Identity and access management
Personio to Google Workspace integration: Google accounts per entity and office
With an integration between Personio and Google Workspace, every new employee in Personio gets a Google account with the right entity's domain, office, department and manager. After the last working day in Personio the account is suspended, and the licence is released on the contract end date.
What the integration does
Groups with entities in several countries that use Personio for all of them and work in Google Workspace with a separate email domain per country often create accounts from an onboarding task, sometimes with the wrong domain. Leavers keep their licence until someone goes through the list.
- HR creates the new employee in Personio, with legal entity, office, department, job title and manager.
- KoppelHet creates the Google account with the entity's domain, in the matching organisational unit, and writes the Google address back to Personio.
- Groups and licence follow from department, office and type of employee.
- After the last working day KoppelHet suspends the account.
- On the contract end date the licence is released; the files go to the manager first.
What to watch for with Personio and Google Workspace
- Personio has two dates on a departure, the last working day and the contract end date. KoppelHet suspends the Google account after the last working day and only releases the licence on the end date, so a colleague who spends their final weeks on leave no longer has access while mail and files still exist.
- In Personio every employee belongs to a legal entity. KoppelHet uses that entity to choose the email domain and organisational unit, so a colleague of the GmbH does not start with the BV's address.
- Personio accepts an email address only once. If KoppelHet writes the new Google address back and that address is still on an old record, for example for someone who is rehired, the integration stops and HR gets a warning instead of an error halfway.
- Personio marks external staff separately from own employees. Externals go into their own organisational unit, where you can for example restrict sharing outside the domain.
- An employee on leave or in onboarding counts as active in Personio. KoppelHet therefore does not suspend on parental leave or long-term sick leave, unless you agree that per type of leave.
- The office from Personio goes to the building in Google. Anyone looking for a meeting room in Google Calendar then sees the rooms at their own office first.
- Personio keeps notifications for thirty days and can send them again. After an outage KoppelHet requests the missed notifications again, so no start or departure is lost.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Does this work with several email domains in one Google environment?
Yes. We record the domain and organisational unit per legal entity in Personio.
Does the integration see salaries in Personio?
No. API access is limited to persons and employments; compensation is excluded.
Does this also work with Microsoft 365?
Yes, we build that integration too.
What can be traced afterwards for an audit?
Every action of the integration is recorded in the audit logging of the KoppelHet platform. KoppelHet works with an ISO 27001 certified management system.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Personio is read through webhooks and the Personio API v2 (persons with preferred_name and email, employments with legal_entity, office, org_units, position, supervisor, type, status, last_working_day and termination_date), with only the personio:persons:read and personio:persons:write scopes for writing back email. Missed events up to thirty days back through the Webhooks API redelivery endpoint.
- Google is written through the Admin SDK Directory API (externalIds, name, primaryEmail, orgUnitPath, organizations, locations with buildingId, relations type manager, suspended) and the Enterprise License Manager API. Access through a service account with domain-wide delegation.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Personio | Field in Google Workspace | Notes |
|---|---|---|
Personio-id | externalIds (type organization) | Fixed key |
preferred_name of first_name | name.givenName | |
last_name | name.familyName | |
Naamgevingsregel met domein per legal_entity | primaryEmail | Goes back to email in Personio |
legal_entity | orgUnitPath | |
position | organizations.title | |
org_units (afdeling) | organizations.department en groepen | |
office | locations.buildingId | |
supervisor | relations (type manager) | |
type (INTERNAL of EXTERNAL) | orgUnitPath voor externen | |
last_working_day | suspended = true |
Related
Ashby → Personio
Ashby to Personio integration: hires with hours and entity as new employees in Personio
Bullhorn → Personio
Bullhorn to Personio integration: placements as a person with employment in Personio
Carerix → Personio
Carerix to Personio integration: successful placement as a new employee in Personio
Greenhouse → Personio
Greenhouse to Personio integration: hired candidates as employees in Personio