Identity and access management
YouForce to Active Directory integration: accounts opened and closed from Visma Raet
With an integration between Visma Raet YouForce and Active Directory, every new employee from YouForce automatically gets a network account, at the right location and with job title, department and manager. For a temporary contract the account expires on the end date by itself, and after the last working day the account closes without a ticket.
What the integration does
Organisations that use YouForce for HR and payroll and run Active Directory in their own data centre have new employees in YouForce on time, but the network account only follows a ticket. Temporary contracts end without anyone closing the account.
- IT installs the KoppelHet agent on a server in its own network, and the organisation grants KoppelHet read access to YouForce.
- HR records a new employee in YouForce. KoppelHet determines the main employment and location.
- The account is created in the location's place, with job title, department and employee number. For a temporary contract the end date is set straight away.
- Whoever becomes manager of a unit in YouForce joins the managers group and becomes the manager of that unit's employees.
- After the last working day the account is disabled and moved to the place for leavers.
What to watch for with Visma Raet YouForce and Active Directory
- For a temporary contract the end date is already in YouForce when the account is created. KoppelHet sets that date as the expiry date in Active Directory straight away. When HR extends the contract, the expiry date moves along.
- YouForce records per organisation unit who is responsible for what, and from when. Both the manager on each employee in Active Directory and membership of the managers group follow from that.
- A rehire usually keeps the same employee number in YouForce. The integration uses it to find the old, disabled account and re-enables it, instead of creating a second account with a sequence number.
- If an employee entered by mistake is deleted in YouForce, KoppelHet cleans up an account that was not yet in use, instead of only disabling it.
- The location in YouForce decides the account's place in Active Directory. Because policies apply per place, an employee who moves to another building automatically gets that building's printers and drives.
- Visma has announced direct notifications for changes in YouForce, but still as a concept. Until they are generally available, KoppelHet asks at a fixed interval what has changed since the last time.
- The agent may only write in the parts of Active Directory and the groups the integration manages. Admin and system accounts outside them are never touched.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Do we need to open ports for the agent?
No. The agent makes an outbound connection to the KoppelHet platform itself and collects its instructions there.
Can the username from Active Directory go back to YouForce?
Yes. We only request it if you want the email address or username written back.
What if an employee works at two locations?
The main employment then decides where the account sits. Groups for the second location can be added, so the employee can reach the right resources there too.
What if we move to Entra ID later?
Only the target changes. The rules for naming, groups and end dates stay the same.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- YouForce is read through the Youforce IAM API (persons, employments, organisation units and role assignments), with changes through the from parameter on latestSync. Webhooks with events such as EMPLOYMENT_CHANGED are documented by Visma, but still as a concept. The customer authorises KoppelHet in the Visma Developer Portal.
- Active Directory is written by an agent in the customer's network, with an outbound connection to the KoppelHet platform. Attributes employeeID, sAMAccountName (at most 20 characters), userPrincipalName, mail, givenName, sn, displayName, title, department, physicalDeliveryOfficeName, manager and accountExpires. The location decides the OU; the service account only has write rights on the managed OUs and groups.
- Writing back to YouForce is possible with the IAM API write scopes for contact details and for the identity of the YouForce user. After a move to Entra ID KoppelHet writes through Microsoft Graph.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Visma Raet YouForce | Field in Active Directory | Notes |
|---|---|---|
Persoonsnummer | employeeID | Key between YouForce and AD |
Naamgevingsregel | sAMAccountName | At most 20 characters |
Naamgevingsregel | userPrincipalName en mail | |
Roepnaam en achternaam volgens gebruik | givenName, sn en displayName | |
Functie (job profile) | title | |
Organisatie-eenheid | department | |
Locatie | OU en physicalDeliveryOfficeName | Through a lookup table to the OU structure |
Rolverdeling op de organisatie-eenheid | manager en groep leidinggevenden | |
Einddatum dienstverband | accountExpires |
Related
ADP Workforce Now → Visma Raet YouForce
ADP Workforce Now to YouForce integration: requests for new Dutch hires and contract changes
Bullhorn → Visma Raet YouForce
Bullhorn to YouForce integration: a placement becomes a hire request
Carerix → Visma Raet YouForce
Carerix to YouForce integration: a placed candidate starts the hire workflow in YouForce
Darwinbox → Visma Raet YouForce
Darwinbox to YouForce integration: hires and pay changes from Darwinbox as a request in YouForce