Identity and access management
Sage HR to Active Directory integration: domain accounts per team, with an expiry date from the termination
With an integration between Sage HR and Active Directory, a new employee from Sage HR gets a domain account in their team's OU, with job title and manager, and the account expires on the last working day HR fills in on the termination. KoppelHet reads Sage HR through the API and a small program in your domain carries out the changes.
What the integration does
Organisations that use Sage HR and still have their own Windows domain often create domain accounts based on an email from HR. A termination in Sage HR then only reaches IT if someone remembers, and a team change not at all.
- We record the OU and the groups per Sage HR team.
- Every hour KoppelHet reads the active and terminated employees, with the team and position history.
- The program in the domain creates the account in the team's OU, with job title and manager.
- On a team change the program moves the account on the start date from the team history.
- On a termination the last working day becomes the expiry date; on a rehire the account opens again.
What to watch for with Sage HR and Active Directory
- A termination in Sage HR requires a date that is the last working day, and a reason from a fixed list. KoppelHet sets that date as the expiry date on the domain account. The reason does not go to the domain; it stays in Sage HR.
- Anyone who has left sits in a separate list in Sage HR and no longer among the active employees. KoppelHet reads both lists, so a departure also arrives if the termination was processed between two runs.
- With team_history Sage HR gives a start and end date for each team change. The program moves the account to the new OU on the start date, not at the moment HR enters the change.
- Sage HR marks on-call workers with a flag of its own. KoppelHet puts those accounts in a separate OU, so for example no VPN group applies there, or a different policy than for permanent employees.
- According to Sage HR, signing in to Sage HR with an on-premises Active Directory is only possible with help from their engineering team. The accounts in the domain are created by the KoppelHet program that runs inside the domain itself.
- After a rehire the employee is back among the active employees under the same ID. The program switches the old domain account on, removes the expiry date and moves it to the OU of the new team.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Does anything need to be opened in the firewall?
No. The program in the domain only makes an outbound connection to the KoppelHet platform.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Sage HR REST API at {subdomain}.sage.hr/api with the X-Auth-Token header. GET /employees with team_history and position_history (email, employee_number, position, team, reports_to_employee_id, irregular_contract_worker), GET /terminated-employees (termination_date) and GET /termination-reasons. Pages with page and meta.next_page. No webhooks.
- A KoppelHet agent on a Windows server in the domain fetches instructions through an outbound connection and writes employeeID, sAMAccountName, userPrincipalName, mail, givenName, sn, displayName, title, department, manager and accountExpires, manages groups and moves accounts between OUs.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Sage HR | Field in Active Directory | Notes |
|---|---|---|
employee_number | employeeID | At most 16 characters |
Naamgevingsregel | sAMAccountName | At most 20 characters |
email | userPrincipalName en mail | |
first_name en last_name | givenName, sn en displayName | |
position | title | |
team (team_history) | OU, department en groepen | |
reports_to_employee_id | manager | |
irregular_contract_worker | OU voor oproepkrachten | |
termination_date | accountExpires |
Related
Recruitee → Sage HR
Recruitee to Sage HR integration: hired candidates as employees in Sage HR
Sage HR → ADP iHCM
Sage HR to ADP iHCM integration: compensation and leavers from Sage HR to Dutch ADP payroll
Sage HR → AFAS Profit
Sage HR to AFAS integration: employees of the Dutch entity in AFAS Profit Payroll
ASSage HR → Arbodienst (SIVI)
Sage HR to the occupational health service via SIVI: time off requests of the sickness policy as absence reports