Identity and access management
Rippling to Active Directory integration: accounts in your own domain through the hybrid app from Rippling and Microsoft
Rippling and Microsoft built an app together that creates employees from Rippling as accounts in your own Active Directory domain and disables them on offboarding, through Microsoft's provisioning agent. For an integration between Rippling and Active Directory with one domain that app is the route; KoppelHet adds to it where several domains, a second HR source or custom rules are needed.
What the integration does
Organisations that use Rippling as their HR platform and still have their own Active Directory for file servers, printers or older applications often create those accounts by hand. Rippling does handle the cloud apps, but the domain account lags behind, and a leaver can still log on to the network.
- In the domain we install the Microsoft Entra Connect provisioning agent, which makes an outbound connection.
- An administrator grants Rippling consent to create a provisioning app in Entra ID, and enters the domain and the OU for new accounts.
- We set up the field mapping and the account access rules in Rippling, and test with a test employee.
- A new employee in Rippling gets a domain account, which Entra Connect then synchronises to Entra ID.
- On offboarding in Rippling the domain account is disabled; KoppelHet monitors the logs and moves the account as agreed.
What to watch for with Rippling and Active Directory
- Rippling's hybrid app does not write to the domain itself. Rippling sends the data to Entra ID's API, and the Microsoft Entra Connect provisioning agent in the network creates the account in Active Directory. Without that agent on a server in the domain the app does not work.
- During setup the administrator specifies one domain and one OU for new accounts. If the organisation has several domains, or accounts must go into a different OU per country or department, KoppelHet adds that, for example by moving the account after it is created.
- After the domain account it also has to reach Entra ID. Rippling does not do that, Entra Connect Sync or Cloud Sync does. A new colleague therefore only has a Microsoft licence after the next synchronisation; KoppelHet plans the first working day around that.
- For accounts that reach Active Directory through this route, Microsoft relies on a Temporary Access Pass from the lifecycle workflows for the first sign-in. That requires Rippling's start date and termination date in the mapping, and an Entra ID Governance licence.
- Rippling lets you record in the account access rules who gets a domain account and from which moment. Employees who only use cloud apps, such as field staff without a domain laptop, therefore get no unnecessary domain account.
- On offboarding the app disables the domain account. According to the sources it does not move it to an OU for leavers, remove groups or delete it after a period; KoppelHet handles that with a task in the domain.
- A rehire in Rippling gives a new worker under the same user. KoppelHet checks that the mapping is based on the user, so a returning colleague gets their old domain account with folders and groups back instead of a second one.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Do we need to open a port?
No. Microsoft's provisioning agent and KoppelHet's agent both make an outbound connection.
We no longer have Active Directory, only Entra ID?
Then you use Rippling's cloud app for Entra ID; see the integration between Rippling and Entra ID.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- By default through the Rippling app Microsoft Entra ID/Active Directory (Rippling App Shop). Rippling creates an API-driven provisioning app in the tenant and sends events to Entra ID; the Microsoft Entra Connect provisioning agent writes to Active Directory. Then Entra Connect Sync or Cloud Sync to Entra ID. Entra ID P1 or P2 required; lifecycle workflows require Entra ID Governance.
- Additional KoppelHet tasks in the domain through an agent with an outbound connection and rights on the managed OUs (moving to the leavers OU, groups, deletion after a period). Rippling read through the v2 REST API (rest.ripplingapis.com) with a token with read-only scopes.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Rippling | Field in Active Directory | Notes |
|---|---|---|
User id | employeeID | Fixed key, also after rehire |
Preferred given name, family name | givenName, sn, displayName | |
Title | title | |
Department | department | |
Manager | manager | |
User start date | Startdatum voor lifecycle workflows | |
Termination date | Einddatum voor lifecycle workflows | |
Offboarding | userAccountControl (uitgeschakeld) |
Related
Carerix → Rippling
Carerix to Rippling integration: successful match as a hire for review in Rippling
Greenhouse → Rippling
Greenhouse to Rippling integration: every hire straight into Rippling for review
Recruitee → Rippling
Recruitee to Rippling integration: hired candidates ready to hire
Rippling → 4PS Construct
Rippling to 4PS Construct integration: own employees of the construction entity in 4PS, with department as a dimension