Identity and access management
Zoho People to Active Directory integration: HR drives the domain account, not the other way round
With an integration between Zoho People and Active Directory, a new employee from Zoho People gets a domain account in the OU of their location, with department, designation and manager, and the account expires on the last working day from the exit process. Zoho's own synchronisation only runs from Active Directory to Zoho, so for this direction KoppelHet builds the integration, with a small program in your domain.
What the integration does
Organisations with Zoho People and their own Windows domain sometimes use Zoho's Directory Sync tool to get domain users into Zoho. It only works from the domain to Zoho; a new colleague in Zoho People does not get a domain account from it.
- We record the OU per location and the groups per department, and which form fields apply.
- Every fifteen minutes KoppelHet fetches the changed records of the employee form.
- The program in the domain creates the account or moves it when the location changes.
- As soon as the Date of Exit is in Zoho People, it becomes the account's expiry date.
- After departure KoppelHet disables the account and removes it from the groups.
What to watch for with Zoho People and Active Directory
- Zoho's Directory Sync tool compares the domain with Zoho and updates Zoho; according to Zoho, synchronisation always runs from Active Directory to Zoho. If you use that tool, it stays in place. KoppelHet creates the account in the domain, and the tool then carries it over to Zoho Directory.
- Whether the Date of Exit appears when the resignation is approved or only on the last working day is set by the Zoho People administrator. KoppelHet sets the date as the expiry date as soon as it is there; with the first setting the domain therefore knows weeks in advance when the account stops.
- HR changes a leaver's status in Zoho People by hand, and only from the last working day. KoppelHet does not wait for it and uses the Date of Exit, so a forgotten status change does not keep the domain account open.
- By default Zoho People closes a leaver's own login the morning after the last working day. An expiry date in Active Directory takes effect at the end of the day before; that way the domain and Zoho People stop around the same moment.
- Fields such as department, designation and location sit in a form the administrator can change. At the start we record which field determines the OU; if the administrator renames a location, KoppelHet reports it instead of sending accounts to an unknown OU.
- Zoho People blocks anyone who sends more than four hundred requests per minute for five minutes, and that applies to the whole environment. KoppelHet only requests records changed since the previous run, in pages of two hundred, and only gets read rights on forms.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Can't Zoho's Directory Sync tool do this?
No. It brings users and passwords from the domain to Zoho, not new employees from Zoho People to the domain.
Does anything need to be opened in the firewall?
No. The program in the domain only makes an outbound connection to the KoppelHet platform.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Zoho People API with OAuth 2.0 (header Authorization Zoho-oauthtoken, scope ZOHOPEOPLE.forms.READ). GET /people/api/forms/employee/getRecords with sIndex, limit (at most 200, otherwise error code 7021) and modifiedtime in milliseconds; four hundred requests per minute with a five-minute lock.
- A KoppelHet agent on a Windows server in the domain fetches instructions through an outbound connection and writes employeeID, sAMAccountName, userPrincipalName, givenName, sn, displayName, title, department, manager and accountExpires, manages groups and moves accounts between OUs.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Zoho People | Field in Active Directory | Notes |
|---|---|---|
EmployeeID | employeeID | At most 16 characters |
Naamgevingsregel | sAMAccountName en userPrincipalName | sAMAccountName at most 20 characters |
FirstName en LastName | givenName, sn en displayName | |
Department | department en groepen | |
Designation | title | |
Location | OU | |
Reporting To | manager | |
Date of Exit | accountExpires |
Related
Recruitee → Zoho People
Recruitee to Zoho People integration: hired candidates in the Zoho People employee form
Teamtailor → Zoho People
Teamtailor to Zoho People integration: hired candidates as a record in the Zoho People employee form
Zoho People → AFAS Profit
Zoho People to AFAS integration: new hires and changes to Dutch payroll
ASZoho People → Arbodienst (SIVI)
Zoho People to the occupational health service via SIVI: sick leave records as absence reports