Identity and access management
Sage HR to SailPoint integration: Sage HR as the authoritative source for SailPoint Identity Security Cloud
With an integration between Sage HR and SailPoint, SailPoint gets an identity for every employee from Sage HR with job title, team, manager and a lifecycle state that follows from start date, termination and rehire. KoppelHet reads the active and terminated employees through the Sage HR API and delivers them every hour to a Delimited File source in SailPoint.
What the integration does
Organisations that use Sage HR for HR and SailPoint for roles and certifications often keep the two aligned by hand. Leavers disappear from the active list in Sage HR, and without an integration SailPoint does not notice that their access must be revoked.
- A Sage HR administrator creates an API key for KoppelHet.
- The SailPoint team creates a Delimited File source as authoritative source and gives KoppelHet rights on that source only.
- Every hour KoppelHet reads the active and the terminated employees and builds one file.
- KoppelHet sends the file to SailPoint, which aggregates straight away.
- A transform sets the identity to inactive after the last working day, and back to active after a rehire.
What to watch for with Sage HR and SailPoint
- KoppelHet delivers to a Delimited File source, which the SailPoint team manages itself and which needs no custom connector code.
- After a termination Sage HR removes the employee from the active list and puts them in a separate list with the end date. If KoppelHet only delivered the active list, the account would vanish from the source instead of the identity becoming inactive. KoppelHet therefore includes leavers with their end date in the file.
- The date of a termination in Sage HR is the last working day. KoppelHet sets it as endDate, and the transform in SailPoint makes the identity inactive from the day after, so the employee can still work their last day.
- A rehire brings an employee back in Sage HR under the same ID. KoppelHet uses that ID as uid, so SailPoint makes the old identity active again, instead of putting a new identity next to the old one.
- Through team_history Sage HR returns a start and end date per team change, and no office through the API. KoppelHet puts the team that applies on the day of delivery in the file, so team-based roles only change on the effective date.
- On-call workers have their own checkbox in Sage HR. KoppelHet delivers it as a separate column, so SailPoint can assign different birthright access to that group or set a shorter review cycle.
- The email address is required at creation in Sage HR and cannot be changed through the API afterwards. SailPoint requires an email address but does not check it. KoppelHet checks whether the domain belongs to your organisation and reports a private address to HR instead of passing it on.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
How long do leavers stay in the file?
As long as you agree, for example ninety days. After that KoppelHet leaves them out.
What rights does KoppelHet get in SailPoint?
Only the rights to update this one source.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Sage HR REST API at {subdomain}.sage.hr/api with X-Auth-Token: GET /employees (email, first_name, last_name, employee_number, position, team, reports_to_employee_id, employment_start_date), team_history, GET /terminated-employees (termination_date); pages with page and meta.next_page; no webhooks.
- SailPoint Identity Security Cloud with a Delimited File source as authoritative source; delivery through the import-accounts API, which starts the aggregation. Required attributes uid, email and lastname; Manager Name through manager correlation; Lifecycle State through a transform on startDate and endDate.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Sage HR | Field in SailPoint | Notes |
|---|---|---|
id (Sage HR) | uid | Stays the same on a rehire |
employee_number | employeeNumber | |
first_name en last_name | firstname en lastname | |
email | email | |
position | title | |
team (met team_history) | department | |
reports_to_employee_id | manager | |
Vinkje oproepkracht | workerType | |
employment_start_date en termination_date | startDate en endDate |
Related
Recruitee → Sage HR
Recruitee to Sage HR integration: hired candidates as employees in Sage HR
Sage HR → Active Directory
Sage HR to Active Directory integration: domain accounts per team, with an expiry date from the termination
Sage HR → ADP iHCM
Sage HR to ADP iHCM integration: compensation and leavers from Sage HR to Dutch ADP payroll
Sage HR → AFAS Profit
Sage HR to AFAS integration: employees of the Dutch entity in AFAS Profit Payroll