Identity and access management
HiBob to SailPoint integration: Bob as the HR source for SailPoint Identity Security Cloud
With an integration between HiBob and SailPoint, SailPoint knows every new, changed and departed employee from Bob, so roles and access follow automatically and lapse after departure. KoppelHet delivers the employees as an HR source in SailPoint, with rules for colleagues who have not started, garden leave, contractors and multiple countries.
What the integration does
Organisations that use HiBob as their HR system and introduce SailPoint Identity Security Cloud want SailPoint to know every leaver from Bob. An auditor requires demonstrably timely revocation of access after departure, while HR then often exports a list every week.
- HR creates a new employee in Bob; they show there as not yet started.
- KoppelHet adds the work email following the naming rule and delivers the employee to the HR source in SailPoint.
- SailPoint creates the identity as a pre-hire and assigns the roles on the start date.
- On a change of department or site KoppelHet starts a new aggregation right away.
- On departure the identity gets the end date that belongs to the departure reason and access lapses.
What to watch for with HiBob and SailPoint
- KoppelHet delivers the HiBob data as a file for a Delimited File source in SailPoint, as an authoritative source. The SailPoint team then does not have to develop or maintain anything itself.
- SailPoint requires a work email for every identity. Bob also asks for an address for a new employee, and HR often enters the private address. KoppelHet delivers the work email following the naming rule, so a private address never reaches SailPoint.
- Anyone who has not started in Bob is excluded from HiBob's search results by default. KoppelHet deliberately includes those colleagues, so SailPoint knows them as pre-hires and access is ready on the first working day.
- HiBob also reports garden leave as a departure. Whether access then lapses on the last day in the office or on the contract end date is recorded per departure reason.
- If the integration may not read a field in Bob, HiBob leaves it out without an error. An empty department can make a role lapse in SailPoint. KoppelHet checks that all expected fields are present and holds back an employee with missing fields until HR fixes it.
- The employment type from Bob, such as permanent, temporary or freelance, goes to SailPoint. Roles and certifications can then differ for contractors and employees.
- HiBob reports changes right away. KoppelHet starts a SailPoint aggregation straight after such a notification, so a departure does not wait for the next scheduled aggregation. That makes timely revocation demonstrable for audit.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
What rights does KoppelHet get in SailPoint?
Only the rights to update this one source, no administrative rights over the whole environment.
What about audit logging, GDPR and our integration platform?
Every delivery and every error is in the audit logging of the KoppelHet platform, and the security and audit logging can go to your SIEM as JSON. You are the controller and KoppelHet is the processor, under a data processing agreement. An existing integration platform is left alone.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- KoppelHet reads HiBob through signed webhooks (including employee.created, employee.updated, employee.joined and employee.left) and the People API (people search with showInactive for employees who have not started), with a service user with read rights on root, work and employment.
- SailPoint Identity Security Cloud receives a CSV through the import-accounts API of a Delimited File source (authoritative source), which starts the aggregation right away. Lifecycle states prehire and inactive through a transform on startDate and endDate. Required attributes uid, email and lastname.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in HiBob | Field in SailPoint | Notes |
|---|---|---|
root.id | uid (User Name) | |
root.firstName | firstname | |
Achternaam | lastname | |
Naamgevingsregel of werkadres | email (Work Email) | |
work.title | jobTitle | |
work.department | department | |
work.siteId | site en country | |
Leidinggevende | manager | |
employment.type | employeeType | |
Startdatum en vertrekdatum | startDate en endDate (lifecycle state) |
Related
Ashby → HiBob
Ashby to HiBob integration: a hire from Ashby straight in as an employee in Bob
Bullhorn → HiBob
Bullhorn to HiBob integration: an approved placement as a new employee in Bob
Carerix → HiBob
Carerix to HiBob integration: successful match becomes a new employee in Bob
Greenhouse → HiBob
Greenhouse to HiBob integration: from a hire in Greenhouse to a new employee in Bob