Identity and access management
Rippling to Google Workspace integration: Rippling's Google app, and when custom work is needed
Rippling has its own Google Workspace app that sets up a Google account and licence on hire, maintains groups based on Rippling data and stops access on termination. For organisations where everyone is in Rippling, that app is the integration between Rippling and Google Workspace; KoppelHet comes in for a second HR source, transferring files on departure or a verifiable check afterwards.
What the integration does
Organisations that use Rippling as their HR platform and work on Google Workspace usually let Rippling manage the Google accounts itself. That works as long as all employees are in Rippling. Questions arise with a country or subsidiary that keeps a different HR system, or when leavers' files must be kept.
- Together we establish whether all employees are in Rippling and which rules in Rippling determine who gets a Google account.
- If everyone is in Rippling, the administrator sets up Rippling's Google Workspace app and KoppelHet builds nothing twice.
- KoppelHet puts employees from a second HR system in their own organisational unit in Google, outside the reach of the Rippling app.
- On departure KoppelHet can transfer the Drive files to the manager from Rippling before the account is deleted.
- KoppelHet compares daily who is active in Rippling with who can sign in to Google, and reports differences.
What to watch for with Rippling and Google Workspace
- Rippling is a Google Workspace reseller and can buy and assign a licence itself on a hire. KoppelHet therefore does not touch licences for Rippling employees, so two systems do not both order licences.
- In Rippling, access rules on team, location, department or level determine who gets a Google account, and when. Rippling gives its own new colleagues access ten days before the start. That period can be set per organisation; for a second source KoppelHet uses the same period, so both groups of colleagues start the same way.
- Rippling manages Google groups with Supergroups, dynamic groups based on department, location or tenure, and takes over existing groups with their members. KoppelHet does not change a group Rippling manages; employees from a second source go into their own groups.
- On termination Rippling, according to Rippling, stops access to all connected services. What happens to Drive files and mail is not publicly described by Rippling. When an account is deleted Google also deletes its files; KoppelHet can first move them to the manager with the Data Transfer API.
- Google bills a suspended account like an active one. If leavers stay suspended for a long time, you keep paying. KoppelHet deletes the account after the retention period you choose, and a super administrator can restore a deleted account for twenty days.
- In Rippling the user is the person and the worker is the employment. On a rehire the same user gets a new worker. KoppelHet uses the user ID as the external key in Google, so a returning colleague gets their old account and files back instead of a second account.
- An API token in Rippling belongs to the person who creates it and expires when that person leaves or when the token has not been used for thirty days. For the daily comparison KoppelHet creates the token on an admin account that is not tied to one employee.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Do we have to buy the licences through Rippling?
That is a choice in Rippling. If you already have your own Google contract, check with Rippling how the app handles that.
Who manages the groups when there are two sources?
Rippling manages its own groups; KoppelHet creates separate groups for the second source. That way two systems never write to the same group.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- By default through Rippling's Google Workspace app (access rules on attributes, configurable access period before the start, licences through Rippling as reseller, groups and Supergroups under the Groups tab).
- Custom work: Rippling read through the v2 REST API (rest.ripplingapis.com, /workers with expand user, at most 100 per page). Google written through the Admin SDK Directory API (users with externalIds, orgUnitPath, suspended; groups and members) and the Data Transfer API for Drive, with a service account with domain-wide delegation.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Rippling | Field in Google Workspace | Notes |
|---|---|---|
User id | externalIds (type organization) | Not the worker ID; that changes on rehire |
Preferred given name, family name | name.givenName, name.familyName | |
Naamgevingsregel | primaryEmail | |
Title | organizations.title | |
Department | organizations.department en groepen | |
Work location | orgUnitPath | |
Manager | relations (type manager) | |
Termination date | suspended en overdracht van bestanden |
Related
Carerix → Rippling
Carerix to Rippling integration: successful match as a hire for review in Rippling
Greenhouse → Rippling
Greenhouse to Rippling integration: every hire straight into Rippling for review
Recruitee → Rippling
Recruitee to Rippling integration: hired candidates ready to hire
Rippling → 4PS Construct
Rippling to 4PS Construct integration: own employees of the construction entity in 4PS, with department as a dimension