Identity and access management
Yoobi to Entra ID integration: Microsoft accounts based on employees and contracts in Yoobi
With an integration between Yoobi and Microsoft Entra ID, every new employee in Yoobi automatically gets a Microsoft account that is enabled on the contract start date and closed after the end date. New accounts go straight into the group that grants access to the Yoobi app in Entra ID, so signing in with Microsoft works from day one.
What the integration does
Organisations that keep contracts, hours and leave in Yoobi and have payroll handled externally know first in Yoobi who starts and who stops. Without an integration IT creates Microsoft accounts after an email, and interns and temporary staff keep their account after the last contract.
- Yoobi switches on the API for the organisation. The administrator creates a separate API user with rights only on employees and contracts.
- KoppelHet fetches new and changed employees and their contracts.
- For a new employee KoppelHet creates a disabled Microsoft account and adds it to the group for the Yoobi app.
- On the contract start date the account is enabled.
- After the end date of the last contract KoppelHet blocks the account and removes it from the groups.
What to watch for with Yoobi and Microsoft Entra ID
- Yoobi's API is not on by default; Yoobi switches it on on request and configures it per organisation. That is therefore the first step, before KoppelHet can read anything.
- Yoobi recommends creating separate API users instead of the user with full admin rights, and granting rights per method. KoppelHet only gets read rights on employees and contracts, and no access to hours, projects or invoices.
- Yoobi's API works on production data by default, including the built-in documentation in which you try out requests. KoppelHet therefore tests with read rights only, so a test request never changes an employee in Yoobi.
- In Yoobi the start and end date belong to an employee's contract, and an employee can have consecutive contracts. KoppelHet looks at the last contract, so an extension keeps the account open and an intern loses access after the last contract.
- For signing in with Microsoft you create your own enterprise application for Yoobi in Entra ID and assign the users to it. KoppelHet adds new accounts straight to the group attached to that application, so nobody is forgotten.
- After single sign-on is set up, each user must link their Microsoft account in Yoobi themselves through My details. KoppelHet has the new email address ready before the first working day, so that linking step works straight away.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Is Yoobi the right source for accounts?
If contracts and departures are kept first and best in Yoobi, yes. If your payroll system has that data earlier, it can be the source and Yoobi stays a target.
Can the email address go back to Yoobi?
Yoobi's API can update employee data. That needs write rights for the API user, which we only request if you want it.
Does this also work with Active Directory?
Signing in to Yoobi with Microsoft runs through Entra ID. For accounts in a local Active Directory we assess per situation whether it makes sense.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Yoobi is read through the Yoobi REST API (RAML and JSON) with a separate API user with rights per method, on the objects employees (create, retrieve and update) and employee contracts. Yoobi switches the API on per organisation.
- Entra ID is written through Microsoft Graph (user with employeeId, givenName, surname, displayName, userPrincipalName, mail, department, jobTitle, employeeHireDate, employeeLeaveDateTime and accountEnabled; group membership for Yoobi's enterprise application). Yoobi uses SAML with the federation metadata URL and the sign-in URL from Entra ID.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Yoobi | Field in Microsoft Entra ID | Notes |
|---|---|---|
Medewerkernummer | employeeId | Fixed key |
Voornaam | givenName | |
Achternaam met tussenvoegsel | surname en displayName | |
Naamgevingsregel | userPrincipalName en mail | |
Afdeling | department | |
Functie | jobTitle | |
Begindatum contract | employeeHireDate en accountEnabled | |
Einddatum laatste contract | employeeLeaveDateTime en accountEnabled |
Related
Recruitee → Yoobi
Recruitee to Yoobi integration: new colleagues ready for planning in Yoobi
Teamtailor → Yoobi
Teamtailor to Yoobi integration: hired candidates as employees in Yoobi, ready for planning and hours
Yoobi → AFAS Profit
Yoobi to AFAS integration: overtime, mileage and expenses from Yoobi in the AFAS payroll run
Yoobi → Nmbrs
Yoobi to Nmbrs integration: hours, leave and mileage per pay period to Nmbrs