Identity and access management
Officient to Entra ID integration: Microsoft 365 accounts from Exact Officient
With an integration between Officient and Microsoft Entra ID, every new person in Exact Officient automatically gets an account in Entra ID, with team, job, manager and the right language. After the last day of employment in Officient sign-in is blocked, and a reactivated colleague gets their old account back.
What the integration does
Organisations that use Exact Officient for HR and work with Microsoft 365 often still have IT create accounts by hand, and an end of employment in Officient only reaches Entra ID if someone remembers.
- In Officient the administrator creates a client app for KoppelHet and sets webhooks for people, teams, roles and managers to KoppelHet's address.
- On a notification KoppelHet fetches the person's detail, because the notification itself only contains the id.
- For a new person KoppelHet creates the account with the agreed naming, in the team's group.
- KoppelHet updates changes of team, job or manager in Entra ID, including the groups.
- After the last day of employment KoppelHet blocks sign-in; on a reactivation the same account opens again.
What to watch for with Officient and Microsoft Entra ID
- Officient has separate webhooks for a changed team, a new manager and a new role. KoppelHet uses them to update only that field and the groups, without rewriting the whole account.
- An Officient notification only contains the account, the event type and the person's id. KoppelHet then fetches the detail, and keeps the nightly comparison within the limit of thirty calls per five seconds.
- Officient stores the preferred language as a two-letter code, such as nl or fr. Entra ID expects language and country together, such as nl-BE or fr-BE. KoppelHet adds the country per company, so Microsoft 365 greets a French-speaking colleague in Brussels in French.
- For the manager, Officient has an extra manager next to the regular one. Entra ID has one field for the manager. KoppelHet puts the regular manager there and can use the extra manager as owner of the team group.
- Officient reports with person_reactivated that someone returns. KoppelHet then finds the existing account through the Officient id in employeeId and enables it again, instead of creating a second account with a sequence number.
- According to its own documentation, Officient only fills the payroll provider's employee number for certain Dutch integrations. For the key KoppelHet therefore uses the person's fixed id in Officient, which exists for every Belgian and Dutch employee.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
What if a new person in Officient has no work email yet?
Then KoppelHet determines the address with the agreed naming rule. Writing the address back to Officient can follow later as an extension.
Does this also work with Active Directory in our own network?
Yes, through a small program in the domain that collects the jobs through an outbound connection.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Officient through the REST API (api.officient.io/1.0) with a bearer token from a dedicated client app (scope personal.info:read): GET /people/{id}/detail with email, team, current_role, current_reports_to (person_id, extra_manager_id), employment (first_employment_date, last_employment_date) and preferred_language_code. Webhooks person_added, person_updated, person_deleted, person_reactivated, person_team_updated, person_manager_updated and person_role_updated (body with account, event_type and related_object_id); resent on any status other than 200. At most 30 calls per 5 seconds, above that 429.
- Entra ID through Microsoft Graph with application permissions: employeeId (at most 16 characters), givenName, surname, mail, userPrincipalName, department (at most 64), jobTitle, manager through $ref, preferredLanguage (RFC 4646, for example nl-BE), employeeHireDate, employeeLeaveDateTime (User-LifeCycleInfo.ReadWrite.All) and accountEnabled.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Officient | Field in Microsoft Entra ID | Notes |
|---|---|---|
id (person) | employeeId | Key between both systems |
first_name, last_name | givenName, surname en displayName | |
email | mail | Empty for a new person: naming rule |
team.name | department en groep | |
current_role.name | jobTitle | |
current_reports_to.person_id | manager | |
preferred_language_code | preferredLanguage | Completed with country code, for example nl-BE |
employment.first_employment_date | employeeHireDate | |
employment.last_employment_date | employeeLeaveDateTime en accountEnabled = false |
Related
Officient → Active Directory
Officient to Active Directory integration: AD accounts from Exact Officient
Officient → ADP iHCM
Officient to ADP iHCM integration: Dutch wages and leavers from Exact Officient to ADP iHCM
Officient → AFAS Profit
Officient to AFAS integration: Dutch employees from Exact Officient in AFAS Profit Payroll
ASOfficient → Arbodienst (SIVI)
Officient to the occupational health service via SIVI: absence periods from Exact Officient as absence reports