Identity and access management
HR2day to SailPoint integration: one identity per care worker, even with several contracts
With an integration between HR2day and SailPoint Identity Security Cloud, HR2day becomes the authoritative source, so SailPoint has one identity per employee with department, job, manager and the right lifecycle. SailPoint has no HR2day connector of its own; KoppelHet reads the employees and employment relationships from HR2day and delivers them in the form SailPoint expects.
What the integration does
Anyone introducing SailPoint with HR2day as HR and payroll system, to base access to the care record, the rostering program and the network on roles, often has employees with two employment relationships, such as a permanent contract in district care and on-call hours in a nursing home. Relief workers also get a new contract every few months.
- The HR2day administrator gives KoppelHet read access to employees, employment relationships and departments.
- KoppelHet determines the leading employment relationship per person and collects the departments of all current relationships.
- KoppelHet delivers one record per person to the SailPoint source and has SailPoint start processing straight away.
- SailPoint calculates the lifecycle, assigns roles per department and job and creates or changes the accounts in the target systems.
- After the end date of the last employment relationship, and an agreed waiting period, KoppelHet delivers the employee as inactive.
What to watch for with HR2day and SailPoint
- HR2day runs on Salesforce, and SailPoint has a Salesforce connector. It reads Salesforce users, permission sets and managed package licences, so who may work in HR2day. It does not read the employees and contracts HR2day keeps. That requires this HR source; the Salesforce connector can stay alongside for access to HR2day itself.
- A care worker with a permanent contract and on-call hours has two employment relationships in HR2day. SailPoint requires the user name to be unique across all identities, and two records for one person give an error or a duplicate identity. KoppelHet delivers one record with the leading relationship and a list of all departments, so access can be granted for the client record teams of both locations.
- Relief staff often get a series of separate contracts in HR2day with a few days in between. If SailPoint set the lifecycle to inactive on every end date, it would revoke all access and request it again at the next contract. KoppelHet keeps the employee active as long as the gap is shorter than the agreed period.
- Without a work email address SailPoint does not create an identity, but many care workers only have a private address in HR2day. KoppelHet fills an address from the naming rule, so the identity exists before the mailbox is created. A private address never goes to SailPoint.
- In HR2day the manager is often attached to the department, not the employee. SailPoint sends access reviews to the manager of the identity. KoppelHet derives the manager per employee, and for a manager the one of the parent department, so nobody reviews their own access.
- Care and education groups sometimes have several foundations as employer in one HR2day environment. KoppelHet delivers the employer as a separate attribute, so SailPoint can separate roles and certifications per foundation, and a move to another foundation causes a role change instead of a new identity.
- A new employment relationship is often ready in HR2day weeks before the start date. KoppelHet already delivers it, so SailPoint puts the identity in the pre-hire lifecycle state and has accounts ready for the first shift.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Can't SailPoint simply read HR2day through the Salesforce connector?
That connector is meant for the users and permissions in Salesforce, so for access to HR2day itself. Employees and contracts as an authoritative source need a separate source, and KoppelHet delivers it.
Does KoppelHet also create the accounts in Entra ID or the client record system?
Not in this setup. SailPoint creates and changes the accounts; KoppelHet makes sure SailPoint has the right HR data.
What happens to interns and volunteers who are not in HR2day?
They come in as a separate source in SailPoint, with their own identity profile. The priority of the profiles decides which source wins if someone is in both. That can be added later as an extension.
What about the GDPR?
You are the controller and KoppelHet is the processor, under a data processing agreement. BSN, home address and salary are not sent to SailPoint.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- HR2day is read through the APIs HR2day makes available for the customer (employees, employment relationships and departments), filtered on modification date, with a read-only integration user.
- SailPoint Identity Security Cloud gets a Delimited File source as authoritative source with an identity profile. KoppelHet sends the CSV file through the import accounts API, which starts aggregation straight away. uid, email and lastname are required and cannot be empty; departments is a multi-valued attribute; the lifecycle state follows from startDate and endDate through a transform.
- The SailPoint Salesforce connector (SaaS) aggregates PermissionSet, PermissionSetGroup, PermissionSetLicense and ManagedPackage as group objects, among others; loading and provisioning accounts must first be activated by SailPoint.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in HR2day | Field in SailPoint | Notes |
|---|---|---|
Personeelsnummer | uid | Unique across all identities in SailPoint |
Roepnaam | firstname | |
Achternaam met voorvoegsel | lastname | Required in SailPoint |
Zakelijk e-mailadres of naamgevingsregel | email | Required in SailPoint |
Functie leidende arbeidsrelatie | title en jobCode | |
Afdeling leidende arbeidsrelatie | department | |
Afdelingen van alle lopende arbeidsrelaties | departments (meerwaardig) | |
Werkgever (rechtspersoon) | company | |
Leidinggevende van de afdeling | manager | Derived per employee |
Begindatum eerste en einddatum laatste arbeidsrelatie | startDate en endDate |
Related
Exact Online → HR2day
Exact Online to HR2day integration: cost centres and cost units to HR2day, payroll journal per division
HR2day → Active Directory
HR2day to Active Directory integration: accounts per school or location from HR
HR2day → Microsoft Entra ID
HR2day to Entra ID integration: Microsoft 365 accounts for care, education and childcare
HR2day → Google Workspace
HR2day to Google Workspace integration: one Google account per employee, also with several employment relationships