Visma Connect and Public Cloud Azure

Visma Connect is an authentication solution provided by Visma, which we have chosen as the authentication method for Flex HRM. Over one hundred applications use Visma Connect for authentication, with more than 12 million user accounts. It is used to secure APIs, webhooks, web applications, mobile applications, and SPAs. It provides Visma with a single point of action for security improvements. Visma Connect follows industry standards (OpenID Connect, OAuth) and is ISO 27001 certified.

The main difference is a new login page. The actual login process will still be done using a username and password, but now through Visma Connect. This means the look and feel of the login will change, but the way you sign in remains familiar—just more secure and standardized.

Today, login is done using a user ID, which is a free-text field—for example, an employee number. In Visma Connect, the username will always be an email address. However, the user ID can still be an employee number.

About 1–2 months before the migration, all users will see a dialog/information box in Flex HRM prompting them to verify their email address. During this step, a Visma Connect account will also be created.

After the migration, you will access Flex HRM as usual. Once there, you’ll use the “Forgot password” function and then log in as normal with your username and password.

Yes. Thanks to 2FA (two-factor authentication), you will have strong authentication when accessing Flex HRM, which we see as an important measure to maintain a high level of security.

We recommend using the Visma Authenticator app (available in the App Store and Google Play) for the best user experience with 2FA.

Yes. We always recommend using 2FA, and Visma Connect supports most authentication apps—including Google Authenticator and Microsoft Authenticator. However, we recommend using Visma Authenticator for the best experience.

For now, before the migration to Azure, it is possible to activate 2FA for specific employees. With Visma Connect, 2FA becomes very user-friendly while providing a high level of security.

No, all users will use Visma Connect for login. However, you can register your own Identity Provider (IdP) within Visma Connect and log in through it.

An employee has used a personal email address instead of the company's to link their HRM user to Visma Connect—how do we change it?

Remove the link
An administrator with access to the "Users" view first needs to remove the current Visma Connect link.

Link a different email address
If you are still in the provisioning period (the preparation phase, i.e., BEFORE the actual migration to the public cloud), the user will once again see a banner at the top of Flex HRM after the link is removed. The user can then go to My Profile > Security and Login and re-link their account using the correct email address.

If you are already using Visma Connect for login, the administrator can manually update the email address:

Enter the new email address for the user in the "Users" view.

Send a new verification email to the new address.

Complete the link
The user clicks the link in the verification email to confirm the new email address.

It is currently possible to use both username/password and SSO within the same instance of Flex HRM.

Some users may recognize the “/HRM-NoSSO” suffix in the URL—these users will be able to use the regular URL in the future without needing to specify NoSSO.

We plan to offer BankID support in Flex HRM during 2026 and will provide more information closer to the launch.

Yes — an email address is required to log in to Flex HRM and Flex HRM Mobile.

However, users who only make their updates via Flex HRM Timeclock do not need to take any action.

Currently, the option to verify email addresses will be activated approximately one month before the migration to Azure. However, we are exploring the possibility of enabling this functionality earlier to make the process smoother.

If you are unable to provide a work email, it is perfectly fine for them to use their personal email address instead.

Yes.

Yes, there is a filter in the user registry that allows you to view this. You can also use it to send reminder emails to users who have not yet completed their verification.

Both options work. It’s entirely up to you and what best suits your organization’s needs.

We understand that some older users of Flex HRM may find it challenging to set up an email address. Unfortunately, there is no workaround for this—so the only solution is for you to assist them in creating an email address if needed.

Yes. It is possible to send out multiple email verification requests after the migration. However, an administrator will need to enter the employee’s email address in Flex HRM first.

Yes, as long as the user has access to the email address used for email verification and the “Forgot password” function.

Yes, it is! The field “Visma Connect Email” is now available in import and export templates of the type Employees/Users. If an invalid email address is provided, the field will not be updated.

Note: It is only possible to import email addresses for users who are not yet linked to Visma Connect.

We keep track of whether your organization uses SSO and will assist you during the migration.

As a general guideline:
If you log in using a username and password directly on the Flex HRM login page, you likely do not have SSO.

If you are redirected to another website—such as Microsoft—for login, then you do have SSO.

You will continue to use SSO after the migration, with the same username and password.

The only difference is that your Identity Provider (e.g. Entra ID) will be integrated with Visma Connect instead of directly with Flex HRM.

We will assist you with the SSO configuration to ensure everything continues to work as it did before the migration.

No, since 2FA authentication takes place against your Identity Provider (e.g. Entra ID), it will remain intact.

Your users will not need to make any changes, and they are unlikely to notice the migration.

Yes. All users who need to log in to Flex HRM or Flex HRM Mobile will be required to add and verify an email address in order to create an account in Visma Connect.

Yes. Users will go to web.flexhrm.com and will be asked to enter their email address. After that, they will be presented with the option to log in using SSO—for example, “Sign in with Entra ID.”

All data for Flex HRM will be stored within the EU. We have chosen Azure Sweden Central, which has its data centers located in Gävle and Sandviken, Sweden.

Visma Connect stores information related to secure login—such as usernames and device IDs. This data is stored by Amazon within the EU.

The migration to Azure does not affect data retention—data will be stored in the same way as today. Some data can be deleted automatically after a certain period, while other data must be removed manually in Flex HRM.

All data for Flex HRM will be stored within the EU. We have chosen Azure Sweden Central, with data centers located in Gävle and Sandviken, Sweden.

Visma Connect stores information related to secure login—such as usernames and device IDs—and this data is hosted by Amazon within the EU.

Based on our analysis, we feel confident in our choice of Azure. That said, we do have an exit strategy in place—which is always a good practice to prepare for unforeseen events.

