Identity and access management
SAP HCM to Active Directory integration: domain accounts per personnel area from SAP HR
With an integration between SAP HCM and Active Directory, KoppelHet creates a domain account for a new employee from SAP HR in the OU of their personnel area, with organisational unit, job and manager. The leaving date from SAP is set on the account in advance as its expiry date, and on that day it is disabled.
What the integration does
Organisations that run SAP HCM on-premise and manage their own Active Directory often create accounts from a weekly list out of SAP. Transfers only reach the domain weeks later, and leavers' accounts stay active until the list has been processed.
- The SAP administrator sets up the sending of HR master data once to a small KoppelHet program in your own network.
- On a hiring action the program creates the account in the OU of the personnel area, disabled until the start date.
- A change in the organisational assignment moves the account and changes the groups on the start date.
- On a leaving action the program sets the expiry date straight away and disables the account on that date.
- Leavers' accounts go to a separate OU, so IT can hand over mailbox and files.
What to watch for with SAP HCM and Active Directory
- SAP HCM and Active Directory are both in your own network. The KoppelHet program receives the messages from SAP and carries out the changes in the domain; KoppelHet's platform supplies the rules and records every action. No connection from outside to inside is needed.
- The personnel area in SAP usually indicates the site or installation. KoppelHet uses it to choose the OU, so group policy per location is right without IT moving accounts.
- A leaving action is often recorded weeks ahead in SAP. KoppelHet sets the leaving date as the account's expiry date straight away, so it also stops if the program is not running that day.
- SAP only sends the infotypes that changed. KoppelHet keeps the latest state per employee, so a change of just the name does not take the account out of its OU or groups.
- With HR master data SAP always sends the base infotypes 0000 to 0003, even if only the organisational assignment changes. KoppelHet only uses what the domain needs from them, and address and bank details are not included in the sending to the program.
- Not every employee at an installation works at a PC. Per personnel area or job we agree who gets a domain account, so no unused accounts are created.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
What does our SAP administrator need to do?
Set up the distribution model, partner profile and change pointers for HR master data once. We supply the specification.
Does this also work with Microsoft 365 only?
Yes, we build that integration too.
What about the GDPR?
You are the controller and KoppelHet is the processor, under a data processing agreement. The integration only uses the infotypes Active Directory needs.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- SAP HCM sends HR master data through ALE with message type HRMD_A (IDocs), created by change pointers, with a distribution model and partner profile. Infotypes 0000 (actions, STAT2), 0001 (company code, personnel area, organisational unit, position) and 0002; key PERNR. A KoppelHet agent in the network receives the IDocs.
- The same agent writes employeeID (at most 16 characters), sAMAccountName (at most 20 characters), userPrincipalName, mail, givenName, sn, displayName, title, department, company, physicalDeliveryOfficeName, manager and accountExpires in Active Directory, and moves accounts between OUs.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in SAP HCM | Field in Active Directory | Notes |
|---|---|---|
PERNR (personeelsnummer) | employeeID | Fixed key |
Infotype 0002: roepnaam of voornaam | givenName | |
Infotype 0002: achternaam | sn en displayName | |
Naamgevingsregel | sAMAccountName | At most 20 characters |
Naamgevingsregel | userPrincipalName en mail | |
Infotype 0001: personeelsgebied | OU en physicalDeliveryOfficeName | |
Infotype 0001: organisatie-eenheid | department en groepen | |
Infotype 0001: functie of positie | title | |
Infotype 0001: bedrijfsnummer | company | |
Infotype 0000: uitdienstmaatregel | accountExpires en uitschakelen |
Related
SAP HCM → AFAS Profit
SAP HCM to AFAS integration: SAP HR data straight to Dutch payroll
SAP HCM → Microsoft Entra ID
SAP HCM to Entra ID integration: Microsoft accounts from SAP HR, without your own Logic Apps
SAP HCM → Google Workspace
SAP HCM to Google Workspace integration: Google accounts based on SAP actions
SAP HCM → Nmbrs
SAP HCM to Nmbrs integration: SAP HR data to Dutch payroll