Identity and access management
Sage People to Active Directory integration: domain accounts for the Dutch office
With an integration between Sage People and Active Directory, a new team member of the Dutch office gets a domain account in the right OU, with department, job title and manager, and the account gets the employment record's end date as its expiry date. A small KoppelHet program in your domain carries out the changes through an outbound connection.
What the integration does
Organisations that run HR in Sage People and have their own local Active Directory, for example for workstations and a file server, have IT create accounts based on an email. After a departure the account sometimes stays active for months.
- HR records a new team member in Sage People, with employment record and start date.
- KoppelHet fetches the changed team members and employment records of the Dutch office.
- The program in the domain creates the account in the department's OU, with job title and manager.
- An end date on the employment record immediately becomes the account's expiry date.
- After the last working day KoppelHet disables the account and moves it to an OU for leavers.
What to watch for with Sage People and Active Directory
- Sage People stores the person and the employment as separate records. An end date sits on the employment record; KoppelHet watches changes in both, and sets the end date straight away as the expiry date, so the account also stops if the program does not run that day.
- A team member can get a new employment record after returning. KoppelHet then re-enables the old domain account and moves it back, instead of creating a second account with a new sequence number.
- The KoppelHet platform reads Sage People in the cloud; the program in the domain only fetches instructions through an outbound connection. The domain needs no access to Salesforce, and nothing is opened in the firewall.
- The permission set of the API user in Sage People determines what the integration sees. If the manager is empty, that right is usually missing, and KoppelHet reports it instead of clearing the manager in the domain.
- Sage People is often used for every country, while this domain only serves the Dutch office. KoppelHet only includes the team members of the Dutch entity.
- Departments in Sage People can be named freely per country. Per Dutch department we record the OU and the groups, so the drawing department gets access to the project folders and the back office does not.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Does anything need to be opened in the firewall?
No. The program in the domain only makes an outbound connection to the KoppelHet platform.
Does this also work with Entra ID?
Yes, we also connect Sage People directly with Entra ID.
What do we need to arrange in Sage People?
A separate API user with read rights on the agreed fields, and an app the integration signs in with.
What can be traced afterwards for an audit?
Every action of the integration is recorded in the audit logging of the KoppelHet platform. KoppelHet works with an ISO 27001 certified management system.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Sage People is read through the Salesforce API with SOQL on fHCM2__Team_Member__c and fHCM2__Employment__c, filtered on the modification date of both objects. Sign-in through an External Client App with OAuth 2.0 client credentials and an API user with a Salesforce Integration licence and a read-only permission set.
- A KoppelHet agent on a Windows server in the domain writes employeeID (at most 16 characters), employeeNumber, sAMAccountName (at most 20 characters), userPrincipalName, givenName, sn, displayName, title, department, manager and accountExpires, and moves accounts between OUs.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Sage People | Field in Active Directory | Notes |
|---|---|---|
Employee Number (team member) | employeeID | Fixed key; at most 16 characters |
Salesforce-id van het employment record | employeeNumber | Which employment drives the account |
Naamgevingsregel | sAMAccountName en userPrincipalName | sAMAccountName at most 20 characters |
First Name en Last Name | givenName, sn en displayName | |
Department | department en OU | |
Job Title | title | |
Manager (team member) | manager | |
End Date (employment) | accountExpires |
Related
Sage People → ADP iHCM
Sage People to ADP iHCM integration: salary records, bonuses and leavers of the Dutch payroll company to ADP
Sage People → AFAS Profit
Sage People to AFAS integration: Dutch employees and salaries from Sage People in AFAS Profit
ASSage People → Arbodienst (SIVI)
Sage People to the occupational health service via SIVI: absence records as absence reports
Sage People → DATEV
Sage People to DATEV integration: German payroll changes from Sage People to DATEV