Identity and access management
Sage People to SailPoint integration: team members as an authoritative source in SailPoint Identity Security Cloud
With an integration between Sage People and SailPoint, SailPoint gets an identity for every team member from Sage People with job title, department, country and manager, and roles and access follow the start and end date of the employment record. SailPoint's Salesforce connector manages the Salesforce users and permission sets of Sage People, not the team members themselves; KoppelHet delivers those as the HR source.
What the integration does
Organisations that use Sage People for several countries and SailPoint for access governance often already have Sage People as a Salesforce source in SailPoint for the rights of HR users. That source does not serve as the HR source for all employees, because the team members sit in an object of their own.
- The Sage People administrator creates an API user with read-only rights on team members and employment records.
- Every fifteen minutes KoppelHet reads the changed records and adds the current employment record per team member.
- KoppelHet delivers the file to the SailPoint source and starts the aggregation.
- SailPoint sets new colleagues to pre-hire and assigns the roles on the start date.
- After the end date of the employment record the identity becomes inactive.
What to watch for with Sage People and SailPoint
- SailPoint's Salesforce connector manages Salesforce users with their permission sets, roles and groups. Sage People runs on Salesforce, but an employee there is a team member record in an object of its own, not a Salesforce user. KoppelHet delivers the team members as a separate authoritative source; the Salesforce source stays for the rights of HR users.
- Since July 2026 SailPoint's Salesforce connector can sign in through an External Client App. KoppelHet uses its own app with read-only rights in the same Sage People environment. That keeps SailPoint's administrative rights and the HR data for the identities separate.
- The end date in Sage People is on the employment record and not on the team member. KoppelHet follows changes on both objects and delivers the end date of the current record, so SailPoint sees a departure even if the team member itself did not change.
- After a return a team member gets a new employment record. An identity in SailPoint with review history should stay with that person. KoppelHet uses the team member's employee number as uid, so the old identity becomes active again instead of a second one appearing.
- Sage People assigns each employee to a country through the payroll company. KoppelHet delivers payroll company and country as attributes, so SailPoint can make roles and certifications per country, for example for a local payroll system.
- HR often records an end date weeks ahead. KoppelHet delivers that date as endDate straight away, and the transform in SailPoint only sets the identity to inactive after that day. The leaver keeps access up to and including the last working day.
- SailPoint requires a work email for every identity, while a new team member often only has a private address. KoppelHet fills the work email following the naming rule per country, and never passes on a private address.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
What rights does KoppelHet get in Sage People and SailPoint?
In Sage People only read rights on team members and employment records. In SailPoint only the rights to update this one source.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Sage People through the Salesforce API with SOQL on fHCM2__Team_Member__c and fHCM2__Employment__c, filtered on the modification date of both objects; signing in through an External Client App with OAuth 2.0 client credentials and an API user with a read-only permission set.
- SailPoint Identity Security Cloud gets a Delimited File source as authoritative source; KoppelHet sends the CSV through the import-accounts API, which starts the aggregation right away. Required attributes uid, email and lastname; lifecycle states prehire, active and inactive through a transform on startDate and endDate. SailPoint's Salesforce SaaS connector (users, PermissionSet, PermissionSetGroup, PublicGroup, Role) stays a separate source.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Sage People | Field in SailPoint | Notes |
|---|---|---|
Employee Number (team member) | uid | Per team member, not per employment record |
First Name | firstname | |
Last Name | lastname | |
Werkadres of naamgevingsregel | email | |
Job Title | title | |
Department | department | |
Payroll company en land | company en country | |
Manager (team member) | manager | |
Start Date en End Date (employment) | startDate en endDate |
Related
Sage People → Active Directory
Sage People to Active Directory integration: domain accounts for the Dutch office
Sage People → ADP iHCM
Sage People to ADP iHCM integration: salary records, bonuses and leavers of the Dutch payroll company to ADP
Sage People → AFAS Profit
Sage People to AFAS integration: Dutch employees and salaries from Sage People in AFAS Profit
ASSage People → Arbodienst (SIVI)
Sage People to the occupational health service via SIVI: absence records as absence reports