Identity and access management
Personio to Active Directory integration: from cloud HR to your own domain
With an integration between Personio and Active Directory, a new colleague in Personio automatically gets an account in your own Active Directory, at the right office and with job title, department and manager. On the last working day the account is disabled, so IT no longer keeps an Excel list of new colleagues and leavers.
What the integration does
Organisations that have moved HR to Personio in the cloud, while the domain still runs on Active Directory in their own server room, have nothing in between. IT keeps an Excel list of new colleagues and leavers, and the departments in AD drift out of step with Personio.
- IT installs a small KoppelHet program once in the domain, with rights only on the integration's folders.
- HR enters a new colleague in Personio. KoppelHet derives username and email address.
- The account is ready in Active Directory at the Personio office, with manager and department groups, but still disabled.
- On the start date the account is enabled, and through Microsoft also in Entra ID and Microsoft 365.
- On the last working day the account is disabled and moved to the leavers.
What to watch for with Personio and Active Directory
- Personio cannot connect to a server inside your network. The change therefore arrives at the KoppelHet platform, and the program in your network collects the instruction itself.
- Besides disabling, the account gets an expiry date equal to the last working day. Active Directory then refuses sign-in itself, even if the program happens to be unreachable that day.
- Personio is often used internationally, with names such as Müller or Łukasz. An Active Directory username may hold 20 characters at most and no special characters. We transliterate accents for the username and keep the display name as Personio has it.
- An employee still in onboarding in Personio already gets an account, but disabled. It is only enabled on the start date, so someone entered early cannot sign in for weeks.
- Contractors in Personio go into their own folder. Their account also expires on the contract end date, so a forgotten extension does not lead to a forgotten account.
- Personio has departments and teams. The department shows in the address book; the team only decides which security groups someone is in. That keeps the department in the address book recognisable.
- The Personio office decides the folder. When someone moves to another office, the account moves along and that location's rules apply.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Why not straight to Entra ID?
If you run hybrid, Active Directory is the source for the accounts, and a change in Entra ID would be overwritten again. If you later move fully to the cloud, we switch the target.
Which rights does the program in our network need?
Only rights to manage accounts and groups in the folders the integration manages. No domain admin.
What happens if a notification from Personio does not arrive?
A periodic check sets Personio against Active Directory. Whatever differs is still processed and shows in the logging.
Can we keep existing accounts?
Yes. Before go-live we link existing accounts to the employees in Personio. Accounts that cannot be linked go on a list for IT.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Personio is read through webhooks and the Personio API v2, with a periodic check through the API.
- A KoppelHet agent in the domain collects instructions through an outbound connection and only has rights on the integration's organizational units (OUs), not domain admin.
- AD attributes include employeeID (Personio id, up to 16 characters), sAMAccountName (at most 20 characters, no characters such as / or [), userPrincipalName, mail, title, department, physicalDeliveryOfficeName, company, manager, accountExpires and userAccountControl. Contractors recognised by type EXTERNAL.
- Entra Connect syncs the account to Entra ID.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Personio | Field in Active Directory | Notes |
|---|---|---|
id (person) | employeeID | Up to 16 characters in AD |
preferred_name of first_name | givenName | |
last_name | sn | |
Naamgevingsregel | sAMAccountName | Without accents and 20 characters at most |
Naamgevingsregel | userPrincipalName en mail | |
position | title | |
org_units (afdeling) | department | |
office | physicalDeliveryOfficeName en OU | |
legal_entity | company | |
supervisor | manager | Distinguished name of the manager's account |
last_working_day | accountExpires en userAccountControl |
Related
Ashby → Personio
Ashby to Personio integration: hires with hours and entity as new employees in Personio
Bullhorn → Personio
Bullhorn to Personio integration: placements as a person with employment in Personio
Carerix → Personio
Carerix to Personio integration: successful placement as a new employee in Personio
Greenhouse → Personio
Greenhouse to Personio integration: hired candidates as employees in Personio