Identity and access management
Sage HR to Entra ID integration: Microsoft accounts based on the work email in Sage HR
With an integration between Sage HR and Microsoft Entra ID, a new employee from Sage HR gets a Microsoft account with job title, team and manager, and the account is blocked after the last working day of the termination in Sage HR. With Entra ID, Sage HR only offers sign-in through SAML, and employees are created by hand for that; KoppelHet builds the creating and blocking through the Sage HR API.
What the integration does
Organisations with Sage HR and Microsoft 365 often use the app in the Entra gallery to sign in to Sage HR with Microsoft. IT still creates the Microsoft account itself by hand, and the work address must be exactly the same in both systems.
- HR creates the employee in Sage HR with the work address according to the naming rule.
- KoppelHet sees the new employee in the list of active employees and creates the Microsoft account with that address.
- Job title, team and manager come from Sage HR; each team becomes a group in Entra ID.
- On a termination KoppelHet sets the last working day as the leave date and blocks the account after that day.
- On a rehire KoppelHet switches the existing account back on.
What to watch for with Sage HR and Microsoft Entra ID
- Sage HR asks for the email address when an employee is created, but the operation to update an employee has no email field. KoppelHet therefore cannot write the Microsoft address back. HR fills in the work address straight away, and KoppelHet uses it to create the account and checks that the domain is right.
- For signing in with Microsoft, Sage HR is still listed as CakeHR in the Entra gallery. Microsoft describes that the user is created by hand in Sage HR and linked to the Entra account through the work address. Because KoppelHet uses the Sage HR address as the userPrincipalName, the two always match.
- After a termination an employee disappears from the list of active employees and appears in a separate list of terminated employees, with the end date. KoppelHet reads both lists; anyone who only reads the active list just sees a leaver disappear without a date.
- The date on a termination in Sage HR is the last working day. KoppelHet blocks the Microsoft account at the end of that day and also sets the date as the leave date on the account.
- In the API Sage HR returns no location for an employee; a location can only be written. Microsoft requires a usage location before a licence can go on an account. It therefore comes from a custom field in Sage HR or from a fixed value per team.
- According to the API description Sage HR sends no webhooks. KoppelHet therefore compares the active and terminated employees with the previous state every hour and only writes what has changed.
- A rehire in Sage HR brings an employee back under the same ID. KoppelHet recognises that ID, switches the blocked Microsoft account back on and does not create a second account with a sequence number.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Doesn't Sage HR's Entra app create accounts?
No. The app in the gallery handles sign-in through SAML. Microsoft describes creating users for this app as manual work.
Does this also work with on-premises Active Directory?
Yes, we build that integration with a small program in your domain.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Sage HR REST API at {subdomain}.sage.hr/api with the X-Auth-Token header. GET /employees (email, first_name, last_name, employee_number, position, team, reports_to_employee_id, employment_start_date), GET /terminated-employees (termination_date) and GET /terminated-employees/{id} (termination with reason). Pages with page and meta.next_page. No webhooks.
- To Entra ID through API-driven inbound provisioning (/bulkUpload with SCIM, requires Entra ID P1 or higher) or Microsoft Graph (user with userPrincipalName, employeeId, jobTitle, department, usageLocation, manager, employeeHireDate, employeeLeaveDateTime and accountEnabled; group membership).
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Sage HR | Field in Microsoft Entra ID | Notes |
|---|---|---|
email | userPrincipalName en mail | Also the link for sign-in through SAML |
first_name en last_name | givenName, surname en displayName | |
employee_number | employeeId | |
position | jobTitle | |
team | department en groepslidmaatschap | |
reports_to_employee_id | manager | |
employment_start_date | employeeHireDate | |
termination_date | employeeLeaveDateTime en accountEnabled = false |
Related
Recruitee → Sage HR
Recruitee to Sage HR integration: hired candidates as employees in Sage HR
Sage HR → Active Directory
Sage HR to Active Directory integration: domain accounts per team, with an expiry date from the termination
Sage HR → ADP iHCM
Sage HR to ADP iHCM integration: compensation and leavers from Sage HR to Dutch ADP payroll
Sage HR → AFAS Profit
Sage HR to AFAS integration: employees of the Dutch entity in AFAS Profit Payroll