Identity and access management
Officient to Active Directory integration: AD accounts from Exact Officient
With an integration between Officient and Active Directory, KoppelHet creates an AD account for every new person in Exact Officient, in the organisational unit of their team and with job and manager. The last day of employment from Officient becomes the account's expiry date, so access stops on time.
What the integration does
Organisations that use Exact Officient as their HR system and manage their accounts in their own Active Directory often keep the two aligned by hand. IT hears about new colleagues and leavers by email or a ticket, and a team change in Officient rarely leads to another folder or group in AD.
- In Officient we set webhooks for people, teams, roles and managers to the KoppelHet platform.
- In the domain a small KoppelHet program runs that only connects outbound and collects the jobs.
- For a new person the program creates the account in the team's organisational unit, with the agreed logon name.
- On a team change the program moves the account and switches the groups; job and manager are updated.
- The last day of employment becomes the expiry date; after that the program disables the account and moves it to the leavers folder.
What to watch for with Officient and Active Directory
- Officient resends a webhook as long as it does not get status 200 back. The notifications arrive on the KoppelHet platform, not in the domain; if the program in the network is off for a while, the jobs are waiting and Officient never needs to reach your servers.
- In Officient a person belongs to one team, and a team change has its own webhook. KoppelHet uses the team as the organisational unit and moves the account on that notification, so group policy and groups belong to the new team straight away.
- Officient stores a Dutch name in parts, with name prefix and optionally the partner's name. KoppelHet puts prefix and last name together in sn and leaves the prefix out of the logon name, so it stays under twenty characters.
- The end of employment is stored in Officient as a date. accountExpires counts in UTC; KoppelHet converts the date from Belgian or Dutch time and sets the expiry at the end of the last day.
- When someone returns, Officient reports it with person_reactivated. KoppelHet enables the old account again, takes it out of the leavers folder and sets the expiry back to never.
- If HR deletes a person in Officient, a person_deleted notification arrives. KoppelHet does not delete an AD account on that notification, but disables it; that way the link with mailbox and files remains until IT decides.
- Officient passes the manager on as the id of another person. Active Directory expects the distinguished name of an account; KoppelHet looks it up through the Officient id in employeeID, so a manager who changes team also stays correct.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Does the integration see wage or national number?
It does not use those fields and does not put them in Active Directory. Only name, work email, team, job, manager and dates are passed on.
Does this also work with Entra ID only?
Yes. KoppelHet then writes directly to Entra ID and the program in the domain is not needed.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Officient through the REST API (api.officient.io/1.0, bearer token, scope personal.info:read): GET /people/{id}/detail with first_name, last_name, name_parts (insertion, last_name_partner), email, team, current_role, current_reports_to and employment.last_employment_date. Webhooks person_added, person_updated, person_deleted, person_reactivated, person_team_updated, person_manager_updated and person_role_updated; body with account, event_type and related_object_id. At most 30 calls per 5 seconds.
- A KoppelHet agent in the domain applies the changes through an outbound connection. AD attributes include employeeID, sAMAccountName (at most 20 characters), userPrincipalName, mail, givenName, sn, displayName, title, department, manager and accountExpires (FILETIME in UTC; 0 or 0x7FFFFFFFFFFFFFFF means never); an OU per team and an OU for leavers.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Officient | Field in Active Directory | Notes |
|---|---|---|
id (person) | employeeID | Key between both systems |
first_name | givenName | |
name_parts.insertion en last_name | sn en displayName | |
Naamgevingsregel | sAMAccountName en userPrincipalName | Logon name at most 20 characters |
email | mail | |
team.name | department, OU en groep | |
current_role.name | title | |
current_reports_to.person_id | manager | Distinguished name of the manager |
employment.last_employment_date | accountExpires |
Related
Officient → ADP iHCM
Officient to ADP iHCM integration: Dutch wages and leavers from Exact Officient to ADP iHCM
Officient → AFAS Profit
Officient to AFAS integration: Dutch employees from Exact Officient in AFAS Profit Payroll
ASOfficient → Arbodienst (SIVI)
Officient to the occupational health service via SIVI: absence periods from Exact Officient as absence reports
Officient → DATEV
Officient to DATEV integration: German employees from Officient to the tax adviser using DATEV