Identity and access management
YouForce to Entra ID integration: Microsoft accounts and managers from Visma Raet
With an integration between Visma Raet YouForce and Microsoft Entra ID, every new employee from YouForce automatically gets a Microsoft account, with department, cost centre, groups and the right manager. On departure sign-in is blocked on the agreed day, so the service desk no longer retypes forms and the org chart in Teams is right.
What the integration does
Organisations that record in YouForce who starts, changes department or leaves pass that on to the service desk through a form without an integration, and the service desk creates the user in Entra ID by hand. Managers are often missing in Entra ID, so approvals and the org chart in Teams are wrong.
- The organisation grants KoppelHet read access to the basic data in YouForce through Visma.
- KoppelHet fetches who has changed since the last time and determines the main employment per person.
- Before the first working day the Microsoft account is ready, with employee number, department, cost centre and the department's manager.
- Groups and licence follow from department and job. A temporary assignment to another department adds groups for that period.
- On the end date sign-in is blocked and the employee is removed from the groups. Deletion follows after a period the organisation chooses.
What to watch for with Visma Raet YouForce and Microsoft Entra ID
- YouForce has no manager field on the employee itself. It does record per department who holds the manager role, and KoppelHet derives the manager in Entra ID from that for the department of the main employment.
- If the manager is a member of the department they lead, they would become their own manager. In that case KoppelHet looks one level up in the organisation.
- A temporary assignment in YouForce places an employee in another department without changing the employment. KoppelHet adds groups for that period and removes them on the end date.
- An employee can be split across several cost centres in YouForce, while Entra ID holds only one. We take the cost centre with the largest share, or a fixed order the organisation chooses.
- Whether an employee still exists in YouForce does not say whether the account should close. For blocking in Entra ID KoppelHet uses the end date of the employment.
- The Microsoft account can go back to YouForce, so employees sign in to YouForce self-service with their Microsoft account.
- The employment type from YouForce, such as permanent, temporary or intern, is also in Entra ID. IT can then treat interns and temporary staff differently from permanent staff in groups and access rules.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
What access does KoppelHet need in YouForce?
Only read access to basic data. We do not request private data such as BSN and home address. The organisation approves the access itself through Visma.
What if managers in YouForce are not kept up to date?
Then the manager in Entra ID will be wrong too. Before go-live we list departments without a manager, so HR can complete them first.
Do contractors who are not in YouForce get an account?
Not through this integration. We agree up front which accounts the integration manages; it leaves other accounts alone.
Does this also work with on-premises Active Directory?
Yes, through an agent in your own network.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- YouForce is read through the Youforce IAM API with the read scope for basic data (persons, employments, role assignments), with records whose latestSync is after the previous run through the from parameter. The isActive flag only says whether a record still exists in HR Core. With the separate Update_Identity scope the UPN can go to the YouForce account.
- Entra ID is written through Microsoft Graph (user) with employeeId (at most 16 characters), givenName, surname, displayName, userPrincipalName, mailNickname, jobTitle, department, manager, employeeOrgData.costCenter, employeeType and accountEnabled = false on departure. employeeType can be used in dynamic groups and Conditional Access.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Visma Raet YouForce | Field in Microsoft Entra ID | Notes |
|---|---|---|
Persoonsnummer | employeeId | Fixed key; at most 16 characters in Entra ID |
Roepnaam | givenName | |
Achternaam volgens gebruik achternaam | surname en displayName | |
Naamgevingsregel | userPrincipalName en mailNickname | |
Functie (job profile) | jobTitle | |
Organisatie-eenheid | department | |
Rolverdeling op de organisatie-eenheid | manager | The person holding the manager role on the unit |
Kostenplaats uit de loonverdeling | employeeOrgData.costCenter | |
Soort arbeidsrelatie | employeeType | For example permanent, temporary or intern |
Datum uit dienst | accountEnabled = false |
Related
ADP Workforce Now → Visma Raet YouForce
ADP Workforce Now to YouForce integration: requests for new Dutch hires and contract changes
Bullhorn → Visma Raet YouForce
Bullhorn to YouForce integration: a placement becomes a hire request
Carerix → Visma Raet YouForce
Carerix to YouForce integration: a placed candidate starts the hire workflow in YouForce
Darwinbox → Visma Raet YouForce
Darwinbox to YouForce integration: hires and pay changes from Darwinbox as a request in YouForce