OIIdentity and access management
Personio to One Identity integration: employees from Personio in One Identity Manager
With an integration between Personio and One Identity Manager, employees, departments and teams from Personio are ready every day in fixed files that One Identity Manager's CSV connector reads. One Identity Manager uses them to create accounts and permissions, and sees a departure on the last working day from Personio.
What the integration does
Organisations that use One Identity Manager and run HR in Personio often load employees through an export someone pulls from Personio periodically. That export changes layout as soon as HR adds a column, and a departure only reaches One Identity Manager when the next export is there.
- Personio gets an API client with read-only rights on persons, employments and org units.
- KoppelHet creates two files with a fixed layout, employees and organisation, and places them where the synchronisation server reads.
- The One Identity Manager administrator sets up the CSV connector with both files in one system connection.
- One Identity Manager reads the files and links persons to departments and managers.
- On departure the row stays with the last working day filled in, so One Identity Manager processes the departure itself.
What to watch for with Personio and One Identity
- One Identity has cloud connectors for HR systems such as Workday, but we found none for Personio. One Identity Manager's CSV connector reads any source that keeps to a fixed file layout. KoppelHet makes sure Personio delivers that layout exactly the same every day.
- A person can have several employments in Personio, for example after a move to another legal entity. With a duplicate key the CSV connector picks the first, the last, no row or an error, depending on its setting. KoppelHet prevents that by putting only the applicable employment per person in the file.
- Departments and teams are separate org units in Personio. The CSV connector can read one column as a path in a hierarchy and loads parent units first. KoppelHet puts each team under its department in that path, so One Identity Manager sees them as one tree.
- One Identity Manager cannot use a file from another source to mark missing persons as outstanding. Someone who becomes INACTIVE in Personio therefore does not disappear from the file; the row stays with the last working day as ExitDate until after the retention period.
- Personio is often used internationally, with names such as Søren or Łukasz. KoppelHet writes the files in UTF-8 and puts text columns between quotes, so the CSV connector reads special characters and commas in job titles correctly.
- Personio delivers dates as year-month-day, and the CSV connector reads dates according to the language set for the file. KoppelHet keeps the year-month-day format and records it in the system connection, so an ExitDate is never read as another month.
- Employees on leave are LEAVE in Personio and stay in the file as active. For a type of leave where access must stop, KoppelHet adds a separate column, so One Identity Manager can apply its own rule without simulating a departure.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Does this work with several legal entities?
Yes. All entities are in the same file, with the entity in its own column.
Can the work address go back to Personio?
Yes, but not through the files. That can follow later as an extension, with write rights on the email address in Personio.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Personio through webhooks and the Personio API v2 (/v2/persons, /v2/persons/{id}/employments with status, type, org_units with type department or team, legal_entity, supervisor, position.title, employment_start_date and termination; filter updated_at.gt, limit at most 50, cursor). Read scopes only.
- One Identity Manager reads two files in one system connection through the CSV connector (UTF-8, fixed header row, text delimiters), with a key column in the employee file, Hierarchical sort order on the department path, Uniqueness violation behavior set to Throw error, Read-only access and Data import in the synchronisation step. Access to the files directly or through a remote connection server.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Personio | Field in One Identity | Notes |
|---|---|---|
person.id | Sleutelkolom PersonnelNumber | |
preferred_name of first_name | FirstName | |
last_name | LastName | |
position.title | Kolom functie | |
org_units (department en team) | Afdelingspad (hiërarchische sortering) | |
legal_entity | Kolom bedrijf | |
supervisor.id | Kolom leidinggevende | |
type (INTERNAL of EXTERNAL) | Kolom soort medewerker | |
employment_start_date | EntryDate | |
last_working_day | ExitDate |
Related
Ashby → Personio
Ashby to Personio integration: hires with hours and entity as new employees in Personio
Bullhorn → Personio
Bullhorn to Personio integration: placements as a person with employment in Personio
Carerix → Personio
Carerix to Personio integration: successful placement as a new employee in Personio
Greenhouse → Personio
Greenhouse to Personio integration: hired candidates as employees in Personio