Identity and access management
HiBob to Google Workspace integration: Google accounts per site, suspended after the last day
With an integration between HiBob and Google Workspace, every new employee in HiBob gets a Google account in the organisational unit of their site, with job title, department and manager. After the last working day KoppelHet suspends the account and the Drive files go to the manager.
What the integration does
Organisations with HiBob for HR and Google Workspace as their workplace often create accounts by hand from the onboarding task in Bob. If each country has its own Google settings, IT also has to pick the right organisational unit, and on departure the files are regularly not handed over.
- HR hires a new colleague in HiBob, with site, department, job title and manager.
- KoppelHet creates the Google account in the organisational unit of the site, so that country's policy applies straight away, and writes the work address back to HiBob.
- When someone changes department or site, the account moves to the new unit and the groups change.
- When someone goes on leave without keeping access, KoppelHet pauses the account in the agreed way.
- After the last working day KoppelHet suspends the account and transfers the Drive files to the manager.
What to watch for with HiBob and Google Workspace
- HiBob only reports a departure at midnight after the effective date, in the site's time zone. Colleagues in different time zones are therefore suspended at different moments, and nobody loses access during their last working day.
- In Google the organisational unit decides which policy and apps apply. KoppelHet uses the site from HiBob to choose that unit, so colleagues in each country get that country's settings.
- HiBob has leave where someone keeps access and leave where they do not. HiBob only sends a notification for the second kind, and only then does KoppelHet pause the Google account.
- If an employee is deleted in HiBob rather than terminated, the record can no longer be retrieved. HiBob does include the email address in that notification; KoppelHet uses it to find the Google account and puts it to IT for review.
- Google records the manager by their Google address, HiBob by a reference to the employee. KoppelHet translates that reference to the manager's Google account.
- A change HR enters in advance, such as a move to another site from the first of the month, is only reported by HiBob on the effective date. The move to the new organisational unit therefore happens on exactly that day.
- On departure KoppelHet transfers the Drive files to the manager from HiBob before the account is deleted later. That way no shared documents disappear with the account.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
When exactly is a leaver suspended?
At midnight after the last working day, in the time zone of the site in HiBob. If an account must close earlier, for example on summary dismissal, IT can suspend it straight away; the integration does not undo that.
Does the integration see salaries in HiBob?
No. The service user in HiBob may only read personal and work data and change the email address.
Does this also work with Microsoft 365?
Yes, we build that integration too.
What about the GDPR?
You are the controller and KoppelHet is the processor, under a data processing agreement. The integration only reads the fields Google Workspace needs.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- HiBob is read through signed employee events (employee.created, employee.updated, employee.joined, employee.left, employee.temporaryLeave and employee.deleted, which includes the email address) and the People API (people search). Lifecycle events fire at midnight after the effective date in the site's time zone; employee.temporaryLeave does not fire when Remain active is chosen.
- Google is written through the Admin SDK Directory API (users with externalIds, name, primaryEmail, organizations, orgUnitPath, relations type manager, customSchemas and suspended; groups and members) and the Data Transfer API for Drive. Access through a service account with domain-wide delegation, limited to those scopes.
- The work address goes back through the HiBob People API email endpoint. The service user has no rights to salary or bank details.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in HiBob | Field in Google Workspace | Notes |
|---|---|---|
root.id | externalIds (type organization) | Fixed key |
root.firstName | name.givenName | |
root.surname | name.familyName | |
Naamgevingsregel | primaryEmail | Goes back to root.email in HiBob |
work.title | organizations.title | |
work.department | organizations.department en groepen | |
work.siteId | orgUnitPath | One organisational unit per site or country |
Leidinggevende (reports to) | relations (type manager) | The manager's Google address |
employment.type | customSchemas | Custom field for employment type |
employee.left | suspended = true en Drive-overdracht |
Related
Ashby → HiBob
Ashby to HiBob integration: a hire from Ashby straight in as an employee in Bob
Bullhorn → HiBob
Bullhorn to HiBob integration: an approved placement as a new employee in Bob
Carerix → HiBob
Carerix to HiBob integration: successful match becomes a new employee in Bob
Greenhouse → HiBob
Greenhouse to HiBob integration: from a hire in Greenhouse to a new employee in Bob