Identity and access management
Cezanne HR to SailPoint integration: Cezanne as the authoritative source in SailPoint Identity Security Cloud
With an integration between Cezanne HR and SailPoint, SailPoint gets an identity for every person with an employment in Cezanne with job, organisational unit, location, employer and lifecycle state, also for those who have yet to start. KoppelHet reads the Cezanne API and delivers one row per person to a Delimited File source in SailPoint.
What the integration does
Organisations that use Cezanne HR and introduce SailPoint often have the SailPoint team work with exports that are out of date after every reorganisation.
- Through Cezanne's Customer Success contact KoppelHet gets API access with an integration user that only sees the employers in scope.
- The SailPoint team creates a Delimited File source as authoritative source with lifecycle states.
- KoppelHet reads persons, primary employments and assignments, and builds one row per person with today's values.
- KoppelHet sends the file to SailPoint, which aggregates straight away.
- A transform sets the state to pre-hire, active or inactive based on the dates.
What to watch for with Cezanne HR and SailPoint
- KoppelHet reads Cezanne through Cezanne's OData API and delivers to a Delimited File source, so nothing custom has to be built in SailPoint.
- The persons table in Cezanne also contains future starters and leavers. KoppelHet includes both, so SailPoint sets a new colleague to pre-hire with birthright access ready on the start date, and makes a leaver inactive instead of letting them vanish.
- For an employment without an end Cezanne sets 31 December 2999 as the end date. A transform in SailPoint that looks at endDate would see a real date there. KoppelHet then delivers an empty end date, so the transform stays simple.
- Someone can have more than one employment in Cezanne, and Cezanne can return the primary current employment per person. SailPoint only uses the first value of a multi-valued attribute in a transform. KoppelHet therefore delivers job, unit and employer of the primary employment as separate columns.
- Job, unit and location are assignments in Cezanne with their own effective date, and are often entered in advance. In each delivery KoppelHet only includes the assignment that applies today, so SailPoint does not assign a new role at the moment HR enters the move.
- Every employment in Cezanne belongs to an employer through a company code. The API follows the rights of the integration user. KoppelHet delivers the employer as its own column, and the integration user only sees the employers SailPoint manages, so no identities from other countries enter the source.
- Cezanne only has webhooks in People PLUS+. With that package KoppelHet starts a delivery shortly after a change; without it KoppelHet compares every hour, and SailPoint still gets the full state every run.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Do we need People PLUS+?
No. Without webhooks KoppelHet delivers every hour.
Does salary data go to SailPoint?
No. The file only contains identity fields.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Cezanne HR API v2 (OData, dataservice.svc, JSON) with OAuth 2.0; access through Customer Success, rights according to the integration user. Tables People (also leavers and future starters; filter ActiveEmployee), PeopleToEmploymentCurrentPrimary, Employments (CompanyCode, TerminationDate), JobDeployments, OrgUnitPositionDeployments and LocationDeployments. Webhooks with People PLUS+.
- SailPoint Identity Security Cloud with a Delimited File source as authoritative source; delivery through the import-accounts API, which starts the aggregation. Required attributes uid, email and lastname; Lifecycle State through a transform on startDate and endDate; multi-valued attributes in a transform with the first value only.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Cezanne HR | Field in SailPoint | Notes |
|---|---|---|
Persoonscode | uid | Key of the identity |
Voornaam | firstname | |
Achternaam | lastname | |
Werkadres of naamgevingsregel | email | |
JobDeployments | title | |
OrgUnitPositionDeployments | department | |
LocationDeployments | location | |
CompanyCode | company | |
Startdatum en TerminationDate (primair dienstverband) | startDate en endDate |
Related
Cezanne HR → Active Directory
Cezanne HR to Active Directory integration: domain accounts per employer and location
Cezanne HR → ADP iHCM
Cezanne HR to ADP iHCM integration: compensation, single payments and leavers to Dutch ADP payroll
Cezanne HR → AFAS Profit
Cezanne HR to AFAS integration: the Dutch employer from Cezanne in AFAS Profit Payroll
ASCezanne HR → Arbodienst (SIVI)
Cezanne HR to the occupational health service via SIVI: sickness absence events as absence reports