Identity and access management
Sympa to Entra ID integration: Microsoft accounts from Sympa, also for multiple entities
With an integration between Sympa and Microsoft Entra ID, every new employee from Sympa gets a Microsoft account with job title, department and manager, and the account is disabled after the employment ends. KoppelHet includes multiple entities in one integration, with your own naming and groups, and disables the account on the end date itself.
What the integration does
At organisations with several entities in Sympa and one Entra ID environment, IT often creates accounts by hand, especially when naming differs per country.
- HR records a new employee in Sympa at one of the entities.
- KoppelHet reads the change within the hour and creates the account, disabled until the start date.
- Groups and licence follow from entity, organisation unit and job.
- The work email goes back to Sympa, so HR has the right address in the record.
- On the end date the account is disabled, even if the next run comes later.
What to watch for with Sympa and Microsoft Entra ID
- If the group has several entities in Sympa, KoppelHet reads all entities belonging to the Microsoft environment in one integration, with rules per country.
- KoppelHet reads changed employees in Sympa every hour and disables the account on the end date itself. A departure or a new colleague is not left waiting for a day.
- Sympa organisation units form a tree. For groups in Entra ID KoppelHet picks the level your access design uses, for example the department under the Dutch entity, and not the name of the lowest team.
- Microsoft requires a country on the user for a licence. The country comes from the Sympa entity, so a Belgian colleague gets the right usage location and licence.
- An interface in Sympa can return the email address of the manager with the manager field. KoppelHet uses it to look up the manager's Microsoft account, even when the manager works at another entity.
- Sympa allows one hundred API requests per hour per interface by default. KoppelHet uses its own interface for this integration, so the hourly run does not get in the way of other integrations on Sympa, such as a payroll integration.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Does this also work with on-premises Active Directory?
Yes, through a small program in your network.
What about audit logging, GDPR and our integration platform?
Every action of the integration is in the audit logging of the KoppelHet platform, traceable per employee. You are the controller and KoppelHet is the processor, under a data processing agreement; the Sympa interface only contains the fields in the design. An existing integration platform is left alone.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- KoppelHet reads Sympa through the Sympa Integration API (OData v4) on its own interface with X-ApiKey, with $filter on modified and on the entity, and target fields on the manager's datacard field.
- Entra ID is written through Microsoft Graph (user) with employeeId (at most 16 characters), givenName, surname, userPrincipalName, jobTitle, department, companyName, manager, usageLocation and accountEnabled, or through API-driven inbound provisioning (requires Entra ID P1 or higher).
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Sympa | Field in Microsoft Entra ID | Notes |
|---|---|---|
Personeelsnummer | employeeId | |
Roepnaam of voornaam | givenName | |
Achternaam | surname | |
Naamgevingsregel per land | userPrincipalName en mailNickname | |
Functie | jobTitle | |
Organisatie-eenheid | department | |
Entiteit | companyName | |
Leidinggevende (e-mail via doelveld) | manager | |
Land van de entiteit | usageLocation | |
Einddatum dienstverband | accountEnabled = false |
Related
Greenhouse → Sympa
Greenhouse to Sympa integration: hired candidate as a data card with contract row in Sympa
Recruitee → Sympa
Recruitee to Sympa integration: hired candidates as a data card in Sympa
SmartRecruiters → Sympa
SmartRecruiters to Sympa integration: ready to onboard becomes a data card in Sympa
Sympa → 4PS Construct
Sympa to 4PS Construct integration: fitters of the Dutch employer from Sympa in 4PS, with cost centre as a dimension