Identity and access management
Sage People to Google Workspace integration: Google accounts per country, with sign-in through Google
With an integration between Sage People and Google Workspace, a new team member gets a Google account in the organisational unit of their country, with job title, department and manager, and the account is suspended after the end date of the employment. Sage People itself only offers sign-in with Google as the identity provider; KoppelHet creates, changes and suspends the accounts through the Sage People API and Google's Directory API.
What the integration does
Organisations that use Sage People for several countries and have Google Workspace as their workplace often let employees sign in to Sage People through Google. The Google account itself is then still created after an email from HR, and the link for sign-in has to be set by hand per person.
- We record the organisational unit and the domain in Google per payroll company.
- KoppelHet reads changed team members and employments and creates the Google account before the start date.
- The new address goes to the Sage People administrator as the Federation Id, so sign-in through Google works.
- After the end date KoppelHet suspends the account.
- After the retention period KoppelHet transfers the Drive files to the manager and deletes the account.
What to watch for with Sage People and Google Workspace
- Sage People lists Google as a supported identity provider for sign-in. Google's assertion is matched against the username or the Federation Id in Sage People; Sage People recommends the Federation Id, because usernames must be unique across the whole of Salesforce. The Google address KoppelHet creates therefore becomes the Federation Id.
- Sage People assigns every employee to a payroll provider in a country through the payroll company. KoppelHet uses that payroll company to choose the organisational unit and domain in Google, so each country keeps its own policy for apps and devices.
- The end of an employment sits on the employment in Sage People, not on the team member. KoppelHet follows changes on both and suspends the Google account on the day after the end date, even if HR entered the departure weeks earlier.
- A deleted Google account takes mail and Drive with it, and only a super administrator can restore it within twenty days. KoppelHet therefore suspends first and only transfers the files to the manager from Sage People after the retention period.
- After a return a team member can get a new employment record. KoppelHet finds the suspended Google account by employee number and reactivates it, with the mail and files from back then, if it has not been deleted yet.
- Google requires a password for every new account. With sign-in to Sage People through Google, the new colleague only needs to know one password; KoppelHet sets a random initial password that must be changed at first sign-in.
- KoppelHet reads Sage People with its own app and an API user with read-only rights, without an HR employee's password. Salary and bank details are not in those rights and therefore never end up in Google.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Does KoppelHet set the Federation Id in Sage People itself?
Not in the smallest setup: the integration only reads. The address goes to the administrator as a task; writing it ourselves can follow later as an extension.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Sage People through the Salesforce API with SOQL on fHCM2__Team_Member__c and fHCM2__Employment__c, filtered on the modification date; sign-in through an External Client App with OAuth 2.0 client credentials and an API user with a read-only permission set.
- To Google through the Admin SDK Directory API (users with externalIds, name, primaryEmail, password and changePasswordAtNextLogin, orgUnitPath, organizations, relations type manager and suspended) and the Data Transfer API, with a service account with domain-wide delegation.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Sage People | Field in Google Workspace | Notes |
|---|---|---|
Employee Number (team member) | externalIds (type organization) | |
First Name en Last Name | name.givenName en name.familyName | |
Naamgevingsregel per land | primaryEmail | |
Payroll company | orgUnitPath | |
Job Title | organizations.title | |
Department | organizations.department | |
Manager (team member) | relations (type manager) | |
End Date (employment) | suspended = true |
Related
Sage People → Active Directory
Sage People to Active Directory integration: domain accounts for the Dutch office
Sage People → ADP iHCM
Sage People to ADP iHCM integration: salary records, bonuses and leavers of the Dutch payroll company to ADP
Sage People → AFAS Profit
Sage People to AFAS integration: Dutch employees and salaries from Sage People in AFAS Profit
ASSage People → Arbodienst (SIVI)
Sage People to the occupational health service via SIVI: absence records as absence reports