Identity and access management
Talentech to Active Directory integration: accounts in your own domain from PeopleCore
With an integration between Talentech PeopleCore and Active Directory, every employee HR completes in Talentech gets an account in your own domain, in the folder of their location and with job title, department and manager. The account expires on the employment end date from the resignation, and the address from the domain goes back to Talentech.
What the integration does
Organisations with Talentech for HR and their own Active Directory, often with Entra Connect to Microsoft 365, have the service desk create accounts based on an email from HR. Someone who starts at another site or leaves often only appears correctly in the domain later.
- Talentech gives KoppelHet a client for the token service with only the required scopes; the domain gets a KoppelHet agent with rights on only the integration's folders.
- KoppelHet compares employees, positions, contracts and resignations with the previous state every hour and prepares the differences as tasks.
- The agent collects the tasks through an outbound connection and creates the account disabled in the location's folder.
- On the start date the account is enabled; the address goes back to Talentech.
- On a resignation the agent sets the expiry date and disables the account after the end date.
What to watch for with Talentech and Active Directory
- Talentech cannot connect to a server in your network, and the PeopleCore API sends no notifications for this data that we have found. KoppelHet therefore compares every hour in the cloud, and the agent in the domain only collects the result through an outbound connection.
- An employee's ID in PeopleCore is a long code, and employeeID in Active Directory holds at most 16 characters. KoppelHet puts the Talentech ID in a custom attribute and stores a short number in Talentech among the employee's external identifiers, so both sides can find each other.
- Location, department and legal entity are attached to the position in PeopleCore, not to the employee. KoppelHet chooses the folder in Active Directory by location or entity, so a move to another position immediately moves the account to the right folder and group policy.
- On a job change Talentech ends the current contract and starts a new contract on the new position. KoppelHet recognises that pair as a change and keeps the same account, instead of disabling the old one and creating a new one.
- A resignation in PeopleCore has an employment end date. KoppelHet sets it as the account's expiry date. Active Directory then refuses sign-in after that day itself, even if the hourly run or the agent is briefly not running.
- Employees sign in to Talentech with the email address of their Talentech ID, and that address can be changed through the API. KoppelHet writes the address from the domain back there, so sign-in to Talentech stays in line with the account Entra Connect brings to Microsoft 365.
- Talentech is widely used in Norway, Sweden and Denmark, with names such as Bjørn or Märta. A username in Active Directory may have at most 20 characters. KoppelHet converts special characters according to a fixed rule and keeps the display name as it is in Talentech.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Does a port have to be opened in our firewall?
No. The agent only makes an outbound connection to the KoppelHet platform.
Why every hour and not immediately?
PeopleCore does not report these changes itself. A shorter run is possible but needs more requests to Talentech; we agree that per customer.
What rights does the agent have in our domain?
Only on the integration's folders: creating, changing and disabling accounts. No domain administrator.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Talentech PeopleCore API (api.talentech.io/peoplecore) with a JWT from the token service (client credentials), scopes peoplecore-employees:read and :write, peoplecore-positions:read, peoplecore-contracts:read and peoplecore-resignations:read. GET /v1/Employees, /v1/Positions (organizationInformation, superiorPositionId), /v1/Contracts and /v1/EmployeeResignApplications; no filter on modification date. Write-back with PATCH /v1/Employees/{employeeId}, PUT /v1/Employees/{employeeId}/TalentechIdEmail and PUT /v1/Employees/{employeeId}/externalSystemIdentifiers.
- A KoppelHet agent in the domain collects tasks through an outbound connection and only has rights on the integration's OUs. AD attributes employeeID (at most 16 characters), an extensionAttribute for the Talentech ID, sAMAccountName (at most 20 characters), userPrincipalName, mail, title, department, physicalDeliveryOfficeName, company, manager, accountExpires and userAccountControl.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Talentech | Field in Active Directory | Notes |
|---|---|---|
employee.id | extensionAttribute of employeeID (eigen nummer) | |
personalDetails.firstName | givenName | |
personalDetails.middleName + lastName | sn | |
Naamgevingsregel | sAMAccountName | At most 20 characters |
Naamgevingsregel | userPrincipalName en mail | |
position.organizationInformation.jobTitle | title | |
departmentId (naam) | department | |
locationId (naam) | physicalDeliveryOfficeName en OU | |
legalEntityId (naam) | company | |
superiorPositionId (medewerker op die positie) | manager | |
resignation.employmentEndDate | accountExpires en userAccountControl | |
mail (AD) | businessEmail en talentechIdEmail |
Related
Recruitee → Talentech
Recruitee to Talentech integration: hired candidates with a contract on a position in Talentech
Talentech → ADP iHCM
Talentech to ADP iHCM integration: salaries and resignations from PeopleCore to Dutch ADP payroll
Talentech → AFAS Profit
Talentech to AFAS integration: employees, contracts and salaries from Talentech PeopleCore in AFAS
ASTalentech → Arbodienst (SIVI)
Talentech to the occupational health service via SIVI: PeopleCore absences as absence reports