Identity and access management
Workday to Entra ID integration: Microsoft accounts for the Netherlands from global HR
With an integration between Workday and Microsoft Entra ID, every new Dutch colleague in Workday automatically gets a Microsoft account with groups and licence, and that account follows a new job. A departure that has been in Workday for weeks blocks the account on exactly the last day, without local IT having to remember it.
What the integration does
Organisations that manage all workers in Workday but have their own Microsoft tenant in the Netherlands have local IT create accounts by hand from an export or email. A termination that has been in Workday for weeks only reaches Entra ID when someone remembers it.
- HR completes a hire in Workday for the Dutch entity.
- KoppelHet derives the email address from the agreed naming rules, and uses the preferred name when it is in Workday.
- Before the start date the Microsoft account is ready, with manager and the groups for company, location and job.
- If you want, the new email address goes back to Workday, so other Workday integrations know the right address too.
- A job change updates details and groups on its effective date. After a departure sign-in is blocked on the last day and the licence is removed later.
What to watch for with Workday and Microsoft Entra ID
- Workday numbers employees and contingent workers in separate series. A number is therefore not automatically unique across both. KoppelHet records the worker type in Entra ID and prevents two people ending up on the same account.
- Workday is often set up for the whole world, while this Microsoft environment serves only the Netherlands. KoppelHet only includes employees who belong to this environment.
- A departure with a future date is in Workday before it takes effect. KoppelHet writes that date to Entra ID and blocks the account on the day itself.
- Microsoft also ships its own Workday integration for Entra ID, which can write the email address back. KoppelHet uses the same Workday functions for that write-back step, if you want it.
- Workday shows the preferred name when there is one, and the legal name otherwise. Teams and Outlook show the preferred name; the legal name stays in Workday for contracts and payroll.
- Department names in Workday are often long and contain codes. Entra ID allows at most 64 characters, so a lookup table converts them to the name colleagues recognise.
- In Workday the integration may only see worker, organisation and contact data. Salary and bank details are excluded.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Why not Microsoft's own Workday integration?
It can be a fine choice. KoppelHet fits better when you want Dutch naming rules, groups and licences derived from Workday, or when the same Workday data also goes to other systems.
Do contingent workers get an account too?
If you want them to. They are recognisable as external in Entra ID, so IT can manage their access separately.
What if Workday is only managed at headquarters?
That is common. Dutch IT does not need to change Workday; headquarters does need to create an integration user with the right permissions.
How do you handle a hybrid environment?
If the accounts live in Active Directory in your own network, KoppelHet writes to Active Directory and Microsoft carries it over to Entra ID.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Workday is read through Workday Web Services (Get_Workers) or a RaaS report, on completed business processes (Hire, Change Job, Terminate) and change date, with an Integration System User with only the security domains for worker, organisation and contact data. Employee_ID and Contingent_Worker_ID are separate series.
- Entra ID is written through Microsoft Graph. employeeId (at most 16 characters), givenName and surname (Preferred_Name_Data, otherwise Legal_Name_Data), userPrincipalName, mailNickname (required on create), jobTitle (Business_Title), department (at most 64 characters), manager, employeeType, employeeHireDate, usageLocation, employeeLeaveDateTime and accountEnabled.
- employeeLeaveDateTime requires the Graph permission User-LifeCycleInfo.ReadWrite.All. Write-back to Workday through Change_Work_Contact_Information and Update_Workday_Account, as Microsoft's Workday app does.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Workday | Field in Microsoft Entra ID | Notes |
|---|---|---|
Employee_ID / Contingent_Worker_ID | employeeId | At most 16 characters in Entra ID |
Preferred_Name_Data (anders Legal_Name_Data) | givenName en surname | |
Naamgevingsregel | userPrincipalName en mailNickname | mailNickname is required on create |
Business_Title | jobTitle | |
Supervisory organization | department | At most 64 characters in Entra ID; long names through a lookup table |
Manager uit de supervisory organization | manager | |
Worker type | employeeType | For example Employee or Contractor |
Hire_Date | employeeHireDate | |
Land van de locatie | usageLocation | |
Termination_Date | employeeLeaveDateTime en accountEnabled = false |
Related
Ashby → Workday
Ashby to Workday integration: hires to Workday, with a check on outcome and phone number
Bullhorn → Workday
Bullhorn to Workday integration: a consultant's first placement as a hire in Workday
Carerix → Workday
Carerix to Workday integration: a placed candidate becomes a pre-hire and starts the hire
Greenhouse → Workday
Greenhouse to Workday integration: hires as pre-hires, interim staff and contractors included