Visma operates its own high-standard data center within the EU, where we use a technology called Azure Stack Hub. This enables us to more easily move the application and database to Visma’s own infrastructure if needed.

In addition, Visma has established agreements with OVH Cloud, a French cloud provider.

No, we do not provide backups or similar data extracts due to security reasons.

Yes. The databases are encrypted at rest using Transparent Data Encryption (TDE). The encryption algorithm used is AES 256.

The encryption key is service-managed and protected by a certificate unique to each server. The key is rotated once per year. Neither we nor Microsoft will share the key.

The Azure Sweden Central data center is SOC 2 compliant.

We are currently in the process of certifying both the company and the Flex HRM service.

Our goal is for Flex HRM to be ISO 27001 certified during 2026, following the Visma Cloud Delivery Model.

Yes. The new IP address is: 4.223.138.189

Yes. However, you may need to add the new IP address to an allow list to ensure continued access.

No, Classic Payroll will not be affected by the migration to Azure, except that integrations between Classic Payroll and Flex HRM may need to be reviewed during the transition.

However, we recommend that your company consider migrating to Flex HRM Payroll, which is a future-proof alternative to Flex Classic Payroll.

No. Migrating from Classic Payroll to Flex HRM Payroll means you are now using Flex HRM Payroll in our current hosting environment. It is this environment that will be migrated to Azure.

Yes, payroll runs can be processed as usual.

However, in order for a user to log in and register travel expenses, time, absence/leave, and similar, they must verify their email address to gain access through Visma Connect.

Since there will be a new URL and IP address, integrations will be affected.
After the migration, the API URL must be updated to the new one: api.flexhrm.com.

For customers hosted by us, integrations will continue to work temporarily using the old URL after the migration. However, we strongly recommend updating to the new URL as soon as possible.

We also recommend reviewing and verifying all integrations after the migration to ensure everything runs smoothly.

For customers who host Flex HRM themselves, it is mandatory to switch to the new URL when migrating to our Azure environment. To ease the transition, you can redirect calls from the old URL to the new one.

Yes. Everyone who subscribes to their schedule will need to start a new subscription and paste a new link into their calendar, as the path will change. For customers using our hosting service, a temporary redirect will be in place, so subscriptions will not stop working immediately after the move. However, a new subscription should be set up as soon as possible after the migration to ensure continued functionality.

Shift requests sent before the migration will no longer be possible to respond to after the migration, as the response link will change.

If you are using IP1 (shift requests via SMS), you will need to update the callbackURL in your IP1 configuration to ensure continued functionality.

Hostname needs to be updated to timeclock.flexhrm.com, and “/Timeclock” must be removed. In some cases, the customer number needs to be added.
Examples:
"customer.flexhosting.se/Timeclock" becomes
→ **timeclock.flexhrm.com/default/customerNumber**

"customer.flexhosting.se/Timeclock/Fabriksklocka" becomes
→ **timeclock.flexhrm.com/Fabriksklocka/customerNumber**

"exempel.com/Timeclock/Fabriksklocka/1234" becomes
→ **timeclock.flexhrm.com/Fabriksklocka/1234**

No. It will be necessary to manually enter the new URL and log in again on each Timeclock device.

Yes. The tags used for clocking in and out with Timeclock will continue to function as usual.

It will continue to work as usual, but with the new URL.

Yes, you can still use a custom-designed Timeclock. It will function just as before.
The only change is the new URL.

If you are currently using MFID tags, they will continue to work in Azure as well.

No. They can continue using Flex HRM Timeclock as usual without needing to provide an email address or create a Visma Connect account.

According to the current timeline, all companies will be migrated to Azure during 2025.

In the first phase, companies already hosted in our existing cloud environment will be migrated. After that, we will proceed with companies currently using their own server within our hosting, as well as those managing their own infrastructure.

You will receive information well in advance—approximately one month before it is time for your company to be migrated.

Yes. You will receive information one month in advance, including the specific date on which the migration will occur.

For customers hosted by us, the migration will be handled by us and comes at no cost.

We will send out information as soon as it is possible for self-hosted customers to migrate to Azure. At that point, you will be able to place an order for the migration.

If no order is placed, we will reach out to you to agree on a suitable date for the migration.

No, however, there will be a cost for customers who wish to use Mobile BankID.

Public cloud is a service where hardware, software, and infrastructure are managed by a cloud provider, simplifying operations. This model typically gives users access to software via the internet through a subscription—commonly referred to as SaaS (Software as a Service).
Examples of widely used public cloud services include Office 365, Google Workspace, and Slack.

Azure is Microsoft’s cloud services platform, giving you access to data storage, servers, and applications over the internet. The platform is flexible, scalable, and secure, and is used by organizations worldwide to run everything from small applications to complex enterprise systems.

If you have any questions about your contract, please feel free to contact our sales department. Your designated sales representative will be happy to assist you and ensure you receive the information you need.

If you are using SaaS or another hosting solution provided by us, your domain likely includes flexhosting.se.
If not, you are most likely running a self-hosted solution.

Yes. As part of the move, we are making improvements to the updating process of Flex HRM. This will reduce downtime and make Flex HRM more accessible, even during nighttime hours when updates typically occur.

Yes. Today, each customer has a unique URL. In Azure, everyone will use the same URL. This means that all employees and administrators will log in using a new web address.
Below are the new addresses:

Flex HRM: web.flexhrm.com

Flex HRM Mobile: mobile.flexhrm.com

Flex HRM Timeclock: timeclock.flexhrm.com

Flex HRM API: api.flexhrm.com

The saved bookmark/favorite will remain in your browser, but it will no longer work. Users will need to update their bookmarks with the new addresses.