ONS to JumpCloud integration: care staff and teams as the source for JumpCloud