Identity and access management
Sage HR to Google Workspace integration: Google accounts from Sage HR, suspended after the last working day
With an integration between Sage HR and Google Workspace, a new employee from Sage HR gets a Google account with job title, team and manager, and the account is suspended after the last working day of the termination in Sage HR. Sage HR only offers signing in with Google; KoppelHet creates, changes and suspends the accounts through the Sage HR API.
What the integration does
Organisations that use Sage HR alongside Google Workspace often let employees sign in to Sage HR with Google. IT still creates and suspends the Google accounts themselves by hand, based on an email from HR.
- HR creates a new employee in Sage HR with the work email following the naming rule.
- KoppelHet sees the new employee in the next run and creates the Google account with that address.
- Job title, team and manager go to Google; the team decides the groups.
- After the last working day of a termination KoppelHet suspends the account.
- On a rehire KoppelHet switches the same account back on.
What to watch for with Sage HR and Google Workspace
- Sage HR offers signing in with Google, to be enabled by a Google Workspace administrator. According to Sage HR this does not work when Sage HR is connected to Sage 50 Payroll; employees then sign in with their Sage account. KoppelHet creates the Google accounts either way, but the Google sign-in to Sage HR depends on that choice.
- The email address is required when creating an employee in Sage HR, but the API cannot change it afterwards. KoppelHet therefore cannot write a Google address back. HR enters the work email straight away, and KoppelHet creates the Google account with it after checking that the domain belongs to your Google environment.
- An employee with a termination disappears from Sage HR's list of active employees and then sits in a separate list, with the end date. KoppelHet reads both lists, so a leaver is suspended in Google and does not just drop out of the overview unnoticed.
- For a termination the date in Sage HR is the last working day. KoppelHet suspends the Google account at the end of that day, and after the retention period transfers the Drive files to the manager from Sage HR.
- Sage HR does not return an office for an employee through the API. KoppelHet therefore chooses the organisational unit in Google by team, or by a fixed value you record per team.
- According to the API description Sage HR sends no webhooks. KoppelHet compares both lists with the previous state every hour and only writes the differences to Google, so the Directory API does not update all accounts on every run.
- A rehire in Sage HR brings an employee back under the same ID. KoppelHet recognises that ID and lifts the suspension of the old Google account, with the mail and files from then, as long as the account has not been deleted yet.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Can the Google address go back to Sage HR?
No, the Sage HR API cannot change the email address after creation. HR therefore enters the work email straight away.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Sage HR REST API on {subdomain}.sage.hr/api with the X-Auth-Token header. GET /employees (email, first_name, last_name, employee_number, position, team, reports_to_employee_id), GET /terminated-employees (termination_date) and POST /employees/{id}/rehire. Pages with page and meta.next_page. No webhooks; email not in PUT /employees/{id}.
- To Google through the Admin SDK Directory API (users with externalIds, name, primaryEmail, password and changePasswordAtNextLogin, orgUnitPath, organizations, relations type manager and suspended; groups and members) and the Data Transfer API, with a service account with domain-wide delegation.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Sage HR | Field in Google Workspace | Notes |
|---|---|---|
employee_number | externalIds (type organization) | |
email | primaryEmail | |
first_name en last_name | name.givenName en name.familyName | |
position | organizations.title | |
team | organizations.department, groepen en orgUnitPath | |
reports_to_employee_id | relations (type manager) | |
termination_date (terminated-employees) | suspended = true |
Related
Recruitee → Sage HR
Recruitee to Sage HR integration: hired candidates as employees in Sage HR
Sage HR → Active Directory
Sage HR to Active Directory integration: domain accounts per team, with an expiry date from the termination
Sage HR → ADP iHCM
Sage HR to ADP iHCM integration: compensation and leavers from Sage HR to Dutch ADP payroll
Sage HR → AFAS Profit
Sage HR to AFAS integration: employees of the Dutch entity in AFAS Profit Payroll