Identity and access management
ADP iHCM to SailPoint integration: ADP iHCM as the HR source for SailPoint Identity Security Cloud
With an integration between ADP iHCM and SailPoint, SailPoint knows every employee who joins, moves or leaves in ADP, so roles follow automatically and access lapses after departure. KoppelHet delivers the employees from iHCM as an authoritative source, with rules for rehires, cancelled departures and new employees that ADP has not yet released.
What the integration does
Organisations that run payroll in the Netherlands and other European countries with ADP iHCM and introduce SailPoint for identity governance often have HR send an export. A departure that is later cancelled then removes access that should have stayed.
- ADP registers the integration and adds the APIs and notifications for workers to the application.
- KoppelHet receives the notifications for joining, leaving and changed work assignment and then fetches the worker.
- KoppelHet delivers the workers as a file to an authoritative source in SailPoint, which starts the aggregation right away.
- SailPoint sets the identity to pre-hire, active or inactive based on the dates from ADP.
- If a departure is cancelled or a date is moved, KoppelHet delivers the new state right away.
What to watch for with ADP iHCM and SailPoint
- A new employee is first flagged Stop external processing in iHCM, and cannot be retrieved through the API. Only when HR has filled in the required fields do they appear. KoppelHet reports a hire that still cannot be retrieved after the notification, so HR completes the record before the start date approaches.
- ADP also sends the departure notification for a cancelled departure, and again if the date or reason changes. KoppelHet then reads the current state and adjusts the end date in SailPoint, or removes it, so a colleague who stays after all keeps their access.
- iHCM does not support a separate notification for only a changed termination date. KoppelHet therefore listens to the general departure notification and also compares all dates daily, so a moved last working day also moves in SailPoint.
- On a rehire ADP sends the regular hire notification, with status Rehire. KoppelHet delivers the same ADP reference as the key, so SailPoint reactivates the existing identity with its history, instead of a second identity.
- Which fields ADP returns depends on the rights ADP grants to the application. Client-defined fields have no separate protection, which is why ADP advises not to put sensitive data in them. KoppelHet requests only the fields SailPoint needs for roles.
- Some notifications require the organisation module in iHCM to be in use; ADP assesses that in a technical feasibility study. Plan that study at the start, because without the module SailPoint only sees a department change at the daily delivery.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
What does ADP need to arrange on its side?
Registering the application with the right APIs and notifications, the field rights and sometimes a feasibility study for the organisation module. Allow some extra lead time on the ADP side.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- ADP iHCM through the Worker Management API (GET /hr/v2/workers with $top at most 100 and $skip; only workers with Stop external processing False or empty) and notifications worker.hire (also rehire, status Rehire), worker.terminate (also on Terminate Cancel and changed date or reason; worker.workerTerminationDate.change not supported) and work assignment changes. APIs only work after being added in the Consumer Application Registry (CAR); PRIS event template needed for the changed fields.
- SailPoint Identity Security Cloud receives a CSV through the import-accounts API of a Delimited File source (authoritative source), which starts the aggregation right away. Lifecycle states prehire and inactive through a transform on startDate and endDate.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in ADP iHCM | Field in SailPoint | Notes |
|---|---|---|
associateOID | uid | Fixed key of the identity |
workerID | employeeNumber | |
person.legalName | firstname, lastname | |
Naamgevingsregel of zakelijk e-mailadres | email | |
workAssignments.jobTitle | jobTitle | |
homeOrganizationalUnits | department | |
Land van de werkplek | country | |
reportsTo | manager | |
workerDates (hire, termination) | startDate, endDate (lifecycle state) |
Related
ADP iHCM → Active Directory
ADP iHCM to Active Directory integration: network accounts per country, with an expiry date for temporary contracts
ADP iHCM → Coupa
ADP iHCM to Coupa integration: approved Coupa expenses as a variable pay field in ADP iHCM NL
DyADP iHCM → Dyflexis
ADP iHCM to Dyflexis integration: employees and contracts in scheduling, hours back to ADP
ADP iHCM → Microsoft Entra ID
ADP iHCM to Entra ID integration: accounts from ADP payroll, with the right licence in every European country