Identity and access management
Simployer to Entra ID integration: accounts closed on the leave date, with employee number and licence
With an integration between Simployer One and Microsoft Entra ID, a leaver's account closes on the leave date from Simployer. KoppelHet also sets the employee number and the usage location on the account, so applications find the number and a new colleague gets a licence on the first day.
What the integration does
Organisations that use Simployer One for HR and Microsoft 365 for the workplace often leave a leaver's account enabled until someone disables it by hand. Applications miss the employee number, and a new colleague only gets a licence once someone sets the usage location.
- We establish whether you use Simployer One or Simployer Classic; this integration reads Simployer One.
- KoppelHet reads the leave date from Simployer One and disables the account on that day, if you do not use lifecycle workflows in Entra ID.
- KoppelHet sets employee number and usage location on the account.
- KoppelHet compares the active employees in Simployer with the enabled accounts in Entra ID every day and reports differences.
What to watch for with Simployer and Microsoft Entra ID
- Microsoft can start a lifecycle workflow on the leave date that disables the account, but that requires an Entra ID Governance licence. If you do not have one, KoppelHet reads the leave date from Simployer One and disables the account itself.
- Applications often need the employee number. KoppelHet sets the number from the Simployer One API as employeeId on the account in Entra ID.
- Microsoft wants a usage location on the account before a licence can be assigned. Simployer One knows the country of the employment. KoppelHet sets that country as the usage location, so a new colleague in Norway or the Netherlands gets a licence on the first day.
- An access token for the Simployer One API gets owner rights on the whole account; read-only does not exist. KoppelHet keeps the token in the platform's vault, only uses read calls and advises a separate token for this integration.
- Microsoft allows at most 16 characters in employeeId. KoppelHet checks the employee number from Simployer One against that and reports a longer number to HR instead of truncating it.
- KoppelHet finds the account in Entra ID through the work email from Simployer One and the userPrincipalName. A UPN may not contain accents and must be on a verified domain of the tenant. If the work email differs on that, KoppelHet reports it to HR and touches no other account.
- The Simployer One API also returns the national ID number (ssn), the bank account and private details per employee. With select KoppelHet only requests employeeNumber, workEmail, employmentCountry, active, endDate and offboardDate, so that data never enters the integration.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Can we not handle disabling in Entra ID itself?
Yes, with a lifecycle workflow on the leave date. That requires an Entra ID Governance licence. Without that licence KoppelHet does it.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Simployer One read through the HRM One API (api.alexishr.com/v1, employee with employeeNumber, workEmail, employmentCountry, endDate, offboardDate; filter on updated) with an access token as bearer. To Entra ID through Microsoft Graph (employeeId, usageLocation, accountEnabled) with User.ReadWrite.All.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Simployer | Field in Microsoft Entra ID | Notes |
|---|---|---|
employeeNumber | employeeId | |
employmentCountry | usageLocation | |
offboardDate of endDate | accountEnabled = false | |
workEmail | userPrincipalName | Lookup key for the account |
active | accountEnabled | In the daily comparison |
Related
Recruitee → Simployer
Recruitee to Simployer integration: hired candidates with employment and salary in Simployer One
Simployer → Active Directory
Simployer to Active Directory integration: accounts in your own domain from Simployer
Simployer → ADP iHCM
Simployer to ADP iHCM integration: salary, bonuses and end of employment from Simployer One to ADP iHCM
Simployer → AFAS Profit
Simployer to AFAS integration: Dutch employees from Simployer One in AFAS payroll