Identity and access management
Remote to Active Directory integration: accounts for colleagues in other countries
With an integration between Remote and Active Directory, everyone working through Remote, also in a country without an office of your own, automatically gets an account in Active Directory, in the folder for their country and with job, department and manager. On the end date Remote confirms after offboarding, the account expires by itself.
What the integration does
Organisations that hire colleagues abroad through Remote and run their own Active Directory often create those accounts by hand. Remote is separate from their own payroll, so these people fall outside the existing integration with the HR system, and their accounts often simply stay active after they leave.
- IT installs KoppelHet's program once on a server in the domain, and the Remote administrator creates a key for the integration.
- HR creates an employment in Remote. KoppelHet creates the account in the folder for the country, still disabled.
- As soon as Remote passes on the work email, the account gets that address and the matching sign-in name.
- Shortly before the expected start date the account is enabled, with job, department and manager filled in.
- After a confirmed offboarding the account gets the end date as its expiry date and then moves to the leavers folder.
What to watch for with Remote and Active Directory
- Remote has EOR employees, contractors, own employees and employees who are only paid through Remote. KoppelHet records the type of engagement in Active Directory, so group policy can, for example, keep a contractor out of the internal file shares.
- An employment carries the country as a two-letter code. Active Directory uses the same kind of code for its country field, so KoppelHet can take the country over directly and use a separate folder and group policy per country.
- Remote passes the manager on as a reference to their own employment, with name and email. If the manager does not work through Remote, KoppelHet looks up the account by that email address. If that fails, the field stays empty and IT gets a notification.
- At Remote the work email is sometimes only fixed after the rest of the employment exists, and Remote reports that change separately. KoppelHet creates the account earlier, disabled, and only fills in the sign-in name once the work email is there.
- Remote gives an expected start date for an employment, which can still shift because of visas or notice periods elsewhere. KoppelHet only enables the account shortly before that date and checks again on every change, so there is no active account for someone who starts later.
- The end date of an offboarding is only fixed at Remote after their check against the country's rules. KoppelHet uses the confirmed date and sets it as the account's expiry date, so it expires even if the integration does not run that day.
- Remote only retries a notification on a connection error. The program in your network is therefore not exposed to Remote itself; notifications arrive on the KoppelHet platform, and the daily comparison catches a missed notification.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Our own employees already reach Active Directory from AFAS. Does that clash?
No. The Remote integration only manages the accounts in the folders for the countries where Remote is the employer. We agree who leads if someone moves from one to the other.
Does this also work if we only use Entra ID?
Yes, KoppelHet then writes to Entra ID instead of Active Directory. Countries, groups and timing stay the same.
Does the integration see salary data from Remote?
It does not request it and puts none of it in Active Directory. Only name, work email, job, department, country, manager and the dates are passed on.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Remote is read through the Remote API with a company-scoped token. Initial load with GET /v1/employments, details per employment with GET /v1/employments/{employment_id} (including work_email, job_title, department, country.alpha_2_code, manager_employment_id, manager_email, provisional_start_date, type, employment_model, short_id and on offboarding termination_date). After that signed webhooks on employment.details.updated, employment.work_email.updated, employment.status.updated and offboarding.*.
- A KoppelHet agent in the domain applies the changes through an outbound connection. AD attributes include employeeID, sAMAccountName (at most 20 characters), userPrincipalName, mail, title, department, c (ISO 3166 two-letter), manager (distinguished name), employeeType and accountExpires; an OU per country and an OU for leavers.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Remote | Field in Active Directory | Notes |
|---|---|---|
short_id van de employment | employeeID | KoppelHet stores the long employment ID itself as the key |
Naamgevingsregel uit full_name | sAMAccountName | At most 20 characters |
work_email | userPrincipalName en mail | |
job_title | title | |
department | department | |
country.alpha_2_code | c en OU per land | Two-letter country code |
manager_employment_id | manager | Only if the manager has an account |
type en employment_model | employeeType | |
termination_date | accountExpires |
Related
Greenhouse → Remote
Greenhouse to Remote integration: foreign hires as EOR employment with the country's form
Recruitee → Remote
Recruitee to Remote integration: hires abroad straight into an employment at Remote
Remote → 4PS Construct
Remote to 4PS Construct integration: own employees of the construction entity from Remote in 4PS
Remote → AFAS Profit
Remote to AFAS integration: only your own entity's employees from Remote to AFAS Profit