Identity and access management
Cezanne HR to Google Workspace integration: a Google account per employee, with sign-in to Cezanne
With an integration between Cezanne HR and Google Workspace, every new employee from Cezanne gets a Google account before their start date, with company, job, department and location as they apply in Cezanne on that date. After the end date of the employment KoppelHet suspends the Google account, and the same Google address is the key the employee uses to sign in to Cezanne through Google.
What the integration does
Organisations that use Cezanne HR for employees in several countries and work in Google Workspace often do set up sign-in to Cezanne with Google, but not the Google account itself. IT creates that by hand after a message from HR, and leavers keep Gmail and Drive until someone remembers.
- A Cezanne user with rights on person and employment only gets API access, and in Google Workspace a service account gets admin rights on users.
- KoppelHet reads the employees from Cezanne, including those yet to start, with company, job, department and location.
- A week before the start date KoppelHet creates the Google account in the company's organisational unit.
- KoppelHet sets the Google address as the SAML identifier on the employee in Cezanne, so signing in with Google works straight away.
- After the end date of the employment KoppelHet suspends the account; file transfer and deletion follow after an agreed period.
What to watch for with Cezanne HR and Google Workspace
- Cezanne works with Google for sign-in only, through a custom SAML app the administrator creates in the Google Admin console. Cezanne only provides a guide for automatic user creation for Okta. The Google account itself is therefore not created from Cezanne, and KoppelHet fills that gap.
- Cezanne keeps a SAML identifier per person in a separate table. KoppelHet writes the new Google address there as soon as the account exists, so on day one the employee signs in to Cezanne with the same Google account as for Gmail.
- The people table in Cezanne also returns employees who have yet to start, while the filter on active employees leaves exactly those out. KoppelHet uses the full table and the start date, so a new colleague has their Google account a week ahead and can read the welcome email in Gmail.
- Location is stored in Cezanne in a separate table with an effective date. KoppelHet sets that location as the building in Google on the day of the move, so from then on Google Calendar suggests the meeting rooms of the new office.
- Every employment in Cezanne belongs to a company code. KoppelHet uses it to choose the organisational unit and email domain in Google, so a colleague at the Dutch entity can get different Drive settings from a colleague in the United Kingdom.
- An employment without an end has 31 December 2999 as its end date in Cezanne. KoppelHet reads that as no end date, so no suspension in Google is ever scheduled for a permanent employee.
- Cezanne only has webhooks in the People PLUS+ package. Without that package KoppelHet compares the tables with the previous state every hour; a departure then reaches Google within the hour.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
We already sign in to Cezanne with Google. What does the integration add?
Sign-in only handles access to Cezanne. The integration creates the Google account itself, keeps job and department up to date and suspends the account on departure.
Does the integration see salaries in Cezanne?
No. The integration user only has rights on person, employment and the SAML identifiers.
Do we need People PLUS+?
No. With that package the integration responds immediately, without it it works with an hourly comparison.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Cezanne HR API v2 (OData, JSON) with OAuth 2.0; API access through the Customer Success contact. Tables People (including future joiners and leavers), Employments (CompanyCode, TerminationDate), JobDeployments, OrgUnitPositionDeployments, LocationDeployments and SAMLIdentifiers. Webhooks only with People PLUS+. Sign-in with Google through a custom SAML 2.0 app in the Google Admin console.
- Google through the Admin SDK Directory API (users with primaryEmail, name, externalIds type organization, orgUnitPath, organizations with title and department, locations with buildingId, suspended), with a service account with domain-wide delegation. Drive transfer through the Data Transfer API.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Cezanne HR | Field in Google Workspace | Notes |
|---|---|---|
PersonId | externalIds (type organization) | Fixed key |
Voornaam en achternaam | name.givenName en name.familyName | At most 60 characters each |
Naamgevingsregel met domein per bedrijf | primaryEmail | Goes back to SAMLIdentifiers |
CompanyCode (Employments) | orgUnitPath | |
JobDeployments | organizations.title | |
OrgUnitPositionDeployments | organizations.department | |
LocationDeployments | locations.buildingId | |
TerminationDate (2999-12-31 = leeg) | suspended = true na de datum |
Related
Cezanne HR → Active Directory
Cezanne HR to Active Directory integration: domain accounts per employer and location
Cezanne HR → ADP iHCM
Cezanne HR to ADP iHCM integration: compensation, single payments and leavers to Dutch ADP payroll
Cezanne HR → AFAS Profit
Cezanne HR to AFAS integration: the Dutch employer from Cezanne in AFAS Profit Payroll
ASCezanne HR → Arbodienst (SIVI)
Cezanne HR to the occupational health service via SIVI: sickness absence events as absence reports