Identity and access management
Visma Peple to Active Directory integration: accounts from Peple HRM & Payroll
With an integration between Visma Peple and Active Directory, a new employee from Peple automatically gets an account in Active Directory, in the folder of their organisational unit and with job and manager. On the end date of their last contract in Peple the account expires.
What the integration does
Organisations that use Peple for HR and payroll and have their own Active Directory, often synchronised with Entra ID, handle joiners and leavers with forms and manual work. With many temporary contracts and substitutes, Active Directory then lags behind, and expired contracts leave active accounts behind.
- IT installs KoppelHet's program once on a server in the domain, and the organisation grants KoppelHet read access to the Reporting API through Visma.
- KoppelHet fetches the organisational units from Peple and converts them to folders and groups as agreed with IT.
- For a new employee the program creates an account in the folder of their organisational unit, with a username according to the naming rule.
- When the contract changes unit or job, the account moves and the group membership adjusts.
- The account gets the end date of the last contract as its expiry date and then moves to the leavers folder.
What to watch for with Visma Peple and Active Directory
- Organisational units in Peple have a parent unit and their own start and end date. KoppelHet uses that to build the tree and only creates folders and groups for units that are still valid, so a discontinued unit no longer receives new accounts.
- Peple delivers each export as a file that is only ready after some time, and can send KoppelHet a signal when it is. The program in the domain waits for that signal and therefore does not need to keep asking Peple.
- Peple returns all dates in UTC. A contract ending on 31 December therefore appears as 30 December 23:00 in the export. KoppelHet converts back to Dutch time before setting the expiry date in Active Directory, so nobody is locked out a day early.
- Employees with several contracts, such as a permanent appointment plus a temporary extension at another unit, appear in Peple with a separate contract per unit. KoppelHet places the account in the folder of the main contract and also grants the groups of the other units.
- In Peple's contract data the manager points to a user ID and not to an employee. Using the user overview, where each user ID has an employee number, KoppelHet looks up the manager's account in Active Directory.
- Peple allows full exports only twice a day per data set. The daily comparison between Peple and Active Directory therefore uses one full export at night; during the day KoppelHet works with the changes since the previous run.
- On Saturday evening Peple has a maintenance window and temporarily refuses new exports. KoppelHet waits the indicated time and then tries again, so a change in that window is not lost.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Does Peple need to reach our network?
No. Peple's signal arrives on the KoppelHet platform, and the program in your network collects the jobs there through an outbound connection.
What happens to substitutes who keep coming back?
They keep the same account. With a new contract under the same employee number, KoppelHet re-enables the account and moves the expiry date.
Does this also work with Entra ID only?
Yes. KoppelHet then writes directly to Entra ID; the rules for contracts, units and managers stay the same.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Peple is read through the Visma.net HRM & Payroll Reporting API (Visma Connect, client credentials per tenant) with scopes for employees, contracts, organization units and users. Exports with POST /v1/command/nl/hrm/... and optionally callbackAddress; results through GET /v1/query/nl/hrm/.../{jobId}; incremental with changeTimestampAfter and changeTimestampBefore; dates in UTC; 503 with Retry-After during maintenance (Saturday around 23:30 UTC).
- A KoppelHet agent in the domain applies the changes through an outbound connection. AD attributes include employeeID, sAMAccountName (at most 20 characters), userPrincipalName, mail, givenName, sn, displayName, title, department, company, manager and accountExpires; an OU per organisational unit and an OU for leavers.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Visma Peple | Field in Active Directory | Notes |
|---|---|---|
employeeid | employeeID | |
Naamgevingsregel | sAMAccountName | At most 20 characters, unique |
nickname en achternaam volgens nameusage | givenName, sn en displayName | |
businessemailaddress | mail en userPrincipalName | |
functionname | title | |
orgunit en orgunitparentid | OU en department | |
manageruserid | manager | Through the user overview to the manager's account |
companyname | company | |
enddate van het laatste contract | accountExpires |
Related
ASVisma Peple → Arbodienst (SIVI)
Visma Peple to occupational health service via SIVI: sick and recovery notifications from Peple to the health service
Visma Peple → Microsoft Entra ID
Visma Peple to Entra ID integration: Microsoft accounts from Peple HRM & Payroll
Visma Peple → Exact Online
Visma Peple to Exact Online integration: cost centres ready in Exact and employee changes on a worklist
Visma Peple → Freshservice
Visma Peple Freshservice integration: requesters per contract and requests on joining and leaving