Identity and access management
BambooHR to SailPoint integration: BambooHR as the HR source for SailPoint, with only the data needed
With an integration between BambooHR and SailPoint, SailPoint knows every new, changed and departed employee from BambooHR, so roles and access follow automatically and lapse on the termination date. KoppelHet delivers only the personal data roles need, processes a departure on the day itself and links a returning employee to the existing identity.
What the integration does
Organisations that use BambooHR and SailPoint Identity Security Cloud want only the data for access management in the IAM platform. Gender, marital status and home address are not needed for that, and a former employee who returns must not get a second identity.
- HR creates a new employee in BambooHR or enters a return.
- KoppelHet retrieves the employee and delivers only the agreed fields to the HR source in SailPoint.
- SailPoint creates or resumes the identity and assigns the roles on the start date.
- On a change of job or department KoppelHet starts a new aggregation right away.
- On the termination date the identity becomes inactive and access lapses.
What to watch for with BambooHR and SailPoint
- BambooHR also holds gender, marital status, home address and the US ACA status. Roles do not need them. KoppelHet delivers only the fields in the design to SailPoint.
- KoppelHet writes nothing to BambooHR, except the work email if you want. A change in SailPoint thus cannot overwrite job title, department or location in BambooHR.
- BambooHR keeps an original hire date next to the latest one. KoppelHet uses it to link a returning employee to the existing identity, so SailPoint does not create a second identity.
- KoppelHet reads custom fields in BambooHR by their fixed field name and checks they are filled before SailPoint bases roles on them.
- BambooHR reports a changed employee right away. KoppelHet starts a SailPoint aggregation straight after such a notification, so a departure or job change does not wait for the next scheduled aggregation.
- The termination date sits in BambooHR in the employment status history and can be entered in advance. KoppelHet passes that date on, so SailPoint revokes access on the right day and not at the moment of entry.
- The BambooHR API key belongs to a user and carries their rights. KoppelHet uses a separate user without access to compensation and private data.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Does KoppelHet also write back to BambooHR?
Only the work email, and only if you want it. Job title, department and location stay leading in BambooHR.
What about audit logging, GDPR and our integration platform?
Every delivery is in the audit logging of the KoppelHet platform. You are the controller and KoppelHet is the processor, under a data processing agreement; only the fields in the design go to SailPoint. An existing integration platform is left alone.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- KoppelHet reads BambooHR through event-based webhooks (employee.created, employee.updated with monitor fields) and the changed-employees endpoint, and delivers a CSV to a Delimited File source through the import-accounts API, which starts the aggregation right away.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in BambooHR | Field in SailPoint | Notes |
|---|---|---|
employeeNumber | uid (User Name) | |
preferredName of firstName | firstname | |
lastName | lastname | |
workEmail of naamgevingsregel | email (Work Email) | |
jobTitle | jobTitle | |
department | department | |
division | division | |
location | location en country | |
supervisorEId | manager | |
hireDate, originalHireDate en terminationDate | startDate en endDate (lifecycle state) |
Related
Ashby → BambooHR
Ashby to BambooHR integration: hire, changed start date and employment status in BambooHR
BambooHR → 4PS Construct
BambooHR to 4PS Construct integration: employees from BambooHR in the 4PS company of their location
BambooHR → Active Directory
BambooHR to Active Directory integration: accounts in your own domain from HR
BambooHR → ADP iHCM
BambooHR to ADP iHCM integration: salary, bonuses and commissions to Dutch payroll