Identity and access management
Personio to SailPoint integration: Personio as the HR source for SailPoint Identity Security Cloud
With an integration between Personio and SailPoint, SailPoint knows every new, changed and departed employee from Personio, so roles and access follow automatically and lapse on the last working day. KoppelHet delivers the employees as an HR source in SailPoint, with rules for the last working day, externals and multiple legal entities.
What the integration does
Organisations that have Personio as their HR source and introduce SailPoint Identity Security Cloud for access management and certifications want SailPoint to know the employees from Personio. The SailPoint team does not want to build and maintain its own connector for that.
- HR records a new employee in Personio with legal entity, department, job title and start date.
- KoppelHet delivers the employee with the work email to the HR source in SailPoint and starts the aggregation.
- SailPoint creates the identity as a pre-hire and assigns the roles on the start date.
- When department or manager changes, Personio reports it and SailPoint adjusts roles and approvers.
- After the last working day the identity becomes inactive and access lapses.
What to watch for with Personio and SailPoint
- KoppelHet delivers the Personio data in a form a standard SailPoint source reads, so the SailPoint team does not have to maintain a connector of its own.
- Personio has a last working day and a termination date, which can be weeks apart because of leave taken. For SailPoint the last working day counts as the end date, so certifications and access do not run on until the termination date.
- Personio knows whether someone is internal or external. That goes to SailPoint, so externals get their own roles and are visible separately in certifications.
- Each legal entity in Personio has its own country. KoppelHet delivers the entity along, so roles can differ per country and a move to another entity becomes a mover instead of a new identity.
- Personio only reports changes that matter for access, such as department, job, manager, status and departure dates. KoppelHet then starts a SailPoint aggregation right away; a new home address does not trigger a needless aggregation.
- The integration may only read persons and employments in Personio. Salary and absence stay outside, so the IAM platform contains no salary or absence data.
- SailPoint requires a work email for every identity. If Personio still holds the private address for a new employee, KoppelHet delivers the work email following the naming rule.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
What rights does KoppelHet get in SailPoint?
Only the rights to update this one source, no administrative rights over the whole environment.
What about audit logging, GDPR and our integration platform?
Every delivery and every error is in the audit logging of the KoppelHet platform. You are the controller and KoppelHet is the processor, under a data processing agreement; salary and absence stay outside the integration. An existing integration platform is left alone.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- KoppelHet reads Personio through webhooks (employment.updated fires for department, job, manager, status, last_working_day and termination date, among others; redelivered for up to three days) and the Personio API v2, with read-only scopes on persons and employments.
- SailPoint Identity Security Cloud receives a CSV through the import-accounts API of a Delimited File source (authoritative source), which starts the aggregation right away. Lifecycle states prehire and inactive through a transform on startDate and endDate. Required attributes uid, email and lastname.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Personio | Field in SailPoint | Notes |
|---|---|---|
id | uid (User Name) | |
first_name of preferred_name | firstname | |
last_name | lastname | |
Werkadres of naamgevingsregel | email (Work Email) | |
position | jobTitle | |
department | department | |
legal_entity | legalEntity | |
supervisor | manager | |
employment type (INTERNAL, EXTERNAL) | employeeType | |
hire_date en last_working_day | startDate en endDate (lifecycle state) |
Related
Ashby → Personio
Ashby to Personio integration: hires with hours and entity as new employees in Personio
Bullhorn → Personio
Bullhorn to Personio integration: placements as a person with employment in Personio
Carerix → Personio
Carerix to Personio integration: successful placement as a new employee in Personio
Greenhouse → Personio
Greenhouse to Personio integration: hired candidates as employees in Personio