Identity and access management
Remote to Entra ID integration: Microsoft accounts for employees through Remote, in every country
With an integration between Remote and Microsoft Entra ID, every employee hired through Remote gets a Microsoft account with job title, department, manager and the country of their employment. The new work address goes back to Remote, and the account is only blocked on the end date Remote has confirmed after its country check.
What the integration does
Organisations that hire people through Remote in countries without their own entity often create Microsoft accounts as soon as the contract is signed. Someone who drops out during onboarding then keeps an account, Remote meanwhile emails the personal address, and on departure IT blocks on a date Remote later moves.
- The organisation creates an API token in Remote with only the scopes the integration needs, and registers KoppelHet's webhook.
- On a new employment KoppelHet prepares a disabled account with the country of employment.
- Once onboarding at Remote is complete, KoppelHet enables the account for the start date and sets the work address in Remote.
- Changes in job title, department or manager follow through Remote's notifications.
- On an offboarding KoppelHet waits for the confirmed end date and sets it as the leaving date in Entra ID.
Back: KoppelHet sets the Microsoft account's address as the work_email on the employment in Remote, and the Entra number as its own reference.
What to watch for with Remote and Microsoft Entra ID
- Remote can update the work address through the API for an employment that is invited or active, but not for contractors. KoppelHet therefore writes the Microsoft account's address back for employees, and puts contractors on a list so HR fills in the address in Remote.
- Remote offers employees as SCIM users, with department, employee number and manager in the enterprise extension, read only. Entra ID's HR API expects SCIM. KoppelHet therefore passes the users from Remote on with little translation, and only adds the country and dates from the employment.
- Remote's SCIM list can only filter in the form field eq value. A request for everything changed since yesterday is not possible there; KoppelHet uses Remote's notifications for changes and the SCIM list only for the daily full comparison.
- An employment at Remote first goes through invitation and onboarding. KoppelHet does prepare the account in advance, but only enables it when onboarding is complete, so someone who drops out can never log in.
- On an offboarding Remote first checks the rules of the country, after which the end date can move. KoppelHet only sets the leaving date in Entra ID once Remote has processed the offboarding, so the block does not fall on a proposed date.
- A confidential offboarding is not in Remote's normal list. For accounts it does have to be included; KoppelHet therefore requests confidential requests explicitly, uses only the end date, and shows nothing of the reason in Entra ID.
- Employees through Remote work in very different countries, and Microsoft wants a usage location per account before a licence can be assigned. KoppelHet fills it from the country of the employment, so a new colleague in Portugal or Brazil has a licence on day one.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Are our own employees from AFAS or another HR system included too?
Those run through their own source. Per source we record which accounts belong to it, so Remote and the other system do not overwrite each other.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Remote through the Remote API (gateway.remote.com) with a Customer API token with the chosen scopes. GET /v1/employments and the SCIM endpoints GET /v1/scim/v2/Users and /Groups (read only, filter only 'attribute eq value'); webhooks including employment.work_email.updated, signed with X-Remote-Signature. Confidential offboardings only with include_confidential.
- Write-back with PATCH /v1/employments/{employment_id} (work_email for invited and active, external_id for every status; contractors not through the API), scope employment:write.
- To Entra ID through API-driven inbound provisioning (POST /bulkUpload with SCIM, at most 50 operations per call) or Microsoft Graph (user with employeeId, usageLocation, jobTitle, department, manager, employeeType, employeeHireDate, employeeLeaveDateTime, accountEnabled).
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Remote | Field in Microsoft Entra ID | Notes |
|---|---|---|
employment id | employeeId | |
Naam (SCIM name.givenName, name.familyName) | givenName, surname, displayName | |
job_title | jobTitle | |
department (SCIM enterprise extension) | department | |
manager (SCIM enterprise extension) | manager | |
country van de employment | usageLocation | Needed for licences |
employment_type en employment_model | employeeType | |
Bevestigde einddatum offboarding | employeeLeaveDateTime en accountEnabled | |
userPrincipalName (Entra ID) | work_email | Return to Remote |
Related
Greenhouse → Remote
Greenhouse to Remote integration: foreign hires as EOR employment with the country's form
Recruitee → Remote
Recruitee to Remote integration: hires abroad straight into an employment at Remote
Remote → 4PS Construct
Remote to 4PS Construct integration: own employees of the construction entity from Remote in 4PS
Remote → Active Directory
Remote to Active Directory integration: accounts for colleagues in other countries