Identity and access management
SuccessFactors to Active Directory integration: accounts from hire to departure
With an integration between SAP SuccessFactors and Active Directory, a new employee from SuccessFactors automatically gets an account in your own Active Directory, at the right location and with department, manager and groups. Former employees who return get their old account back, and on the last working day the account is closed.
What the integration does
Organisations that use SuccessFactors Employee Central for HR and manage their own Active Directory create accounts after a form from the manager. Former employees who return get a second account, and AD keeps accounts of people who left long ago.
- IT installs a small KoppelHet program once in the domain. It only uses outbound connections.
- KoppelHet picks up new and changed employees of the Dutch entity in SuccessFactors, including hires who start later.
- If there is an old account, it is re-enabled; otherwise a new account is created at the right location.
- Title, department, office and manager are filled in, and groups follow from location, department and job.
- On the end date the account is disabled and moved to the leavers.
What to watch for with SAP SuccessFactors and Active Directory
- For a rehire SuccessFactors can attach a new employment to the same person. KoppelHet finds the old account and re-enables it with the new job and department, instead of creating a second account.
- SuccessFactors records per employment whether someone may be rehired. If that is set to no, KoppelHet does not automatically re-enable an old account, but notifies IT.
- Externals are recognisable in SuccessFactors as contingent workers. They go into a separate folder, with their own rules.
- Hires from SuccessFactors Onboarding are in the system before they start. Their account is created in advance but disabled, and is only enabled on the start date.
- The end date from SuccessFactors also becomes the account's expiry date. Active Directory then refuses sign-in after the last day, even before the account is formally disabled.
- Long-term leave has its own status in SuccessFactors. Whether an account should be closed during leave differs per organisation; we agree it per status.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Which rights does the program get in our domain?
Only rights on the folders and groups the integration manages. Admin and service accounts outside them stay out of reach.
Can the email address go back to SuccessFactors?
Yes, as the business email address. That happens after Microsoft has carried the account over to Entra ID, so the address actually exists.
What if the manager works in another country?
If that manager has an account in the same domain, KoppelHet sets the relationship. If they are in another domain, we agree whether the field stays empty or points to a fixed contact.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- SuccessFactors Employee Central is read through the OData API (PerPerson, PerPersonal, EmpEmployment, EmpJob, EmpEmploymentTermination) on lastModifiedDateTime. Flags okToRehire and isContingentWorker; emplStatus for leave.
- A KoppelHet agent in the domain only has rights on the integration's organizational units (OUs) and groups. AD attributes include employeeID (personIdExternal, at most 16 characters), sAMAccountName (at most 20 characters), givenName, sn, displayName, title, department, physicalDeliveryOfficeName, manager and accountExpires (latestTerminationDate).
- The work address can go back to PerEmail in SuccessFactors after Entra Connect has synced the account.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in SAP SuccessFactors | Field in Active Directory | Notes |
|---|---|---|
PerPerson.personIdExternal | employeeID | At most 16 characters in AD |
Naamgevingsregel | sAMAccountName | At most 20 characters |
PerPersonal.firstName en lastName | givenName en sn | |
PerPersonal.displayName | displayName | |
EmpJob.jobTitle | title | |
EmpJob.department | department | |
EmpJob.Location (LocationName) | physicalDeliveryOfficeName en OU | |
EmpJob.managerId | manager | Distinguished name of the manager's account |
EmpEmployment.isContingentWorker | OU voor externen | |
EmpEmploymentTermination.latestTerminationDate | accountExpires |
Related
Ashby → SAP SuccessFactors
Ashby to SAP SuccessFactors integration: hire as a new employee in Employee Central
Bullhorn → SAP SuccessFactors
Bullhorn to SAP SuccessFactors integration: placements as employees or contingent workers in Employee Central
Carerix → SAP SuccessFactors
Carerix to SAP SuccessFactors integration: successful placement as a new employee in Employee Central
Greenhouse → SAP SuccessFactors
Greenhouse to SAP SuccessFactors integration: a hire as a new employee in Employee Central