Users in 4PS Construct and ESIS from Entra ID

What it is

An industry application holds the work itself: bookings and approvals in 4PS, pupil data in ESIS. Who sees which company or school depends on job and location, and that is more than an account on or off.

Without an integration an administrator assigns permissions by hand, per company or per school. A disabled account can still be active in the application, while that is exactly where sensitive data sits.

How the integration handles it

• In 4PS KoppelHet assigns the permission sets that belong to job and operating company from Entra ID, instead of groups IT maintains by hand.
• Business Central only reflects a disabled Entra account when an administrator updates the users. KoppelHet disables the 4PS user as soon as Entra ID reports it, and never deletes.
• KoppelHet compares the assigned permissions in 4PS with the role table every day and reports differences.
• In ESIS the integration first creates the employee with appointment and assignment at the school that belongs to the group in Entra ID, and then links the user.
• If someone works at two schools, they are in two school groups and get an assignment at both locations in ESIS, with one user.
• On departure KoppelHet blocks the ESIS user as soon as the Entra ID account is disabled, not at a later clean-up.

Edge cases we handle

• In the cloud version of 4PS a user only exists after creation in Microsoft 365. KoppelHet leaves creation to 4PS itself; the integration starts once the user is in 4PS.
• If 4PS runs on-premises, Entra groups can only be used as security groups from certain Business Central versions. On older versions KoppelHet assigns the permission sets per user.
• ESIS passes staff on to applications such as Basispoort and the parent portal. The email address from Entra ID has to be right before the employee goes into ESIS.
• For substitute teachers and interns we agree which Entra ID group brings them into ESIS.

What KoppelHet does

KoppelHet builds the integration so job and operating company or school from Entra ID decide the permissions, and a departure takes effect immediately. If the HR system should be the source instead of Entra ID, that can follow later as an extension. Expect two to four weeks to go-live.

Common integrations

→

Microsoft Entra ID → 4PS Construct

Entra ID to 4PS Construct integration: users and permissions per company, disabled on departure

→

Microsoft Entra ID → ESIS

Entra ID to ESIS integration: teachers set up in ESIS, access removed on departure

→

Microsoft Entra ID → Somtoday

Entra ID to Somtoday integration: staff set up in Somtoday automatically, with location, job and leaving date

→

Microsoft Entra ID → Magister

Entra ID to Magister integration: staff accounts in Magister through the SCIM API, blocked on departure

• 4PS Construct
• ESIS
• Microsoft Entra ID

• Identity and access management

Customer cases

Tabijn

Education

Tabijn uses HR2Day as the source for Entra ID, and Entra ID as the source for ESIS. New staff get an account automatically, leavers are deactivated, and in ESIS everyone gets access to the schools where they work.

Read the customer story

Spaarnesant

Education

Spaarnesant uses Entra ID as the source for ESIS. An active Entra ID account results in an ESIS user with single sign-on and access to the right schools; when the account is disabled, ESIS follows automatically.

Read the customer story

Frequently asked questions

More on Accounts in applications

Accounts in applications: the overview