Identity and access management
Unit4 HR to Entra ID integration: Microsoft accounts from Unit4 ERPx
With an integration between Unit4 HR and Microsoft Entra ID, every employee from Unit4 ERPx automatically gets a Microsoft account, with department, job, manager and the matching groups. After the end date of the last employment in Unit4, sign-in is blocked.
What the integration does
Organisations that run HR and finance in Unit4 ERPx and work with Microsoft 365 often create Microsoft accounts by hand. HR and finance share the same employees in Unit4, but IT only hears about a new colleague once they have started, and a leaver keeps their account until someone notices.
- Unit4 supplies a dedicated client for machine-to-machine access, linked to a separate user in ERPx for this integration.
- KoppelHet reads the employees changed since the previous run, with employments and relations.
- For a new employee a Microsoft account is ready before the start date, with department, job and manager.
- The employee joins the groups for their organisational unit and position and gets a licence through a group.
- After the end date of the last employment KoppelHet blocks sign-in and deletion follows after the agreed period.
What to watch for with Unit4 HR and Microsoft Entra ID
- For integrations without a user, Unit4 works with a client ID and secret per tenant, linked to a separate user in ERPx with the SUPER or SYSTEM role. That role can do far more than read. KoppelHet therefore asks for a dedicated client for this integration only, so you can revoke it separately.
- A tenant can have at most ten of those machine clients, shared by all integrations with Unit4. If many integrations with finance and procurement are already running, we check up front whether a client is still available.
- An employee in Unit4 can have more than one employment, and one of them is marked as the main position. KoppelHet takes job and department from that main employment and only blocks the account when the last employment has ended.
- An employee record in Unit4 can be in an approval workflow before it is final. KoppelHet only creates an account once that workflow has finished, so a rejected entry does not produce a Microsoft account.
- Besides employees, Unit4 has its own ERP users, with a link between the two and a field for the identity in an external directory. If you want, KoppelHet writes the Entra identity back there, so signing in to Unit4 and the right ERP user account stay together.
- Relations such as organisational unit and cost centre have a start and end date in Unit4. KoppelHet updates department and groups in Entra ID on the date the new relation takes effect, not at the moment of entry.
- A Unit4 tenant can contain several companies. KoppelHet carries the company over as the company name in Entra ID, so licences, email domain and dynamic groups can differ per company.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Will finance notice this integration?
No. KoppelHet only reads, and Unit4's limits apply to all integrations together. We only request the changed employees, so there is room left for the rest.
What if a manager has no Microsoft account?
The manager then stays empty and IT sees a notification in the platform.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Unit4 ERPx is read through the ObjectAPI (GET /v1/objects/employees, read-only) with OAuth 2.0 client credentials through Unit4 Identity Services (scope u4erp, token 3600 seconds), incrementally with filter=lastUpdated/updatedAt ge {previous run}. Fields used include companyId, personId, nameInformation, status, workflowState, employments (isMainPosition, employmentStartDate, employmentEndDate, positionId), relatedValues with relationDateFrom and relationDateTo, and employeeConnectionToUsers. At most 50,000 records per call.
- Entra ID is written through Microsoft Graph (user) with employeeId (at most 16 characters), givenName, surname, displayName, userPrincipalName, mailNickname, jobTitle, department, companyName, manager, usageLocation, employeeHireDate, employeeLeaveDateTime (requires User-LifeCycleInfo) and accountEnabled.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Unit4 HR | Field in Microsoft Entra ID | Notes |
|---|---|---|
personId (resourcenummer) | employeeId | With company code when there are several companies |
nameInformation.firstName | givenName | |
nameInformation.surname | surname en displayName | |
Naamgevingsregel | userPrincipalName en mailNickname | |
Positie van het hoofddienstverband | jobTitle | |
Organisatie-eenheid uit de relaties | department | |
companyId | companyName | |
Leidinggevende uit de relaties | manager | |
employmentStartDate | employeeHireDate | |
employmentEndDate van het laatste dienstverband | employeeLeaveDateTime en accountEnabled |
Related
Greenhouse → Unit4 HR
Greenhouse to Unit4 HR integration: accepted offer as an employee in the right Unit4 company
Recruitee → Unit4 HR
Recruitee to Unit4 HR integration: hired candidate as employee in Unit4, validated before it is saved
SmartRecruiters → Unit4 HR
SmartRecruiters to Unit4 HR integration: hire on the position from SmartRecruiters, with onboarding status back
Teamtailor → Unit4 HR
Teamtailor to Unit4 HR integration: hired candidates as employees in Unit4 ERPx, with company and position