Identity and access management
Simployer to Active Directory integration: accounts in your own domain from Simployer
With an integration between Simployer and Active Directory, a new employee from Simployer One gets an account in your own domain, with job title, department, office and manager, and the account is disabled on the leave date. The work address stays leading in Simployer, and Entra Connect then takes the account along to Microsoft 365.
What the integration does
Organisations with Simployer One for HR and their own Active Directory with Entra Connect cannot simply use Simployer's Entra connection, because their accounts are created in the domain and not in the cloud. IT then creates accounts by hand after a message from HR, and disabling on departure depends on who remembers.
- We establish whether you use Simployer One or Simployer Classic, and do not switch on Simployer's Entra connection for the same employees.
- An owner in Simployer One creates a separate access token for KoppelHet; the domain gets a KoppelHet agent with rights on only the integration's folders.
- KoppelHet reads the changed employees every fifteen minutes; the agent collects the tasks through an outbound connection.
- A new employee gets a disabled account in their office's folder, which is enabled on the hire date.
- On the leave date the agent disables the account; Entra Connect passes that on to Entra ID.
What to watch for with Simployer and Active Directory
- The connection Simployer One itself offers writes to Entra ID through Microsoft Graph and creates cloud accounts there. The guide does not mention Active Directory. If your accounts come from your own domain through Entra Connect, KoppelHet supplies Active Directory and Simployer's Entra connection stays off, so no second account is created.
- Simployer One also has a SCIM entry point to send users to other services, only in the direction from Simployer outwards. It is tested with Okta, Slack and Google Workspace, not with Active Directory, and requires a plan with SCIM. KoppelHet therefore reads Simployer One's regular API.
- Simployer One has an employment end date and a separate offboarding date. KoppelHet uses the offboarding date if there is one, and otherwise the end date, and sets it as the account's expiry date, so Active Directory refuses sign-in after that day itself.
- Office, department and manager are stored in Simployer One as references to an office, department or another employee. KoppelHet fetches the names and finds the manager's account through their employee number, so the manager field in Active Directory points to the right account.
- Simployer One can be queried for employees updated after a given moment. KoppelHet only requests those every fifteen minutes, so a new colleague quickly has an account without the whole organisation being read each time.
- An access token for Simployer One gets owner rights on the whole account. KoppelHet keeps the token in the platform's vault, only uses read calls and never gives the agent in your network the token itself, only the tasks.
- Simployer is widely used in Norway and Sweden, with names such as Ørjan or Åsa. A username in Active Directory may have at most 20 characters. KoppelHet converts special characters according to a rule you choose, for example ø to o, and keeps the display name as it is in Simployer.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Can we not use Simployer's Entra connection?
Yes, if your accounts only exist in the cloud. With your own domain and Entra Connect, accounts are created in Active Directory, and Simployer's connection does not write there.
Does this also work with Simployer Classic?
Yes, but then through Classic's HRConnect API, with different fields and a different sign-in.
Does a port have to be opened in our firewall?
No. The agent only makes an outbound connection to the KoppelHet platform.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Simployer One through the HRM One API (api.alexishr.com/v1) with an access token as bearer: employee (employeeNumber, firstName, lastName, workEmail, title, departmentId, officeId, managerEmployeeId, organization, active, hireDate, endDate, offboardDate; filter on updated), department and office for names. For Simployer Classic the HRConnect API with SimplAuth.
- A KoppelHet agent in the domain collects tasks through an outbound connection and only has rights on the integration's OUs. AD attributes employeeID, sAMAccountName (at most 20 characters), userPrincipalName, mail, title, department, physicalDeliveryOfficeName, company, manager, accountExpires and userAccountControl.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Simployer | Field in Active Directory | Notes |
|---|---|---|
employeeNumber | employeeID | |
firstName | givenName | |
lastName | sn | |
Naamgevingsregel | sAMAccountName | At most 20 characters |
workEmail | userPrincipalName en mail | |
title | title | |
departmentId (naam) | department | |
officeId (naam) | physicalDeliveryOfficeName en OU | |
managerEmployeeId | manager | |
organization | company | |
offboardDate of endDate | accountExpires en userAccountControl |
Related
Recruitee → Simployer
Recruitee to Simployer integration: hired candidates with employment and salary in Simployer One
Simployer → ADP iHCM
Simployer to ADP iHCM integration: salary, bonuses and end of employment from Simployer One to ADP iHCM
Simployer → AFAS Profit
Simployer to AFAS integration: Dutch employees from Simployer One in AFAS payroll
ASSimployer → Arbodienst (SIVI)
Simployer to the occupational health service via SIVI: approved sick leave as absence reports