Identity and access management
Sage People to Entra ID integration: Microsoft accounts that follow the employment record
With an integration between Sage People and Microsoft Entra ID, a new team member in Sage People gets a Microsoft account with department, job title, country and manager, and the start and end date of the employment record determine when the account is active. KoppelHet supplies the data through the route Microsoft describes for HR systems.
What the integration does
Organisations with Sage People for HR and Microsoft 365 for all employees create accounts after a ticket from the manager. Leavers are sometimes only found during a licence review.
- HR records a new team member in Sage People, with an employment record and start date.
- KoppelHet fetches the changed team members and employment records and creates the Microsoft account according to your naming rules.
- The account becomes active on the start date of the employment record.
- When department, job or manager change, the details and groups in Entra ID follow.
- After the end date of the employment record KoppelHet blocks sign-in and removes the employee from the groups.
What to watch for with Sage People and Microsoft Entra ID
- Sage People runs on Salesforce and stores the person and the employment as two separate records. A new end date only changes the employment record; KoppelHet therefore watches changes in both, so a departure is not missed.
- What the integration may read in Sage People is set in the permission set of a separate API user, per object and per field. If the manager or department is empty in Entra ID, that right is usually missing, and KoppelHet reports it as such to your Sage People administrator.
- Sage People signs in to Salesforce through an app with only a key and secret, without a person's password. The integration therefore keeps working when an HR administrator leaves or changes their password.
- A team member can have several employment records in Sage People, for example after a return. KoppelHet uses the record valid on the day, and re-enables a blocked account of the same person instead of creating a second one.
- Sage People is often used for several countries, with its own payroll company per country. Its country becomes the country a Microsoft 365 licence requires, and only countries belonging to this Microsoft environment produce accounts.
- An end date is often recorded in advance in Sage People. KoppelHet blocks on the day after the end date, not when HR enters the departure, so someone can work up to and including the last working day.
- KoppelHet uses the route Microsoft describes for HR systems, so you do not have to maintain your own scripts or Salesforce flows.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
How quickly does a new colleague have an account?
The same day HR records the team member with employment record. The account becomes active on the start date.
What do we need to arrange in Sage People?
A separate API user with read rights on the agreed fields, and an app the integration signs in with. Your Salesforce or Sage People administrator does this once.
Does the work address go back to Sage People?
Not by default; the integration only reads. If you want the address in Sage People, we agree on it and the API user gets write access to that field only.
What can be traced afterwards for an audit?
Every action of the integration is recorded in the audit logging of the KoppelHet platform. KoppelHet works with an ISO 27001 certified management system.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Sage People is read through the Salesforce API with SOQL on fHCM2__Team_Member__c and fHCM2__Employment__c, filtered on the modification date of both objects. Sign-in through an External Client App with OAuth 2.0 client credentials (Run As the API user with a Salesforce Integration licence, the Minimum Access – API Only Integrations profile and a read-only permission set).
- Entra ID is written through Microsoft Graph (user) or through API-driven inbound provisioning (/bulkUpload with SCIM, requires Entra ID P1 or higher). Fields employeeId (at most 16 characters), employeeHireDate, usageLocation (required for licences), manager and accountEnabled = false after the end date.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Sage People | Field in Microsoft Entra ID | Notes |
|---|---|---|
Employee Number (team member) | employeeId | Fixed key; at most 16 characters |
First Name en Last Name | givenName en surname | |
Naamgevingsregel | userPrincipalName en mail | |
Job Title | jobTitle | |
Department | department | |
Manager (team member) | manager | Looked up as an existing account |
Land van de payroll company of het kantoor | usageLocation en country | |
Start Date (employment) | employeeHireDate | |
End Date (employment) | accountEnabled | Blocked after the end date |
Related
Sage People → Active Directory
Sage People to Active Directory integration: domain accounts for the Dutch office
Sage People → ADP iHCM
Sage People to ADP iHCM integration: salary records, bonuses and leavers of the Dutch payroll company to ADP
Sage People → AFAS Profit
Sage People to AFAS integration: Dutch employees and salaries from Sage People in AFAS Profit
ASSage People → Arbodienst (SIVI)
Sage People to the occupational health service via SIVI: absence records as absence reports