Identity and access management
Unit4 HR to Active Directory integration: accounts from Unit4 ERPx in your own domain
With an integration between Unit4 HR and Active Directory, a new employee in Unit4 ERPx automatically creates an account in Active Directory, in the folder of their company or organisational unit and with job, department and manager. After the end date of their last employment the account is disabled and moved aside.
What the integration does
Organisations that use Unit4 ERPx for HR and finance and also run their own Active Directory have IT create accounts based on a form or a list from Unit4. Transfers to another unit or cost centre therefore reach Active Directory late or not at all, and group rights stay with the old department.
- IT installs KoppelHet's program once on a server in the domain, and Unit4 supplies a separate client for this integration.
- KoppelHet periodically requests the employees changed since the previous run.
- For a new employee the program creates an account in the right folder, with a username according to the naming rule.
- On a transfer the account moves on the effective date and the groups change with it.
- After the last working day the account is disabled and moved to the leavers folder.
What to watch for with Unit4 HR and Active Directory
- In Unit4, HR and finance share the same employee. A different cost centre on the employee affects project postings and is often the basis for folders or printers in Active Directory. KoppelHet therefore carries the cost centre over with its effective date, so Active Directory has the same state as the books.
- Unit4 sets a ceiling of 500 requests per minute and 500,000 per day, for all integrations with the tenant together. KoppelHet only requests the employees changed since the previous run, so the Active Directory integration does not get in the way of the finance integrations.
- Unit4 recommends including the boundary of the previous run when fetching changes, so nothing slips through. As a result an employee sometimes arrives twice. The program in the domain only writes when something is actually different, so accounts are not touched needlessly.
- Unit4 offers change notifications through its own Extension Kit. Without that module KoppelHet reads on a fixed interval; with Extension Kit a change in Unit4 can start the run straight away.
- An employee in Unit4 can have the status active, terminated or on leave. KoppelHet does not disable an account on leave unless you agree otherwise, but it does disable it on terminated after the last working day.
- Which data element in Unit4 carries the department and the manager differs per setup, because Unit4 records them as relations on the employee. KoppelHet agrees that choice with you up front and translates every organisational unit into a folder and group in Active Directory.
- A tenant with several companies gives each company its own folder and, if you want, its own suffix for the sign-in name. Resource numbers that occur in two companies get a company code in front of them in Active Directory.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Do any ports need to be opened for this integration?
No. The program in your domain makes its own outbound connection to the KoppelHet platform.
Do we need Extension Kit?
No. Without Extension Kit the integration works on a fixed interval. With Extension Kit a change can come through faster.
What happens to accounts that do not come from Unit4?
They stay out of scope, as long as they are not in the folders the integration manages. Which folders those are, we agree up front.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Unit4 ERPx is read through the ObjectAPI (GET /v1/objects/employees) with OAuth 2.0 client credentials through Unit4 Identity Services, incrementally with filter=lastUpdated/updatedAt ge and paging with limit and offset (at most 50,000 records per call). Tenant limits of 500 requests per minute and 500,000 per 24 hours for all M2M clients together. Events through Message Hub and Extension Kit (optional).
- A KoppelHet agent in the domain applies the changes through an outbound connection. AD attributes include employeeID, sAMAccountName (at most 20 characters), userPrincipalName, givenName, sn, displayName, title, department, company, manager, an extensionAttribute for the cost centre and userAccountControl; an OU per company or organisational unit.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Unit4 HR | Field in Active Directory | Notes |
|---|---|---|
personId (resourcenummer) | employeeID | |
Naamgevingsregel | sAMAccountName | At most 20 characters; a sequence number for duplicates |
nameInformation.firstName en surname | givenName, sn en displayName | |
Positie van het hoofddienstverband | title en groepen | |
Organisatie-eenheid uit de relaties | department en OU | |
Kostenplaats uit de relaties | Eigen attribuut kostenplaats | |
companyId | company | |
Leidinggevende uit de relaties | manager | |
Einde laatste dienstverband | userAccountControl (uitgeschakeld) |
Related
Greenhouse → Unit4 HR
Greenhouse to Unit4 HR integration: accepted offer as an employee in the right Unit4 company
Recruitee → Unit4 HR
Recruitee to Unit4 HR integration: hired candidate as employee in Unit4, validated before it is saved
SmartRecruiters → Unit4 HR
SmartRecruiters to Unit4 HR integration: hire on the position from SmartRecruiters, with onboarding status back
Teamtailor → Unit4 HR
Teamtailor to Unit4 HR integration: hired candidates as employees in Unit4 ERPx, with company and position