Identity and access management
Dayforce to SailPoint integration: Dayforce as the authoritative source in SailPoint, with SailPoint's SaaS connector
SailPoint has its own Dayforce HCM connector that imports employees from Dayforce as an authoritative source, with job, department, location and manager. With an integration between Dayforce and SailPoint, hiring, transfers and departures in Dayforce therefore drive roles and revoking access; KoppelHet sets up the connector and the rights in Dayforce and fills in where it stops.
What the integration does
Organisations that use Dayforce for HR, time and pay and SailPoint Identity Security Cloud for access often switch on the Dayforce connector with its default settings. Then only active employees come in, new colleagues are missing before their start date and leavers drop out of the source without SailPoint seeing the end date.
- In Dayforce we create a web services user with a role that may only read the required fields.
- In SailPoint we create a Dayforce HCM source with the client name and Dayforce's generic base URL.
- KoppelHet configures which employment statuses are included, including new employees before the start and recent leavers.
- We map the account fields to identity attributes and set the lifecycle states on start and end date.
- KoppelHet monitors the aggregations and reports an employee who exists in Dayforce but not in SailPoint.
What to watch for with Dayforce and SailPoint
- SailPoint's Dayforce connector reads only active employees by default. New employees with Prestart status, inactive employees and terminated employees only come in if you switch that on per type. KoppelHet switches on all three, so SailPoint knows a new colleague as a pre-hire and sees a leaver with their end date.
- For terminated employees you can set a look-back period in days. If you leave it empty, the connector reads all terminated employees ever. KoppelHet sets a fixed period, so the aggregation does not grow with every year of history.
- The connector only includes custom employment statuses such as long-term leave or an assignment abroad if they are in the source settings, partly through the SailPoint API. At the start we list the statuses in Dayforce and agree per status whether the account stays active.
- In Dayforce every field needs its own field-level right for web services, such as work assignment, contact details and manager. If such a right is missing, the field stays empty in SailPoint and a role can lapse wrongly. KoppelHet checks after the first aggregation that every expected field is filled.
- If someone has two work assignments, the connector takes the most recent one without a setting. With the primary employment option it reads the assignment marked as primary in Dayforce. KoppelHet switches that option on, so a temporary second job does not overwrite the department in SailPoint.
- From SailPoint the connector can only update first name, last name, business email and business phone in Dayforce. The new work email therefore goes back to Dayforce; other HR data stays there with HR.
- Custom fields from Dayforce, such as a flag for long-term absence or a licence choice, are fetched by the connector through a mapping in the source configuration. Numbers that must remain text, such as a contract hours field, KoppelHet puts in the list that reads them as text, so the aggregation does not stop on a type error.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
SailPoint already has a Dayforce connector. What does KoppelHet do then?
Setting up the web services user and the field rights in Dayforce, configuring the statuses and lifecycle states and monitoring the aggregations. For what the connector does not cover we build an addition.
Do new employees reach SailPoint before their start date?
Yes, if the option for Prestart employees is on. It is off by default; we switch it on.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- SailPoint Ceridian Dayforce HCM (SaaS): account management, full, delta (employees only) and single aggregation, update account (limited) and concurrent employment. Connection with Base URL or Generic Base URL (https://www.dayforcehcm.com/api), Basic or Token Based Authentication (Dayforce Identity Server URL), username and password of the web services user and Client Name.
- Aggregation settings: Aggregate Employee Statuses (Active by default), Aggregate Terminated Employees with Past Termination Offset in Days, Aggregate Inactive Employees, Aggregate Prestart Employees, Account Aggregation Filters, Enabled Employee Statuses, Aggregate Primary Employment, Delta Aggregation. customEmployeeStatus through PATCH on /connectorAttributes; attributeMapping on EmployeeProperties; numericMappedAttributesAsString.
- Rights in Dayforce: Read Data under HCM Anywhere > Web Services, XRefCode enabled, and Web Services Field-Level Access on, among others, EmployeeEmploymentStatus, EmployeeEmploymentType, PersonContact, EmployeeWorkAssignment, EmployeeManager and EmployeeRole, with the matching Authorizations. Default correlation on Business Email, Employee Number and Display Name.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Dayforce | Field in SailPoint | Notes |
|---|---|---|
XRefCode | Employee XRefCode (account-id) | Must not be changed |
EmployeeNumber | Employee Number | |
FirstName, LastName, DisplayName | firstname, lastname, displayName | |
Contacts (BusinessEmail) | Business Email (email) | |
EmploymentStatuses | Employment Status (lifecycle state) | |
EmploymentTypes | Employment Type | |
WorkAssignments (Position, Department, Job) | Position, Department, Job Name | |
EmployeeManagers (ManagerXRefCode) | Manager XRefCode (manager) | |
HireDate, StartDate, TerminationDate | startDate, endDate |
Related
Ashby → Dayforce
Ashby to Dayforce integration: have Dayforce validate the hire first, then save it
Bullhorn → Dayforce
Bullhorn to Dayforce integration: first placement of an employee as an employee in Dayforce
Carerix → Dayforce
Carerix to Dayforce integration: successful placement as a validated new employee in Dayforce
Dayforce → 4PS Construct
Dayforce to 4PS Construct integration: technicians and site managers from Dayforce in 4PS, with cost centre and end date