INTEGRATIONSAFAS PROFIT + MICROSOFT 365Connect AFAS to Microsoft 365
When HR adds a new employee in AFAS, IT has to set up an account, mailbox and access. Connect AFAS to Microsoft Entra ID and a new colleague has their account and the right groups on day one, and the account is blocked as soon as employment ends.
ISO 9001 & 27001
- Account for new starters goes to Microsoft 365
- Groups and licences goes to Microsoft 365
- Job title, department and manager goes to Microsoft 365
- Blocking leavers goes to Microsoft 365
- Email address back comes from Microsoft 365
Built for clients including Tata Steel, M&G Investments, Digistore24, Toppers in Concert, Bar-le-Duc and Loogman
Without an integration, this runs on an email from HR to IT. IT creates the account, comes up with a username and picks groups based on what the email says. When someone changes role, no email arrives, so they keep their old permissions. When someone leaves, the email sometimes arrives late and an account stays active for days.
AFAS knows all of this before IT does: the start date, job title, department, manager and end date. The question isn't whether to connect it, but how far to go: only accounts and groups, or job title, department and licences too.
For each item: which direction it goes, when, and why. This is the starting point; in the first conversation we fit it to your situation.
- 01Account for new startersAFAS Profit → Microsoft 365when the new employee is recorded, before the start date
The employee gets a user in Entra ID with a UPN following your naming convention, such as firstname.lastname@domain. The account can be ready before someone starts.
- 02Groups and licencesAFAS Profit → Microsoft 365when someone starts and when they change role
User groups in AFAS, for example by job title or department, become groups in Entra ID. You attach Teams, SharePoint sites and licences to those groups; Microsoft then assigns a licence to all members of the group.
- 03Job title, department and managerAFAS Profit → Microsoft 365on every change in AFAS
This data on the account keeps the address book and org chart in Microsoft 365 accurate, and makes sure approvals reach the right manager.
- 04Blocking leaversAFAS Profit → Microsoft 365on the end date of employment
The account is blocked, not deleted. Email and files remain available for a handover, while nobody can sign in any more.
- 05Email address backMicrosoft 365 → AFAS Profitafter the account has been created
If the account is created outside AFAS, the email address goes back to the employee in AFAS. Single sign-on and messages from AFAS then use the right address.
Not always. If an existing integration for AFAS Profit and Microsoft 365 does exactly what you need, we'll tell you.
Since Profit 8, AFAS has a built-in Entra ID integration. During onboarding, Profit generates a UPN following a naming convention and checks for duplicates. User groups from Profit and their members go to Entra ID, based on the UPN. Profit leads: changes to those groups in Entra ID are overwritten. When someone leaves, the email address and UPN are cleared in Profit and the user is blocked in Profit and Entra ID, not deleted. You need an app registration in Entra ID for it.
The AFAS documentation covers groups, UPN and blocking. If you need more, such as job title, department and manager on the account, or an on-premises Active Directory, look at Microsoft's API-driven inbound provisioning. With it, an integration sends employee data from any HR system to Entra ID or Active Directory. It requires an Entra ID P1, P2 or Entra ID Governance licence.
- Job title, department, manager and phone number need to be on the account in Entra ID.
- Besides Entra ID, you still have an on-premises Active Directory where accounts need to be created.
- When someone leaves, more needs to happen than blocking, such as handing the mailbox over to their manager.
- External staff, interns or contractors aren't in AFAS but do need an account.
AI reads, sorts and prepares a suggestion. Where it matters, a person decides.
Suggesting permissions for a new role
If a job title appears that isn't linked to any group yet, AI can suggest suitable groups based on colleagues in the same department. IT approves and records the mapping in AFAS. AI only sees job title, department and groups for this, no salary or contract.
Summarising synchronisation errors
A UPN that already exists, a domain that's wrong, a user without a UPN who is skipped as a result. AI can summarise the error messages and provisioning logs daily into a short list for IT, with what needs to happen on each line. The AI step only reads and changes nothing.
