Identity and access management
Nmbrs to Active Directory integration: accounts from the payroll records
With an integration between Nmbrs and Active Directory, a new employee in Nmbrs automatically gets an Active Directory account, with job, department and groups, and the account is disabled after the last working day. Even without a separate HR system, IT hears about new colleagues in time, and salary data stays out of sight.
What the integration does
Organisations that run payroll in Nmbrs without a separate HR system have their only list of who works there in Nmbrs. IT manages Active Directory and hears about new colleagues through a separate message, often only on the first working day.
- IT installs a small KoppelHet program once in the own network, and someone with Nmbrs access grants the integration consent.
- Payroll enters a new employee in Nmbrs.
- The account then appears in Active Directory in the right company's folder, with function, department and manager.
- A new function or department in Nmbrs takes effect from the payroll period in which it was recorded; details and groups follow.
- After the end date of the employment the account is disabled and moved to the leavers.
What to watch for with Nmbrs and Active Directory
- If the Active Directory link currently runs on a home-grown script, that script will probably stop working after 1 March 2027, because Nmbrs retires its old integration method then. KoppelHet builds this integration on the new one from the start, so no second migration is needed.
- In Nmbrs the integration only asks for read access to personal and employment data and the company structure. It cannot see wage or salary data.
- Function and department in Nmbrs have a start period, not an exact date. A job change therefore applies per payroll period; KoppelHet applies it in Active Directory on the first day of that period.
- Functions and departments in Nmbrs are lists per company. We map each function to one or more groups. If payroll creates a new function without an agreement on groups, the employee only gets the base groups and IT sees a notice.
- A returning employee gets a new employment in Nmbrs under the same employee number. KoppelHet recognises them by it and re-enables the old account instead of creating a second one.
- One Nmbrs environment often holds several entities. Each entity gets its own folder and possibly its own email domain, so policy can differ per entity.
- Nmbrs reports changes straight away, but Active Directory sits behind your firewall. The notification arrives at the KoppelHet platform, and the program in your network collects the instruction there.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
We have no HR system, only Nmbrs. Is that enough?
Yes. Nmbrs holds name, employment, function, department and manager, and that is what Active Directory needs.
Can the email address go back to Nmbrs?
It can. We only do it if you want to, because the integration then also needs to write in Nmbrs.
Does this work if our payroll is run by an accounting firm?
Usually yes. Consent must come from an Nmbrs user with access to your companies; we agree with the firm which login that is.
What if we move to Entra ID without Active Directory?
Then the Nmbrs side stays the same and we switch the target to Entra ID.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Nmbrs is read through the Nmbrs REST API with OAuth, with read-only scopes (such as employee.employment.read) for personal and employment data and the company structure; no wage or salary scopes. Webhooks on changes, with a periodic comparison per company. The SOAP API is retired from 1 March 2027.
- A KoppelHet agent in the domain collects instructions through an outbound connection. Organizational unit (OU) and possibly UPN suffix per company.
- AD attributes include employeeID (EmployeeNumber), givenName, sn, sAMAccountName, userPrincipalName, mail, title, department, company, manager and userAccountControl.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Nmbrs | Field in Active Directory | Notes |
|---|---|---|
EmployeeNumber | employeeID | |
Nickname of FirstName | givenName | Preferred name when present in Nmbrs |
Prefix + LastName | sn | With PartnerPrefix and PartnerLastName when the name format requires it |
Naamgevingsregel | sAMAccountName, userPrincipalName en mail | |
Function (Description) | title | |
Department (Description) | department | |
Bedrijf in Nmbrs | company en OU | |
Manager (Email of Number) | manager | Matched to the AD account with the same email address or employee number |
Employment StartDate | Account inschakelen | |
Employment EndDate | userAccountControl (uitgeschakeld) |
Related
ADP Workforce Now → Nmbrs
ADP Workforce Now to Nmbrs integration: the Dutch payroll group from ADP in the right Nmbrs company
AlexisHR → Nmbrs
AlexisHR (Simployer One) to Nmbrs integration: Dutch employees into payroll
BambooHR → Nmbrs
BambooHR to Nmbrs integration: Dutch payroll next to a global HR system
Bullhorn → Nmbrs
Bullhorn to Nmbrs integration: placements with hourly pay and end date in payroll