Identity and access management
Visma Peple to Entra ID integration: Microsoft accounts from Peple HRM & Payroll
With an integration between Visma Peple and Microsoft Entra ID, every new employee from Peple automatically gets a Microsoft account, with department, job, manager and the right groups. After the end date of the last contract in Peple, sign-in is blocked.
What the integration does
Organisations that record HR and payroll in Peple and work with Microsoft 365 often create accounts by hand based on an email from HR. Someone with a temporary contract or a second contract at another unit then drops out of sight, and leavers' accounts stay open.
- The organisation grants KoppelHet access to Peple's Reporting API through Visma, only for employees, contracts, organisational units and users.
- KoppelHet requests the changes since the previous run several times a day and determines the main contract per employee.
- For a new employee the Microsoft account is ready before the start date, with department, job and manager.
- The employee joins the groups for their organisational unit and job and gets their licence through a group.
- After the end date of the last contract KoppelHet blocks sign-in; deletion follows after the agreed period.
What to watch for with Visma Peple and Microsoft Entra ID
- Peple's Reporting API is built for keeping track of changes, not for one-off lookups. An export is a job Peple runs in the background, after which KoppelHet fetches the result. A new account is therefore in Entra ID within a few hours, not within a minute.
- Peple allows only two full exports per data set per day. KoppelHet does the initial load in full and afterwards only asks for what has changed since the previous run, so there is room left for a full check when needed.
- After a change at company level, Peple sometimes returns all employees of that company as changed. KoppelHet compares each field with what is already in Entra ID and only writes real differences, so Microsoft's audit log does not fill up.
- In Peple, organisational unit, job and manager sit on the contract, and an employee can have more than one contract. KoppelHet picks the main contract per employee for department and job, and only blocks the account after the end date of the last contract.
- The manager is stored on a contract as a Peple user ID, not as an employee number. KoppelHet uses Peple's user overview to find the matching employee and then links that employee's Microsoft account as manager.
- The business email in Peple falls under the regular employee data, but private addresses, phone numbers and BSN need separate rights. KoppelHet does not request those extra rights, so that data never reaches the integration.
- When a contract or employee is deleted in Peple, the Reporting API returns an empty row with only the keys. KoppelHet recognises such a row and treats it as a lapsed contract, instead of writing the empty values to Entra ID.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Why not Peple's IAM API?
That API manages users in Visma.net itself, for example who may sign in to Peple. For Microsoft accounts KoppelHet needs the employee and contract data, and that comes from the Reporting API.
How quickly is a new employee in Entra ID?
Within a few hours of entry in Peple. Because HR usually enters a contract well before the start date, the account is ready on time.
Does the integration see payroll data?
No. With the fields parameter KoppelHet only requests the fields Entra ID needs; salary and tax fields stay out.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Peple is read through the Visma.net HRM & Payroll Reporting API with Visma Connect (client credentials, per tenant) and the scopes hrmanalytics:nlhrm:exportemployees, exportcontracts, exportorganizationunits and exportusers. Exports through POST /v1/command/nl/hrm/{employees, contracts, organization/units, users} and retrieval through GET /v1/query/nl/hrm/.../{jobId}; incremental with changeTimestampAfter and changeTimestampBefore, limited with the fields parameter. Two full exports per endpoint per tenant per 24 hours; ghost records for deletions; 503 with Retry-After during maintenance.
- Entra ID is written through Microsoft Graph (user) with employeeId (at most 16 characters), givenName, surname, displayName, userPrincipalName, mail, jobTitle, department, companyName, manager, usageLocation, employeeHireDate, employeeLeaveDateTime (requires User-LifeCycleInfo) and accountEnabled.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Visma Peple | Field in Microsoft Entra ID | Notes |
|---|---|---|
employeeid | employeeId | At most 16 characters |
nickname (roepnaam) | givenName | |
Achternaam volgens nameusage | surname en displayName | Birth name, partner name or combination |
businessemailaddress of naamgevingsregel | userPrincipalName en mail | |
functionname van het hoofdcontract | jobTitle | |
orgunitname van het hoofdcontract | department | |
companyname | companyName | |
manageruserid via het gebruikersoverzicht | manager | |
startdate van het eerste contract | employeeHireDate | |
enddate van het laatste contract | employeeLeaveDateTime en accountEnabled |
Related
Visma Peple → Active Directory
Visma Peple to Active Directory integration: accounts from Peple HRM & Payroll
ASVisma Peple → Arbodienst (SIVI)
Visma Peple to occupational health service via SIVI: sick and recovery notifications from Peple to the health service
Visma Peple → Exact Online
Visma Peple to Exact Online integration: cost centres ready in Exact and employee changes on a worklist
Visma Peple → Freshservice
Visma Peple Freshservice integration: requesters per contract and requests on joining and leaving