Profit leads, groups included
If IT changes a membership directly in Entra ID in a group that comes from AFAS, the integration reverts it at the next synchronisation. So manage those groups in AFAS, and keep groups that IT manages itself separate.
UPN and naming convention
Two employees with the same name, name prefixes such as 'van' or 'de', a name change after marriage. A changed username doesn't synchronise to Entra ID by itself, and the UPN must contain your tenant's primary domain. Agree beforehand what happens with duplicate names and name changes.
Timing around start and end dates
An account that is ready doesn't need to be able to sign in yet. Decide when it becomes active, and at what moment on the end date it is blocked, especially for someone who leaves on a Friday and is still on duty over the weekend.
Rehires
If someone returns, you choose in AFAS between reusing the old, blocked account or creating a new UPN. Reuse keeps email and files together; a new account prevents old permissions from coming back.
What goes where
Which data moves, in which direction, and which system wins when two values differ. That is written down before anything gets built. For this integration, that means: Account for new starters, Groups and licences, Job title, department and manager, Blocking leavers, Email address back.
Fields and rules
For every field, how it translates between the systems: statuses, VAT codes, general ledger accounts, item numbers. And what happens with a duplicate or a missing value. For this integration, that means: Profit leads, groups included, UPN and naming convention, Timing around start and end dates, Rehires.
Testing with real cases
In a sandbox or test administration, with the exceptions you actually run into: credit notes, partial deliveries, changed customer details.
Live, with logging and monitoring
Every sync is logged, and when something fails, someone gets an alert. If a vendor changes its API, we update the integration.
No account manager. You talk to someone who builds integrations themselves, and who will tell you when a standard integration is enough.
- Office on the Duivendrechtsekade in Amsterdam
- ISO 9001 and ISO 27001, certified by Kiwa
- 500 projects delivered
- 4.8 from 127 reviews
Does AFAS have a standard integration with Microsoft Entra ID?
Yes. Since Profit 8, AFAS has a built-in Entra ID integration. It synchronises user groups and their members based on the UPN, and blocks the user in Entra ID when they leave. Profit leads.
What happens to the account when someone leaves?
With the AFAS Entra ID integration, the user is blocked in Profit and in Entra ID when they leave, but not deleted. The email address and UPN are cleared in Profit. You arrange what happens to the mailbox and files separately.
Which licence do I need for inbound provisioning from an HR system?
Microsoft's API-driven inbound provisioning works with Entra ID P1, P2 or Entra ID Governance. Limits apply: 40 calls per five seconds, and per tenant 2,000 calls per 24 hours with P1 or P2, or 6,000 with Governance. Each call can carry up to 50 operations.
Can I sign in to AFAS with my Microsoft account?
Yes. AFAS supports single sign-on through OpenID Connect with Microsoft Entra ID and others, for Profit, InSite and the AFAS Online portal. Your organisation is responsible for setting up and securing that sign-in method.
Related services
- Connect AFAS to HubSpotConnect AFAS to HubSpot: a won deal becomes a customer account and order in AFAS, and sales sees in HubSpot which invoices are still outstanding.
- Connect AFAS to SalesforceConnect AFAS to Salesforce: accounts, opportunities and invoices flow both ways, within the API limits and with AFAS as the financial source of truth.
- Connect AFAS to TOPdeskConnect AFAS to TOPdesk: employees, departments and branches flow from AFAS into the service desk, and a new starter or leaver triggers a request.
- Connect AFAS to ChatGPTConnect AFAS to ChatGPT: give an AI assistant safe access to AFAS through an MCP server with limited permissions, and keep salary and BSN data out of it.
- Connect TOPdesk to Microsoft 365Connect TOPdesk to Microsoft 365: persons come in from Entra ID, tickets from email and Teams, and an approved change carries out actions in Entra ID.
- Connect Claude to Microsoft 365Connect Claude to Outlook, Teams, SharePoint and OneDrive with Anthropic's Microsoft 365 connector. What Claude can do, and what your admin needs to set up.
Sources
The technical facts on this page come from the vendors' official documentation, checked on 19 September 2026. Vendors change their APIs and limits; when we build an integration, we always check the current state.