Identity and access management
SAP HCM to Google Workspace integration: Google accounts based on SAP actions
With an integration between SAP HCM and Google Workspace, a new employee in SAP gets a Google account in the organisational unit of their personnel area, with job title and department, and the account is suspended on the start date of the termination action. SAP only sends the Dutch employees to a KoppelHet program in your network, which only connects outwards.
What the integration does
Anyone running SAP HCM in their own data centre and using Google Workspace for mail and collaboration often creates accounts through a form from the department. After a transfer someone stays in the groups of the old department, and leavers keep their account until someone notices.
- HR enters the hire action in SAP, often weeks in advance.
- SAP sends the changed data to the KoppelHet program in your network.
- KoppelHet creates the Google account in the organisational unit of the personnel area, with job title and department, and adds it to the department's groups.
- A transfer switches department and groups on the start date.
- On the start date of the termination KoppelHet suspends the account; after the period files go to the manager and the account is removed.
What to watch for with SAP HCM and Google Workspace
- SAP HCM only sends the infotypes that changed. If only the organisational assignment changes, KoppelHet completes the name with what is already known, so a transfer does not produce an account without a name.
- Actions in SAP have a start date that is often ahead. KoppelHet creates the Google account as soon as the hire arrives, but only switches groups and suspends on the start date of the next action.
- Whether someone is employed is held in SAP in the status of the action. KoppelHet suspends based on that status, so an employee on unpaid leave keeps their account and a leaver does not.
- The personnel area in SAP determines the organisational unit in Google. Settings can then differ per part of the organisation, without IT moving accounts by hand.
- Google Workspace can only be reached over the internet, SAP HCM sits behind your firewall. The IDocs go to a KoppelHet agent on a server in that same network, and the agent forwards them through an outbound connection; Google never needs to reach SAP.
- Google charges suspended accounts as active ones. KoppelHet deletes a suspended account after the period you choose, once the Drive files have been transferred to the manager.
- The distribution model in SAP determines which infotypes are sent. We leave address and bank details out of it, so only name, organisation and actions leave the network.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Does SAP need to be reachable from outside?
No. SAP sends the data to a KoppelHet program inside your network, which only connects outwards.
What does our SAP administrator need to set up?
A distribution model and partner profile for HR master data, filtered on Dutch employees and without address and bank. We supply the settings.
Do guest staff get an account too?
If they are in SAP with their own employee group, we agree per group whether they get an account and in which organisational unit.
What can be traced afterwards for an audit?
Every action of the integration is recorded in the audit logging of the KoppelHet platform, with the SAP action it followed. KoppelHet works with an ISO 27001 certified management system.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- SAP HCM sends HR master data through ALE with message type HRMD_A (IDocs), created by change pointers, with a distribution model and partner profile filtering on Dutch employees. A KoppelHet agent receives the IDocs inside the network. Infotypes 0000 (actions, STAT2), 0001 (organisational assignment, personnel area) and 0002 (personal data); key PERNR.
- Google is written through the Admin SDK Directory API (externalIds, name, primaryEmail, orgUnitPath, organizations, suspended; delete after the period), groups and members, and the Data Transfer API for Drive. Access through a service account with domain-wide delegation.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in SAP HCM | Field in Google Workspace | Notes |
|---|---|---|
PERNR | externalIds (organization) | Fixed key |
Voornaam en roepnaam (infotype 0002) | name.givenName | |
Voorvoegsel en achternaam (infotype 0002) | name.familyName | |
Naamgevingsregel | primaryEmail | |
Personeelsgebied (infotype 0001) | orgUnitPath | Through a lookup table |
Organisatie-eenheid (infotype 0001) | organizations.department en groepen | |
Functie of positie (infotype 0001) | organizations.title | |
Maatregel en status (infotype 0000) | suspended |
Related
SAP HCM → Active Directory
SAP HCM to Active Directory integration: domain accounts per personnel area from SAP HR
SAP HCM → AFAS Profit
SAP HCM to AFAS integration: SAP HR data straight to Dutch payroll
SAP HCM → Microsoft Entra ID
SAP HCM to Entra ID integration: Microsoft accounts from SAP HR, without your own Logic Apps
SAP HCM → Nmbrs
SAP HCM to Nmbrs integration: SAP HR data to Dutch payroll