Identity and access management
Rippling to Entra ID integration: Rippling's own Entra ID app, and when custom work is needed
Rippling has its own App Shop app that creates employees from Rippling as cloud accounts in Microsoft Entra ID, updates them and revokes them on departure. For most organisations with only Rippling as their HR source that app is the integration between Rippling and Entra ID; KoppelHet comes in when a second HR source, custom fields or stricter checks are needed.
What the integration does
Organisations that use Rippling as their HR platform and Microsoft 365 for their workplace often let Rippling manage accounts itself. That works until a second HR system is added, for example for a country outside Rippling, or until Rippling and Entra ID both have rules on who gets which account.
- We establish whether you have cloud accounts or hybrid accounts with Active Directory; Rippling has a separate app for each.
- An administrator grants Rippling consent in Entra ID and sets up the field mapping and the rules for who gets an account in Rippling.
- KoppelHet checks that start date and termination date are in the mapping, so Entra ID's lifecycle workflows can run.
- KoppelHet supplies employees from a second HR source through its own provisioning app in Entra ID, with a scope that does not overlap with Rippling's.
- KoppelHet monitors the provisioning logs of both apps and reports failed records.
What to watch for with Rippling and Microsoft Entra ID
- Rippling has two apps for Microsoft. The Microsoft Entra ID app creates cloud accounts; the Microsoft Entra ID/Active Directory app creates accounts in your own domain that then go to Entra ID. An organisation picks one, otherwise both apps create the same account.
- If you want to use Entra ID's lifecycle workflows for joining and leaving, Rippling's start date and termination date must be in the field mapping, Microsoft says. Those workflows require an Entra ID Governance licence on top of P1 or P2.
- In Rippling the user is the person and the worker is the employment. On a rehire in the same company one user gets several workers. KoppelHet therefore uses the user ID as the fixed key in Entra ID, so a returning colleague gets their old account back.
- Entra ID creates a separate provisioning app per HR source. Rippling's app is one; a second HR system, for example for Dutch employees in AFAS, gets its own app through KoppelHet. We record per app which employees fall under it, so two sources do not overwrite the same account.
- Microsoft limits the API for HR sources to 2,000 calls per day with P1 or P2, and 6,000 with Entra ID Governance, with at most 50 operations per call. For the second source KoppelHet bundles changes, so the daily check does not use up the tenant limit that Rippling also uses.
- An API token in Rippling belongs to the person who creates it, and expires when that person leaves or the token has not been used for 30 days. When KoppelHet reads from Rippling itself, we create the token on an admin account that is not tied to one employee.
- Rippling shows in the Action history tab which calls were made to Entra ID, based on Microsoft's provisioning logs. KoppelHet reads those same logs and reports failed records, instead of waiting until someone cannot log in on their first working day.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Which Microsoft licence do we need?
Entra ID P1 or P2 for the provisioning app, for example through Microsoft 365 E3 or E5. For the lifecycle workflows also Entra ID Governance.
Rippling also manages apps itself. Who owns the account?
We decide that at the start. Usually Rippling creates the Microsoft account, and Entra ID then handles access to other apps.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- By default through the Rippling app Microsoft Entra ID (cloud accounts) or Microsoft Entra ID/Active Directory (hybrid). After an administrator's consent Rippling creates an API-driven provisioning app in the tenant; field mapping, account access rules and Action history are in Rippling.
- Custom work for a second source through API-driven inbound provisioning: POST /bulkUpload (SCIM, at most 50 operations per call, 40 calls per 5 seconds, 2,000 per 24 hours with P1/P2 and 6,000 with Entra ID Governance), permissions SynchronizationData-User.Upload and ProvisioningLog.Read.All. Rippling read through the v2 REST API (rest.ripplingapis.com, /workers with expand user, at most 100 per page).
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Rippling | Field in Microsoft Entra ID | Notes |
|---|---|---|
User id | employeeId | Not the worker ID; that changes on rehire |
Preferred given name, family name | givenName, surname, displayName | |
Title | jobTitle | |
Department | department | |
Manager | manager | |
User start date | employeeHireDate | Needed for lifecycle workflows |
Termination date | employeeLeaveDateTime | Needed for lifecycle workflows |
- Microsoft Entra Blog – Sync identities from Rippling to Microsoft Entra ID
- Microsoft Learn – Rippling HCM for user provisioning
- Microsoft Learn – API-driven inbound provisioning concepts
- Rippling – Data models
- Rippling – API tokens and permissions
- Rippling Blog – Rippling + Microsoft Entra ID integration
Related
Carerix → Rippling
Carerix to Rippling integration: successful match as a hire for review in Rippling
Greenhouse → Rippling
Greenhouse to Rippling integration: every hire straight into Rippling for review
Recruitee → Rippling
Recruitee to Rippling integration: hired candidates ready to hire
Rippling → 4PS Construct
Rippling to 4PS Construct integration: own employees of the construction entity in 4PS, with department as a dimension