Identity and access management
Talentech to Entra ID integration: Microsoft accounts from Talentech PeopleCore
With an integration between Talentech PeopleCore and Microsoft Entra ID, every employee that HR completes in Talentech gets a Microsoft account with job title, department, location and manager, and the account is blocked after the employment end date from the resignation. The Microsoft address goes back to Talentech as the business email address and as the sign-in for Talentech ID.
What the integration does
Organisations that use Talentech for HR and Microsoft 365 for the workplace often create Microsoft accounts by hand after a message from HR. The address then still has to go into Talentech, also because employees sign in to Talentech with that address, and a resignation only reaches IT when someone passes it on.
- Talentech gives KoppelHet a client for the token service, with only the scopes for employees, positions, contracts and resignations, plus write on employees for the address.
- KoppelHet reads the state in PeopleCore every hour and compares it with the previous run.
- A completed profile with a contract gets a Microsoft account, disabled until the start date.
- The Microsoft address goes back to Talentech as the business address and as the Talentech ID address.
- After the employment end date from the resignation KoppelHet blocks the account and sets the leave date in Entra ID.
What to watch for with Talentech and Microsoft Entra ID
- Talentech writes that accounts can in principle be created automatically in a customer's Entra ID when a new employee is added in PeopleCore, and refers to contact for more information. How that flow works is not in the public documentation. KoppelHet builds it on the PeopleCore API, with rules you decide yourselves.
- Microsoft's app gallery also has a Talentech app, but it works the other way, from Entra ID to Talentech. If you already use it, we record which side leads per field, so Entra ID and PeopleCore do not overwrite each other in turn.
- Every employee in PeopleCore has a Talentech ID with its own email address, which they use to sign in to Talentech. Talentech lets that address be changed through the API. KoppelHet writes the Microsoft address back there, so signing in to Talentech uses the same address as Microsoft.
- A manager is stored in PeopleCore as a superior position, not as a person. KoppelHet finds the employee holding that position and links their Microsoft account as manager. If the position is vacant, KoppelHet looks one level higher.
- An employee who is still a draft in PeopleCore does not get an account. Only when HR completes the profile and there is a contract does KoppelHet create the Microsoft account, so a candidate who still drops out leaves no account behind.
- A resignation in PeopleCore has a last working day and an employment end date. KoppelHet blocks the account after the end date, and can block on the last working day on request, for example when someone is released from work.
- The PeopleCore API cannot query employees by modification date and sends no notifications for this data that we have found. KoppelHet therefore keeps the previous state and compares every hour, so only real changes go to Entra ID.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Does Talentech offer something for this itself?
Talentech mentions HR-driven provisioning to Entra ID and asks you to get in touch for it. Ask Talentech what that covers for you; KoppelHet builds the integration if it does not fit.
Does this also work with on-premises Active Directory?
Yes, we build that integration too, with a small program in your network.
Does the integration read salaries in Talentech?
No. The client gets no scope for salaries or national IDs.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Talentech PeopleCore API (api.talentech.io/peoplecore) with a JWT from the token service (client credentials) and scopes peoplecore-employees:read and :write, peoplecore-positions:read, peoplecore-contracts:read and peoplecore-resignations:read. GET /v1/Employees (isDrafted, talentechId, talentechIdEmail, businessContactInformation.businessEmail, manager, positionId, hasActiveResignation; filters only on name, HasResigned and TalentechId), /v1/Positions (organizationInformation with jobTitle, departmentId, locationId, legalEntityId, superiorPositionId; isVacant), /v1/Contracts, /v1/EmployeeResignApplications (lastDayOfWork, employmentEndDate). Write-back with PATCH /v1/Employees/{employeeId} and PUT /v1/Employees/{employeeId}/TalentechIdEmail.
- To Entra ID through API-driven inbound provisioning (POST /bulkUpload with SCIM, requires Entra ID P1 or higher) or Microsoft Graph (user with employeeId, givenName, surname, userPrincipalName, jobTitle, department, officeLocation, companyName, manager, usageLocation, employeeHireDate, employeeLeaveDateTime and accountEnabled).
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Talentech | Field in Microsoft Entra ID | Notes |
|---|---|---|
Kort nummer in externalSystemIdentifiers | employeeId | The Talentech ID is a UUID and does not fit in the 16 characters of employeeId |
employee.id (uuid) | Extensieattribuut met het Talentech-id | |
personalDetails.firstName, middleName, lastName | givenName, surname en displayName | |
Naamgevingsregel | userPrincipalName en mailNickname | |
position.organizationInformation.jobTitle | jobTitle | |
position.organizationInformation.departmentId (naam) | department | |
position.organizationInformation.locationId (naam) | officeLocation en usageLocation | |
position.organizationInformation.legalEntityId (naam) | companyName | |
superiorPositionId (medewerker op die positie) | manager | |
contract.startDate | employeeHireDate | |
resignation.employmentEndDate | employeeLeaveDateTime en accountEnabled | |
userPrincipalName (Entra ID) | businessEmail en talentechIdEmail |
Related
Recruitee → Talentech
Recruitee to Talentech integration: hired candidates with a contract on a position in Talentech
Talentech → Active Directory
Talentech to Active Directory integration: accounts in your own domain from PeopleCore
Talentech → ADP iHCM
Talentech to ADP iHCM integration: salaries and resignations from PeopleCore to Dutch ADP payroll
Talentech → AFAS Profit
Talentech to AFAS integration: employees, contracts and salaries from Talentech PeopleCore in AFAS