Identity and access management
Zoho People to Entra ID integration: Zoho Directory or custom work driven by HR
With an integration between Zoho People and Microsoft Entra ID, a new employee from Zoho People gets a Microsoft account with department, designation, location and manager, and the account is blocked after the last working day from the exit process in Zoho People. Through Zoho Directory, Zoho can itself create Microsoft 365 accounts when IT assigns a user to the app; KoppelHet comes in when the account has to follow what HR records in Zoho People.
What the integration does
Organisations that use Zoho People for HR and have Microsoft 365 as their workplace often create Microsoft accounts by hand. Zoho's own Microsoft integrations instead pull users from Microsoft into Zoho, or only create accounts when IT assigns someone in Zoho Directory.
- We check whether you already use Zoho Directory and who assigns users to Microsoft 365 there.
- We record which fields of the employee form go to Entra ID, including custom fields.
- KoppelHet fetches changed records and creates or updates the Microsoft account.
- After an exit is approved, KoppelHet sets the leave date on the account.
- After the last working day KoppelHet blocks the account; deleting stays a choice for IT.
What to watch for with Zoho People and Microsoft Entra ID
- Zoho Directory can create Microsoft 365 accounts as soon as IT assigns a user to the Microsoft 365 app, and deletes the Microsoft account when the assignment is withdrawn. That deletion also affects mail and files. Anyone who wants accounts to follow HR data therefore does not let the app assignment handle departures.
- The Microsoft 365 app of Zoho People works the other way round. An administrator uses it to import users from Office 365 as active Zoho People users. A new colleague who only exists in Zoho People does not get a Microsoft account that way.
- In Zoho People the administrator chooses whether the Date of Exit is filled in when the resignation is approved, or only on the last working day. With the first choice KoppelHet sets the date ahead as the leave date in Entra ID; with the second KoppelHet blocks as soon as the date appears.
- By default Zoho People disables a leaver's own login at half past eight on the morning after the last working day. KoppelHet blocks the Microsoft account in the same night, so nobody can still use Teams for a morning while Zoho People is already closed.
- Zoho People allows at most two hundred records per request and can filter on records changed after a point in time. Every fifteen minutes KoppelHet only requests that difference and stays well below the threshold above which Zoho blocks for five minutes.
- Writing the Microsoft address back to Zoho People requires a separate write scope and has its own limit of three hundred requests per minute. Because the email field in Zoho People is also the login, we agree per customer whether KoppelHet fills that field or a custom field for the work address.
- In the first run KoppelHet looks up every existing Entra user in Zoho People by email address or employee ID. That way existing colleagues get their account linked instead of a second account.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Why not Zoho Directory's Microsoft 365 provisioning?
It starts with an assignment by IT, not with a hire or exit in Zoho People, and deletes accounts when withdrawn. If that is enough, we build nothing twice.
Which Zoho plan is needed?
The Zoho People API is included in Essential HR, Professional, Premium and Enterprise.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Zoho People API with OAuth 2.0 (header Authorization Zoho-oauthtoken). Reading through GET /people/api/forms/employee/getRecords with sIndex, limit (at most 200) and modifiedtime (milliseconds), scope ZOHOPEOPLE.forms.READ, four hundred requests per minute with a five-minute lock. Search with SearchColumn EMPLOYEEID or EMPLOYEEMAILALIAS. Writing back through POST /api/forms/json/employee/updateRecord (recordId, inputData), scope ZOHOPEOPLE.forms.UPDATE, three hundred per minute.
- To Entra ID through API-driven inbound provisioning (/bulkUpload with SCIM, requires Entra ID P1 or higher) or Microsoft Graph (user with employeeId, userPrincipalName, department, jobTitle, officeLocation, usageLocation, manager, employeeLeaveDateTime and accountEnabled).
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Zoho People | Field in Microsoft Entra ID | Notes |
|---|---|---|
EmployeeID | employeeId | At most 16 characters |
FirstName en LastName | givenName, surname en displayName | |
EmailID of naamgevingsregel | userPrincipalName en mail | |
Department | department | |
Designation | jobTitle | |
Location | officeLocation en usageLocation | |
Reporting To | manager | |
Date of Exit | employeeLeaveDateTime en accountEnabled = false |
Related
Recruitee → Zoho People
Recruitee to Zoho People integration: hired candidates in the Zoho People employee form
Teamtailor → Zoho People
Teamtailor to Zoho People integration: hired candidates as a record in the Zoho People employee form
Zoho People → Active Directory
Zoho People to Active Directory integration: HR drives the domain account, not the other way round
Zoho People → AFAS Profit
Zoho People to AFAS integration: new hires and changes to Dutch payroll