Compliance and sectors
IAM in education: staff accounts from the HR system
IAM in education makes sure a school board's staff get an account automatically, keep the right permissions per school and are closed off when they leave, with evidence for the Dutch IBP framework or SURFaudit. KoppelHet does this with Joinly, which connects HR systems such as AFAS, Visma and HR2day to Microsoft 365 or Google Workspace.
What it is
A school board has staff at many schools at once, with substitute teachers and people who work at several locations. Accounts are created slightly differently per school, and a central role structure is often missing.
Access management is a separate domain in the Dutch standards framework for information security and privacy in primary and secondary education (IBP) by Kennisnet and SIVON. From 1 January 2027 every school board must know where it stands through a self-assessment. Vocational and higher education are assessed through SURFaudit. Universities and universities of applied sciences are also covered by the Cyber Security Act.
How Joinly handles it
- Accounts are created on hiring and closed at once on departure, including for substitutes and staff at several schools.
- Roles depend on job and on school or location: teacher, special needs coordinator, caretaker and head teacher each get the right profile.
- The board decides centrally how accounts are created. The school stays in charge of its own teaching.
- Joinly works on top of Microsoft Entra ID or Google Workspace, also with a local Active Directory.
- Logging and reporting provide the evidence for the self-assessment and audits.
- Applications for teaching and operations connect through SCIM and app integrations.
What KoppelHet does
In education KoppelHet also connects beyond IAM, for example Entra ID to ESIS, so staff appear in the pupil administration system with the right task assignment.
Joinly
Continue at Joinly
Joinly is KoppelHet's IAM software. joinly.app shows how the product handles this, with screens, pricing and a demo.
Common integrations
AFAS Profit → Microsoft Entra ID
Connect AFAS with Microsoft Entra ID
HR2day → Microsoft Entra ID
HR2day to Entra ID integration: Microsoft 365 accounts for care, education and childcare
Visma Raet YouForce → Google Workspace
YouForce to Google Workspace integration: staff Google accounts without manual work
Microsoft Entra ID → ESIS
Entra ID to ESIS integration: teachers set up in ESIS, access removed on departure
Frequently asked questions
Which HR systems does it work with?
With the systems common in education, such as AFAS, Visma and HR2day. As long as the HR system makes changes available, Joinly can work with it.
Does this help with the IBP framework?
Access management is one of the 15 domains of the IBP framework. Automated provisioning, least privilege and logging provide the evidence.
Do schools keep their autonomy?
Yes. The board decides centrally how accounts and access are created. Roles per school and location leave room for each school's own setup.
More on Identity and access management
Identity and access management: the overview
Lifecycle
Roles and governance
Integrations
- HR as the sourceThe HR system decides who gets an account, with which data.
- Microsoft Entra IDAccounts, groups and licences in Entra ID from HR.
- Active DirectoryOn-premises AD and hybrid Exchange through an agent without an open port.
- Application provisioningAccounts and roles in your business applications, from HR.
- SCIM and SCIM GatewayThe provisioning standard, also for applications without SCIM.
Compliance and sectors
- NIS2 and the Dutch Cyber Security ActWhat the duty of care asks of access management, and what it does not.
- IAM in educationSchool board staff, ready for the IBP standards framework.
- IAM in governmentMunicipalities, provinces and water boards, with BIO and ENSIA.
- IAM in healthcareFlexible staff, multiple contracts and NEN 7510.