Identity and access management
Deel to SailPoint integration: employees, EOR and contractors as one source for roles
With an integration between Deel and SailPoint Identity Security Cloud, Deel becomes the authoritative source, so SailPoint has one identity for everyone who works through Deel, with type of engagement, entity, country, department and manager. SailPoint has no Deel connector of its own; KoppelHet reads the people and contracts from Deel and delivers them in the form SailPoint expects, also when someone moves from contractor to employee.
What the integration does
Organisations with own entities plus EOR employees and contractors in Deel that introduce SailPoint with roles per team and country often track contractors by hand in a separate spreadsheet. For ISO 27001 and customer audits SailPoint then misses part of the people with access.
- You create a token in Deel with read-only rights on people and contracts, and a webhook to KoppelHet.
- KoppelHet merges each person's current contracts into one record, with the type of engagement of the active contract.
- KoppelHet delivers the records to the SailPoint source and has SailPoint start processing straight away.
- SailPoint determines the lifecycle and roles per team, country and type of engagement, and creates or changes the accounts in the target systems.
- When the last contract ends, KoppelHet delivers the person as inactive on the last working day.
What to watch for with Deel and SailPoint
- SailPoint has no Deel connector in its catalogue. SailPoint's generic SCIM connector could read Deel's SCIM API, but Deel delivers the contracts there as a list inside one user. Roles based on the active contract therefore need a conversion first, and KoppelHet does that before SailPoint sees the data.
- An identity in SailPoint belongs to exactly one identity profile. If you put contractors and employees in two separate sources, someone moving from contractor to employee switches profile and may lose access and review history. KoppelHet delivers everyone from Deel in one source with the type of engagement as an attribute, so the identity stays and only the roles change.
- With employer of record, Deel or a partner is the legal employer, not your own entity. KoppelHet sets your own entity or the country as the company for those people, so roles and reviews per business unit do not end up with an outside employer.
- Contractors are often in Deel with only a private address, while SailPoint requires a work address. KoppelHet fills the work address from your naming rule and does not pass on a private address.
- Deel gives the manager as a work address, and SailPoint links the manager through an identity. KoppelHet translates the address into the manager's user name in SailPoint, so a quarterly review of a contractor in Portugal reaches the team lead in the Netherlands.
- People who have not started yet in Deel are already delivered by KoppelHet with their start date. SailPoint puts them in the pre-hire lifecycle state, so laptop and accounts are ready without access being open in advance.
- Deel limits the number of requests and returns an error when too many are made. KoppelHet therefore works on Deel's notifications and does one full comparison per night, so SailPoint is updated quickly without other integrations on Deel being affected.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Why not point SailPoint's SCIM connector directly at Deel?
That can work for a simple situation. As soon as roles depend on the active contract, the employer under EOR or a switch between contract types, something has to be converted first. KoppelHet does that, with logging per person.
Does pay data from Deel go to SailPoint?
No. KoppelHet only reads the data SailPoint needs for identity and roles; pay, rates and home addresses stay in Deel.
Can people outside Deel also be in SailPoint?
Yes, as a separate source with its own identity profile. The priority of the profiles decides which source wins if someone is in both. That can be added later as an extension.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Deel is read through the HRIS People API and contracts (worker_id, hiring_type, person_status ACTIVE, NOT_STARTED or INACTIVE, client_legal_entity, termination_last_day, direct_manager.work_email) with an organisation token, plus webhooks signed with x-deel-signature. The Deel SCIM API (GET /scim/Users, scope Users:read) returns contracts as an employments list in its own extension and answers with 429 when too many requests are made.
- SailPoint Identity Security Cloud gets a Delimited File source as authoritative source; KoppelHet sends the file through the import accounts API, which starts aggregation straight away. uid, email and lastname are required in every identity profile; uid must be unique across all identities. Lifecycle states prehire, active and inactive through a transform on startDate, endDate and status.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Deel | Field in SailPoint | Notes |
|---|---|---|
worker_id (persoon) | uid | Per person, not per contract |
first_name | firstname | |
last_name | lastname | |
work_email of naamgevingsregel | email | |
hiring_type van het actieve contract | workerType | Own entity, EOR or contractor |
client_legal_entity | company | |
Land van het contract | country | |
department en job_title | department en title | |
direct_manager.work_email | manager | Translated to the manager's uid |
person_status en termination_last_day | startDate, endDate en status |
Related
Ashby → Deel
Ashby to Deel integration: hires at the own entity as direct employee in Deel
Bullhorn → Deel
Bullhorn to Deel integration: first placement as a direct employee with a contract in Deel
Carerix → Deel
Carerix to Deel integration: successful placement as a person or contract in Deel
Deel → 4PS Construct
Deel to 4PS Construct integration: own employees of the construction entity in 4PS, with department and cost centre as dimensions