Identity and access management
ADP Workforce Now to SailPoint integration: ADP as the authoritative source in Identity Security Cloud
With an integration between ADP Workforce Now and SailPoint Identity Security Cloud, ADP becomes the authoritative source, so identities, lifecycle states and roles in SailPoint follow from hire, leave, transfer and departure in ADP. KoppelHet reads ADP's Worker API and delivers the employees to a standard SailPoint source, which starts the aggregation straight away.
What the integration does
Organisations that use ADP Workforce Now for colleagues in the United States or Canada and SailPoint for identity governance often load ADP as an export someone refreshes by hand. A departure HR records in advance sets the position to terminated straight away, and an export that filters on it removes access while the colleague still works for weeks.
- In ADP we link the application to the profile for external applications and use People Access to limit which employees are visible.
- In SailPoint we create a Delimited File source as authoritative source and an identity profile with lifecycle states.
- KoppelHet reads all employees, including archived ones, and then processes ADP's notifications.
- After each notification KoppelHet delivers a file through SailPoint's API, which starts the aggregation straight away.
- Every day a full delivery follows and KoppelHet compares the counts with ADP.
What to watch for with ADP Workforce Now and SailPoint
- KoppelHet delivers to a Delimited File source through the API, so there is nothing custom to maintain in SailPoint.
- If HR records a departure with a future date, ADP sets the position to terminated straight away and the employee only on the date itself. KoppelHet delivers the end date as an attribute, and a transform in SailPoint determines the lifecycle state. Access thus changes on the last day and not on the day HR enters the departure.
- Workforce Now sends a separate notification for leave. SailPoint can have a separate lifecycle state for it, in which for example only remote access is revoked. KoppelHet delivers the leave as an attribute, so such a state starts on the notification and ends on the return.
- Employees ADP has archived only come along with a separate header. Without that header they drop out of the file in the daily full delivery, and SailPoint then sees them as deleted accounts. KoppelHet does request them, so former employees stay in SailPoint with their end date for audits.
- If a manager is terminated in ADP, ADP cannot give their team a new manager in the same step. In SailPoint certifications and approvals then point to an identity that becomes inactive. KoppelHet flags teams with a departed manager and reports them to HR, so certifications do not stay with a leaver.
- ADP returns date of birth and social security number masked by default, unless you explicitly request them unmasked. SailPoint does not need them for roles. KoppelHet therefore does not request them unmasked, so they never appear in a file for SailPoint.
- ADP reports a rehire with its own notification, and the associateOID stays with the person. KoppelHet uses it as the account ID in SailPoint, so a returning colleague lands on their existing identity, with history and earlier certifications, instead of a new one.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
What happens with a departure HR records in advance?
SailPoint gets the end date straight away, but the lifecycle state only changes on that date. Until then the colleague keeps their access.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- ADP Workforce Now Worker Management API: GET /hr/v2/workers (50 per page; Prefer: respond-async up to 1,000, not in WFN Next Gen), Content-Type application/json;archived=true for archived employees, sensitive fields masked unless Accept application/json;masked=false. Notifications worker.hire, worker.rehire, worker.onLeave, worker.terminate and worker.workAssignment.modify. Future terminationDate: assignment Terminated, worker ACTIVE until the date; US1401391 (no new manager when terminating a manager).
- SailPoint Identity Security Cloud: Delimited File source as authoritative source, CSV through the import accounts API (load-accounts), which starts the aggregation straight away; identity profile with transforms on startDate, endDate and leave for the lifecycle states.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in ADP Workforce Now | Field in SailPoint | Notes |
|---|---|---|
associateOID | uid (account ID) | |
workerID | employeeNumber | |
legalName of preferredName | firstname, lastname | |
businessCommunication.email | email | |
jobTitle (hoofdpositie) | jobTitle | |
homeOrganizationalUnits | department | |
reportsTo | manager | |
hireDate, terminationDate, verlof | startDate, endDate, leave (lifecycle state) |
Related
ADP Workforce Now → 4PS Construct
ADP Workforce Now to 4PS Construct integration: employees with company, dimensions and statistics group in 4PS
ADP Workforce Now → Active Directory
ADP Workforce Now to Active Directory integration: accounts in your own domain, with expiry date and rehire from ADP
ADP Workforce Now → AFAS Profit
ADP Workforce Now to AFAS integration: Dutch employees from the US HR system in AFAS Profit
ADP Workforce Now → AllSolutions
ADP Workforce Now to AllSolutions integration: employees with department, cost centre and manager in AllSolutions