Identity and access management
Personio to Entra ID integration: Microsoft accounts that follow Personio
With an integration between Personio and Microsoft Entra ID, every new colleague in Personio automatically gets a Microsoft account with manager, groups and licence, and that account follows a new job or department. On the last working day sign-in is closed, even if IT did not see the message from HR.
What the integration does
Organisations with Personio for HR and Microsoft 365 for work have onboarding neatly in Personio, but IT often only creates the account in Entra ID when the new colleague calls to say they cannot log in. On departure it depends on whether IT has seen the message from HR.
- HR enters a new colleague in Personio, with start date, department, position and manager.
- KoppelHet picks up the change straight away and derives the email address from the agreed naming rules.
- The Microsoft account is ready, with manager and groups per department and country; the licence follows through the group.
- A new department, position or manager in Personio updates the account and groups.
- As soon as HR enters the departure, the leaving date is in Entra ID too. On the last working day sign-in is blocked.
What to watch for with Personio and Microsoft Entra ID
- Personio holds a last working day and a termination date, which can be weeks apart because of leave taken. KoppelHet blocks on the last working day; the termination date only decides when the account is cleaned up afterwards.
- Personio reports the changes that matter for the account, such as department, position, manager, status and leaving dates. A new address or salary therefore causes no needless change in Entra ID.
- Personio retries a notification for up to three days, and notifications from the last thirty days can be requested again. After an outage on our side we recover missed changes that way.
- Personio knows whether someone is own staff or external. That goes to Entra ID, so IT can restrict externals with separate groups and access rules.
- Because the leaving date is in Entra ID, an organisation with Entra ID Governance can attach its own automated actions for leavers to it.
- In Personio the integration may only read persons and employments. Salaries and absences are left out, so salary data never enters the account integration.
- Personio holds a legal entity per country. The country decides the email domain and which licence is possible, so a colleague in another country gets the right domain and licence.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Can the email address go back to Personio?
It can, but the integration then also needs to write in Personio. We only do it if you want to; by default the integration only reads.
What if HR forgets to enter the last working day?
We then block on the termination date and HR gets a notice in the platform that the last working day is missing.
Are employees with status inactive or leave included too?
An employee on long leave keeps their account. Status inactive without a termination date is treated as an exception that HR confirms first.
Does this work if we are hybrid, with on-premises Active Directory?
Yes, KoppelHet then writes to Active Directory through a small program in your network.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Personio is read through webhooks (employment.updated fires on department, position, supervisor, status, last_working_day and termination date, among others) and the Personio API v2, with read scopes on persons and employments only. Webhooks are retried for up to three days; events from thirty days can be redelivered.
- Entra ID is written through Microsoft Graph. employeeId (Personio id), givenName, surname, userPrincipalName, mail, mailNickname, jobTitle, department, manager, companyName, employeeType (INTERNAL or EXTERNAL to Employee or Contractor), employeeHireDate, usageLocation, employeeLeaveDateTime and accountEnabled.
- Writing employeeLeaveDateTime requires the Graph permission User-LifeCycleInfo.ReadWrite.All; it enables Lifecycle Workflows in Entra ID Governance.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Personio | Field in Microsoft Entra ID | Notes |
|---|---|---|
id (person) | employeeId | The Personio ID is the fixed key between both systems |
preferred_name of first_name | givenName | Preferred name when filled |
last_name | surname | |
Naamgevingsregel | userPrincipalName, mail en mailNickname | |
position | jobTitle | |
org_units (afdeling) | department | |
supervisor | manager | Through the Entra account holding the manager's employeeId |
legal_entity | companyName | |
type (INTERNAL/EXTERNAL) | employeeType | Employee or Contractor |
employment_start_date | employeeHireDate | |
last_working_day | employeeLeaveDateTime en accountEnabled | Block on the last working day, not on the contract end date |
Related
Ashby → Personio
Ashby to Personio integration: hires with hours and entity as new employees in Personio
Bullhorn → Personio
Bullhorn to Personio integration: placements as a person with employment in Personio
Carerix → Personio
Carerix to Personio integration: successful placement as a new employee in Personio
Greenhouse → Personio
Greenhouse to Personio integration: hired candidates as employees in Personio