OIIdentity and access management
SAP SuccessFactors to One Identity integration: Employee Central as the HR source for One Identity Manager
With an integration between SAP SuccessFactors and One Identity Manager, employees, departments, cost centres and locations from Employee Central arrive in One Identity, which bases accounts and rights in Active Directory and other systems on them. One Identity offers its own SuccessFactors HR connector for this through Starling Connect; KoppelHet sets it up and covers what it does not do, such as choosing between employments.
What the integration does
Organisations that have SAP SuccessFactors as their global HR system and One Identity Manager for accounts and rights often start with a CSV export from SuccessFactors. That export lags behind, misses future hires and breaks as soon as someone adds a column.
- In SuccessFactors we create an API user with read-only rights on Employee Central, plus write rights on email and phone if those need to go back.
- We switch on the SuccessFactors HR connector in Starling Connect and install the Cloud HR module in One Identity Manager.
- In the Synchronization Editor we map employees to Person and the organisation objects to departments, cost centres and locations.
- A separate synchronisation reads future hires, so the account is ready before the start date.
- KoppelHet records per employee which employment counts and monitors the synchronisations.
What to watch for with SAP SuccessFactors and One Identity
- One Identity has two SuccessFactors connectors with opposite directions. SuccessFactors HR reads Employee Central as a source for One Identity Manager; the plain SuccessFactors connector manages users in SuccessFactors as a target system. For this integration we use SuccessFactors HR.
- The SuccessFactors HR connector runs in Starling Connect, One Identity's cloud. To use it in the Synchronization Editor, the Cloud HR module must first be installed in One Identity Manager. That step is separate from the connector itself and is not part of every installation.
- According to the administration guide the connector cannot create or delete objects in SuccessFactors, and updating only works for an employee's mobile number, business phone and email. Writing back is therefore limited to contact details.
- Since version 8.0 the endpoint for future-dated employees returns the next effective record. KoppelHet sets up a separate synchronisation for it, so a colleague starting in two weeks already has a disabled account with the right department.
- Starling Connect added endpoints for global assignments and employment terminations. With an assignment abroad or two concurrent employments, KoppelHet chooses the employment that determines the department, and sets an end date only when the last employment ends.
- The connector indicates per employee whether they are a contingent worker. One Identity Manager can then give contractors different roles and a different expiry date than permanent staff, without a second HR source for externals.
- Starling Connect reaches SuccessFactors from fixed IP addresses, which changed when it moved to a new platform in 2025. If an IP restriction is on in SuccessFactors, the SAP administrator adds the European Starling Connect addresses; otherwise the synchronisation stops without HR noticing.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Starling Connect SuccessFactors HR: SCIM endpoints Employees (EmpJob), BusinessUnits (FOBusinessUnit), Departments (FODepartment), CostCenters (FOCostCenter), Locations (FOLocation), Divisions, Companies (FOCompany), JobCodes (FOJobCode), Positions, EmpEmployments, PerPersonals, PerPhones, EventReasons and picklists; GET with paging, PUT only on Employees (cellPhone, businessPhone, email). Added later: FutureDatedEmployees, EmpJobRelationships (v10.0), EmpGlobalAssignment, EmpEmploymentTerminations, isContingentWorker (v10.3), isPrimaryAssignment.
- Connection: SuccessFactors instance URL, username and password or OAuth (from v6.0), Minimal Attributes option. After the migration in March 2025 the connector uses IP addresses 20.82.221.63 and 51.105.212.253 in the EU.
- In One Identity Manager the Cloud HR module (CHS) is needed to use Starling Connect HR connectors in the Synchronization Editor.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in SAP SuccessFactors | Field in One Identity | Notes |
|---|---|---|
userId (EmpJob) | Person.PersonnelNumber | |
firstName, lastName (PerPersonal) | Person.FirstName, Person.LastName | |
department (FODepartment) | Department | |
costCenter (FOCostCenter) | ProfitCenter | |
location (FOLocation) | Locality | |
managerId | Person.UID_PersonHead | |
emplStatus en einddatum (EmpEmployment) | Person.ExitDate en IsInActive | |
isContingentWorker | Soort medewerker (eigen kolom) |
Related
Ashby → SAP SuccessFactors
Ashby to SAP SuccessFactors integration: hire as a new employee in Employee Central
Bullhorn → SAP SuccessFactors
Bullhorn to SAP SuccessFactors integration: placements as employees or contingent workers in Employee Central
Carerix → SAP SuccessFactors
Carerix to SAP SuccessFactors integration: successful placement as a new employee in Employee Central
Greenhouse → SAP SuccessFactors
Greenhouse to SAP SuccessFactors integration: a hire as a new employee in Employee Central