Identity and access management
Personio to JumpCloud integration: JumpCloud users from Personio, with the JumpCloud import or custom
With an integration between Personio and JumpCloud, every employee from Personio becomes a JumpCloud user with job title, department, office, cost centre and manager, and that user is suspended when the employment ends. JumpCloud has its own Personio import that runs hourly; KoppelHet comes in when leave must not lead to suspension, when new colleagues may only get access on the start date, or when the work email must go back to Personio.
What the integration does
Organisations that use Personio for HR and JumpCloud for accounts, SSO and devices often switch on JumpCloud's import first. They then run into colleagues on parental leave being suspended, new employees who can sign in weeks before their first day, and work emails that stay empty in Personio.
- Personio gets a dedicated API client for KoppelHet with read rights on persons, employments and org units.
- In JumpCloud the administrator creates an API key on a separate admin account that is not tied to one employee.
- KoppelHet stages the user as soon as someone is in onboarding in Personio, with a work email according to your naming rule.
- On the start date the user is activated; groups for department and office grant the apps and devices.
- After the last working day KoppelHet suspends the user; leave only leads to suspension if you agree that per type of leave.
What to watch for with Personio and JumpCloud
- JumpCloud's Personio import treats the statuses Leave and Inactive both as inactive and suspends the user as soon as someone goes on leave. A colleague on parental leave then loses mail, SSO and their laptop. KoppelHet keeps leave separate from departure and leaves the user active, unless you record something else for a type of leave.
- In the same import, Onboarding and Active count as active. Someone already in onboarding in Personio can therefore sign in weeks before the first working day. KoppelHet sets such a person to staged in JumpCloud and only activates them on the start date.
- When someone returns from an inactive status, JumpCloud's reactivationAllowed setting decides whether the user becomes active again. If it is off, the colleague stays suspended until an administrator steps in. KoppelHet reactivates on the day of return and reports it to IT.
- JumpCloud fills username and email both from the work email in Personio. For a new employee that field is often still empty, and Personio accepts an email address for only one person. KoppelHet creates the address with your naming rule and writes it back to Personio.
- For the JumpCloud import you choose in Personio which attributes the API credentials may read. JumpCloud warns that too many attributes make the import time out, and that changing the rights revokes the existing credentials. KoppelHet uses its own API client, so an extra field for the integration does not stop JumpCloud's import.
- The JumpCloud import passes the manager as the manager's email address. If that manager has no work email in Personio yet, the relation stays empty. KoppelHet looks up the manager by their Personio ID and sets the relation to that user in JumpCloud.
- A scheduled JumpCloud import runs hourly and is off by default for a new connector. KoppelHet works on Personio's notifications, so a termination is processed at the end of the last working day and does not depend on a schedule someone has to switch on.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Can the JumpCloud import and KoppelHet run side by side?
Preferably not for the same employees. Both set the state, and the import would then suspend someone KoppelHet keeps active. If you choose KoppelHet, we switch off the scheduled import after a parallel test week.
Is a leaver deleted from JumpCloud?
No, suspended. Deleting after the retention period remains a step for IT, so devices and history stay visible.
Does the integration read salaries in Personio?
No. KoppelHet's API client only has read rights on persons, employments and org units.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- The JumpCloud import for Personio requires the SSO Package or higher, a Client ID and Client Secret from Personio with read rights on the employees API, and required mapping of externalId, username and email. Leave and Inactive are suspended, Onboarding and Active are active; reactivationAllowed decides restoration. Scheduled import hourly, off by default.
- KoppelHet reads Personio through webhooks and the Personio API v2 (/v2/persons and /v2/persons/{id}/employments with status ONBOARDING, ACTIVE, LEAVE or INACTIVE, org_units, legal_entity, supervisor, position.title and termination; filter updated_at.gt, limit at most 50, cursor).
- JumpCloud is written through API v1 (/systemusers, header x-api-key): employeeIdentifier (unique per user), jobTitle, department, costCenter, company, location, manager as a relation to another user, and state STAGED, ACTIVATED or SUSPENDED.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Personio | Field in JumpCloud | Notes |
|---|---|---|
person.id | employeeIdentifier | Unique per user in JumpCloud |
preferred_name of first_name | firstname | |
last_name | lastname | |
Naamgevingsregel | username en email | |
position.title | jobTitle | |
org_units (type department) | department | |
office | location | |
cost_centers | costCenter | |
legal_entity | company | |
supervisor.id | manager | ID of the manager's JumpCloud user |
status en last_working_day | state (STAGED, ACTIVATED, SUSPENDED) |
Related
Ashby → Personio
Ashby to Personio integration: hires with hours and entity as new employees in Personio
Bullhorn → Personio
Bullhorn to Personio integration: placements as a person with employment in Personio
Carerix → Personio
Carerix to Personio integration: successful placement as a new employee in Personio
Greenhouse → Personio
Greenhouse to Personio integration: hired candidates as employees in Personio