Identity and access management
SAP HCM to Entra ID integration: Microsoft accounts from SAP HR, without your own Logic Apps
With an integration between SAP HCM and Microsoft Entra ID, a new employee from SAP HR gets a Microsoft account with department, job and company, and sign-in is blocked as soon as the leaving action in SAP takes effect. KoppelHet receives the changes from SAP inside your network, so IT does not have to build and maintain its own Azure solution.
What the integration does
Organisations that run SAP HCM on-premise for HR and payroll and use Microsoft 365 request new accounts with a form that HR fills in after the hiring action. Until the account exists, a new colleague cannot get started.
- The SAP administrator sets up the sending of HR master data once, filtered on the Dutch employees, to a small KoppelHet program in your own network.
- On a hiring action in SAP, SAP sends the new employee's data. KoppelHet creates the Microsoft account, ready for the start date.
- When the organisational assignment changes, department, job and groups in Entra ID follow on the start date.
- On a leaving action KoppelHet blocks sign-in on the date the action takes effect.
- Every week KoppelHet compares the active employees in SAP with Entra ID, as a check on missed messages.
What to watch for with SAP HCM and Microsoft Entra ID
- For SAP HCM Microsoft describes four routes, including a file export and integrations through Azure Logic Apps on SAP functions or IDocs. The organisation has to build and run those itself. KoppelHet provides the IDoc route as a service, without Logic Apps in your Azure environment.
- On a change SAP HCM only sends the infotypes that changed, based on change pointers. KoppelHet completes what Entra ID needs, so a name change does not lead to an account without a department.
- SAP records data per infotype with a start and end date, and actions are often entered ahead. KoppelHet carries out a transfer or leaving in Entra ID on the action's start date, not at the moment it is entered.
- Whether someone is employed is held in SAP in the status of the action; Microsoft uses status 3 as active in its example. KoppelHet bases creating and blocking on that status and the action, not on the existence of the personnel number.
- SAP HCM runs in your own network. The distribution model in SAP only sends the Dutch employees to the KoppelHet program in that network; no connection from outside to SAP is needed.
- SAP always requires the base infotypes 0000 to 0003 when sending HR master data. KoppelHet only uses what Entra ID needs from them; address and bank details are not included in the sending.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
What does our SAP administrator need to do?
Set up the distribution model, partner profile and change pointers for HR master data once, with a filter on the Dutch employees. We supply the specification.
Does this also work with Active Directory in our own network?
Yes, we build that integration too.
We already have an integration platform. Does this fit alongside it?
Yes. SAP can send the same HR master data to several receivers, so existing flows remain. Every action of this integration is in KoppelHet's audit logging.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- SAP HCM sends HR master data through ALE with message type HRMD_A (IDocs), created by change pointers, with a distribution model and partner profile filtering on Dutch employees. A KoppelHet agent receives the IDocs inside the network. Infotypes 0000 (actions, STAT2), 0001 (organisational assignment), 0002 (personal data); key PERNR.
- Entra ID is written through Microsoft Graph (user with employeeId, givenName, surname, userPrincipalName, jobTitle, department, companyName, officeLocation, usageLocation, manager and accountEnabled), or through API-driven inbound provisioning if you prefer.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in SAP HCM | Field in Microsoft Entra ID | Notes |
|---|---|---|
PERNR (personeelsnummer) | employeeId | Fixed key |
Infotype 0002: roepnaam of voornaam | givenName | |
Infotype 0002: achternaam | surname | |
Naamgevingsregel | userPrincipalName en mail | |
Infotype 0001: organisatie-eenheid | department | |
Infotype 0001: functie of positie | jobTitle | |
Infotype 0001: bedrijfsnummer | companyName | |
Infotype 0001: personeelsgebied | officeLocation en usageLocation | |
Leidinggevende uit de organisatiestructuur | manager | |
Infotype 0000: maatregel en status | accountEnabled | Active at status 3 |
Related
SAP HCM → Active Directory
SAP HCM to Active Directory integration: domain accounts per personnel area from SAP HR
SAP HCM → AFAS Profit
SAP HCM to AFAS integration: SAP HR data straight to Dutch payroll
SAP HCM → Google Workspace
SAP HCM to Google Workspace integration: Google accounts based on SAP actions
SAP HCM → Nmbrs
SAP HCM to Nmbrs integration: SAP HR data to Dutch payroll