Identity and access management

YouServe to Active Directory integration: accounts that follow the personnel records

With an integration between Visma YouServe and Active Directory, a new employee in YouServe automatically gets an Active Directory account, with job title, department, manager and groups. After the last working day nobody can sign in with the account, and IT no longer waits for separate messages from HR.

Discuss your integration How the integration works

Written by Marcel van Beek, founder and integration specialistLast updated: 9 November 2026

What the integration does

Organisations that record new colleagues, job changes and departures in Visma YouServe pass those changes to IT in separate messages without an integration, and IT applies them to Active Directory itself. Whether accounts and groups are right then depends on who sends an email.

IT installs a small KoppelHet program once on a server in the domain.
HR enters a new employee in YouServe. KoppelHet checks whether they get an account according to the agreements.
Before the first working day the account is in the right folder, with employee number, job title, department and manager.
On a new job or department the details are updated and the groups swapped.
On the end date the account is disabled and set aside, so IT can still hand over mailbox and files.

Out: Account with username, email address and display name · Employee number · Job title, department and manager · Folder based on location or department · Security groups per job

What to watch for with Visma YouServe and Active Directory

If YouServe feeds Freshservice and TOPdesk as well as Active Directory, a wrong department name shows up in three places, so we correct it in YouServe and not in Active Directory.
YouServe runs on Visma's HR platform. Which data is available depends on that platform; per customer we establish whether location, cost centre and manager come along.
Dutch employees often choose whether they use their own surname, their partner's or a combination. The integration takes the name usage from YouServe, so the address book shows what HR recorded.
Not every employee of a wholesaler works at a PC. Per job or department we agree who gets an account, so no unused accounts are created.
Besides disabling, the account also gets an expiry date equal to the end date. If the program is down for a day, the account still cannot be used after that date.
The employee number from YouServe goes onto the account. That lets the integration find an existing account, even when someone changes their name.
An employee with two employments gets one account. The employment with the most hours decides job and department, and the account stays active until the last employment ends.

This integration is also part of joiner, mover, leaver.

How we build and run it

The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
Every sync and every error is visible in the functional log; on an error your administrator is notified.
A change that cannot go through is not half-applied but queued for another attempt.
KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
After go-live we manage the integration and adjust it when your process changes.
The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.

Implementation, architecture and compliance

Implementation and price

This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.

A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.

Price indication · Basic

Customer case

How it runs at Farmplus

How these organisations use the integration. The configuration differs for each customer.

Farmplus

Wholesale

Farmplus uses Visma YouServe as the source for Active Directory. For a new hire or a leaver the integration creates a service request in Freshservice, and mobile numbers from TOPdesk reach Active Directory through Joinly.

Read the customer story

Frequently asked questions

Does anything need to be opened in our firewall?

No. The KoppelHet program sets up an outbound connection to the platform itself. No traffic comes in from outside.

Can the same YouServe integration also feed our service desk?

Yes. The same employee data can also go to Freshservice and TOPdesk. Those are separate integrations on the same source.

What happens to accounts that already exist in Active Directory?

Before go-live we link existing accounts to employees in YouServe through the employee number. Accounts we cannot link go on a list that IT reviews first.

Does this still work if we later use Entra ID only?

Yes. The integration then writes directly to Entra ID. The agreements on naming and groups stay in place.

Technical details for IT

For those who want to know how it works under the hood: APIs, fields and sources used.

YouServe is read through the Visma platform APIs (HR Core), on last change.
A KoppelHet agent on a Windows server in the domain carries out the changes through an outbound connection. AD attributes include employeeID (at most 16 characters), sAMAccountName (at most 20 characters), userPrincipalName, mail, givenName, sn, displayName, title, department, manager and accountExpires; organizational unit (OU) per location or department.

Which fields are transferred

The key fields. The full mapping is agreed per customer.

Field in Visma YouServe	Field in Active Directory	Notes
`Personeelsnummer`	`employeeID`	At most 16 characters in AD; also serves as the matching key
`Roepnaam`	`givenName`
`Achternaam volgens naamgebruik`	`sn en displayName`	Own name or partner's name, as HR records it
`Naamgevingsregel`	`sAMAccountName`	At most 20 characters, with a sequence number for duplicates
`Naamgevingsregel`	`userPrincipalName en mail`
`Functie`	`title`
`Afdeling`	`department en OU`	Through a lookup table to the OU structure
`Leidinggevende`	`manager`	Distinguished name of the manager's account
`Datum uit dienst`	`accountExpires`	Safety net next to the agent disabling the account

Sources