Identity and access management
Exact HR to SailPoint integration: payroll in Exact Online as an authoritative source
With an integration between Exact HR and SailPoint, every employee from payroll in Exact Online becomes an identity in SailPoint, with administration, department, job, cost centre, manager and the employment dates. KoppelHet delivers that data as a file to a Delimited File source, so SailPoint grants access at the start and revokes it after the end date.
What the integration does
Organisations that process payroll in Exact Online and have SailPoint for access management often put employees into SailPoint with an export per administration. Someone has to run such an export again and again, and the same employee numbers in two administrations give duplicate usernames in SailPoint.
- Payroll approves KoppelHet's app in Exact Online, with read rights on payroll only.
- KoppelHet fetches the changed employees and their organisation per administration and updates its own full state.
- KoppelHet reports employees without a usable work email or with an unknown manager to payroll.
- KoppelHet loads the file into the Delimited File source, after which SailPoint updates the identities.
- After the end date the lifecycle state becomes inactive and SailPoint revokes access.
What to watch for with Exact HR and SailPoint
- Employee numbers in Exact are only unique within an administration, while SailPoint wants a User Name that is unique across all identities. KoppelHet puts the administration code in front of the number. SailPoint does not allow characters such as full stop, brackets and exclamation mark in the attribute for the username, so the code goes in without punctuation.
- Exact returns changes based on a sequence number that KoppelHet stores per administration, and that number restarts when Exact moves an administration. SailPoint needs the full file at every aggregation. KoppelHet re-reads the administration after such a move, so the file stays complete.
- Exact stores a cost centre with the organisation of the employment. KoppelHet puts that in its own column in the file, so SailPoint roles and certifications can work per cost centre, with the same code as the internal charging in Exact.
- In Exact an employee points to the internal ID of their manager in the same administration. SailPoint links the manager through manager correlation on an account in the source. KoppelHet therefore puts the manager's User Name in the file; a manager in another administration is filled in according to an agreed rule.
- SailPoint requires a work email but does not check whether it is valid. In payroll the business email field is often empty or holds a private address. KoppelHet fills it in according to the naming rule and reports addresses on a private domain, before SailPoint creates an identity with them.
- Exact records per employee how the name is composed, for example with the partner's surname. SailPoint requires a surname for every identity; KoppelHet builds it according to the choice in Exact, so the name in SailPoint certifications matches how the employee calls themselves.
- Through the API the payroll data in Exact can only be read. An address KoppelHet fills in according to the naming rule therefore cannot go back to Exact; KoppelHet puts it on a list for payroll.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Does this work with several administrations?
Yes. All administrations go into one file, with the administration code in the username.
Does payroll data end up in SailPoint?
No. The file only contains name, number, administration, department, job, cost centre, manager, work email and dates.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Exact Online through the REST API with OAuth 2.0 (an app in the Exact App Center, scope Hrm payroll), per {division} and GET only. /api/v1/{division}/sync/Payroll/Employees with a filter on Timestamp (EmployeeHID, FirstName, MiddleName, LastName, NameComposition, NickName, BusinessEmail, Manager, StartDate, EndDate, IsActive), /payroll/EmploymentOrganizations (DepartmentDescription, JobTitleDescription, CostCenter) and /system/Divisions (DivisionMoveDate).
- SailPoint Identity Security Cloud with a Delimited File source as authoritative source. Required identity attributes uid (unique, without the characters * ( ) & ! .), email and lastname; Manager Name with manager correlation; Lifecycle State through a transform on StartDate and EndDate.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Exact HR | Field in SailPoint | Notes |
|---|---|---|
Administratiecode + EmployeeHID | uid (User Name) | Without punctuation |
BusinessEmail of naamgevingsregel | email (Work Email) | Checked by KoppelHet |
MiddleName + LastName volgens NameComposition | lastname | |
FirstName of NickName | firstname | |
Administratie (division) | Identity attribute voor entiteit | |
DepartmentDescription | Identity attribute voor afdeling | |
JobTitleDescription | Identity attribute voor functie | |
CostCenter | Identity attribute voor kostenplaats | |
Manager | Manager Name | As the manager's uid |
StartDate en EndDate | Lifecycle State (via transform) |
Related
Exact HR → 4PS Construct
Exact HR to 4PS Construct integration: payroll costs from Exact Online payroll as a journal in 4PS, with cost centre and project as dimensions
Exact HR → Active Directory
Exact HR to Active Directory integration: accounts from payroll in Exact Online
Exact HR → AllSolutions
Exact HR to AllSolutions integration: payroll costs from Exact Online payroll as a journal posting in AllSolutions
ASExact HR → Arbodienst (SIVI)
Exact to occupational health service via SIVI: sick and recovery notifications from Exact Online payroll to the health service