Identity and access management
Remote to SailPoint integration: everyone working through Remote as an identity in SailPoint Identity Security Cloud
With an integration between Remote and SailPoint, everyone working for you through Remote gets an identity in SailPoint, with employment type, country, department and manager, and access lapses on the end date Remote confirms after offboarding. Remote offers employees only read-only through SCIM, without country or dates, and SailPoint has no Remote connector we could find; KoppelHet supplements the SCIM data from the employments and delivers it as an authoritative source.
What the integration does
Organisations that hire people in other countries through Remote and use SailPoint for access governance often have these colleagues outside their own HR system. In SailPoint they are then missing, or created by hand as an external identity.
- Remote reports a new employment; KoppelHet delivers it as a pre-hire to SailPoint with the expected start date.
- When onboarding in Remote is complete, the identity becomes active on the start date and SailPoint assigns the roles.
- A change of department or manager starts a new delivery straight away.
- For an offboarding KoppelHet waits until Remote has confirmed the end date and then delivers it as endDate.
- After the end date the identity becomes inactive and access lapses.
What to watch for with Remote and SailPoint
- Remote offers its employees as SCIM users, but read-only. SailPoint's SCIM 2.0 connector is built to create, update and disable accounts in a target system. KoppelHet therefore uses Remote's SCIM list only as a check and gives SailPoint an ordinary authoritative source.
- A Remote SCIM user has name, email, department, employee number, manager and an active flag, but no country, job title or dates. Lifecycle states in SailPoint run on start and end date. KoppelHet takes country, job title and dates from the employment and merges them per person.
- With employer of record, Remote is the legal employer, not your own company. KoppelHet sets the employment type and country as attributes, so SailPoint can use different roles and a reviewer of their own for EOR employees and contractors than for your own staff.
- An employment at Remote first goes through invitation and onboarding, and can still fall through in that phase. KoppelHet delivers such a colleague as a pre-hire, and removes them from the source again if the employment does not go ahead, so SailPoint does not keep an identity of someone who never started.
- For an offboarding Remote first checks the rules of the country, and after that the end date can still shift. KoppelHet only delivers an endDate once Remote has put the offboarding through, so SailPoint does not revoke access on a proposed date.
- A confidential offboarding at Remote is not in the normal list and must be requested separately. KoppelHet requests it and delivers only the end date, without a reason, so a reviewer in SailPoint sees nothing about the departure either.
- SailPoint requires a work email for every identity. Remote only lets the work email be updated through the API for invited or active employees, not for contractors. KoppelHet fills missing addresses following the naming rule and reports contractors without a work email to HR.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Do contractors also go into SailPoint?
Yes, with the employment type as an attribute, so roles and reviews can differ for them.
What rights does KoppelHet get in SailPoint?
Only the rights to update this one source.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Remote through the Remote API (gateway.remote.com) with a Customer API token with limited scopes. GET /v1/employments, SCIM GET /v1/scim/v2/Users (read-only; enterprise extension with department, employeeNumber and manager; filter in the form attribute eq value), webhooks signed with X-Remote-Signature; confidential offboardings with include_confidential.
- SailPoint Identity Security Cloud gets a Delimited File source as authoritative source; KoppelHet sends the CSV through the import-accounts API, which starts the aggregation right away. Required attributes uid, email and lastname; lifecycle states prehire, active and inactive through a transform on startDate and endDate.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Remote | Field in SailPoint | Notes |
|---|---|---|
employeeNumber of SCIM id | uid | Per person |
name.givenName | firstname | |
name.familyName | lastname | |
work_email of naamgevingsregel | email | |
job_title (employment) | title | |
department (SCIM enterprise-extensie) | department | |
manager (SCIM enterprise-extensie) | manager | Translated to the manager's uid |
country van de employment | country | |
employment_type en employment_model | workerType | |
Startdatum en bevestigde einddatum | startDate en endDate |
Related
Greenhouse → Remote
Greenhouse to Remote integration: foreign hires as EOR employment with the country's form
Recruitee → Remote
Recruitee to Remote integration: hires abroad straight into an employment at Remote
Remote → 4PS Construct
Remote to 4PS Construct integration: own employees of the construction entity from Remote in 4PS
Remote → Active Directory
Remote to Active Directory integration: accounts for colleagues in other countries