Identity and access management
SuccessFactors to SailPoint integration: Employee Central as the HR source, with the SailPoint connector or custom
With an integration between SAP SuccessFactors and SailPoint, SailPoint knows every new, changed and departed employee from Employee Central, so roles and access follow automatically and lapse on the last working day. SailPoint has its own SuccessFactors connector that reads employees and users and also manages accounts in SuccessFactors; KoppelHet comes in when the HR data must first be enriched, filtered or merged, for example with a Dutch payroll, before SailPoint bases roles on it.
What the integration does
Organisations with SAP SuccessFactors and SailPoint Identity Security Cloud that pay Dutch salaries through a local payroll package with its own employee number get duplicate identities in SailPoint. Roles for the Netherlands do not work when local data is missing in SuccessFactors.
- HR records a new employee in Employee Central, with a start date that may be weeks ahead.
- KoppelHet reads the data as it applies on the start date and adds the Dutch employee number and work email.
- KoppelHet delivers the set to the HR source in SailPoint and starts the aggregation.
- SailPoint creates the identity as a pre-hire and assigns the roles on the start date.
- After the last working day of the last employment the identity becomes inactive and access lapses.
What to watch for with SAP SuccessFactors and SailPoint
- According to SailPoint, its SuccessFactors connector is an integration that requires additional licensing or subscriptions, and it runs through a virtual appliance in your network. So check whether it is already in your SailPoint contract.
- SuccessFactors can restrict API traffic to known IP addresses. SailPoint warns that the connector may then be unable to use some features. KoppelHet works from fixed addresses that your SAP team allows in advance.
- The SailPoint connector can create, change and block users in SuccessFactors, but not employees in Employee Central. Those stay with HR. For an HR source that is exactly right: SailPoint reads, HR decides.
- For a new hire with a future start date SuccessFactors shows today's data by default. KoppelHet requests the data as it applies on the start date, so SailPoint prepares the right roles.
- The Dutch payroll has its own employee number. KoppelHet adds it per employee to the SuccessFactors data, so SailPoint has one identity instead of two.
- If someone has an assignment abroad or two concurrent employments, KoppelHet picks the employment that counts for roles and only reports an end date when the last employment ends.
- SailPoint normally processes the HR source at fixed times. KoppelHet starts the aggregation itself after each delivery, so a departure does not have to wait for the next scheduled time.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
What rights does KoppelHet get in SailPoint?
Only the rights to update this one source, no administrative rights over the whole environment.
What about audit logging, GDPR and our integration platform?
Every delivery and every error is in the audit logging of the KoppelHet platform. You are the controller and KoppelHet is the processor, under a data processing agreement; only the fields in the design go to SailPoint, no salary or national ID. SAP Integration Suite or another integration platform is left alone.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- According to SailPoint the SuccessFactors connector supports full, single and delta aggregation (delta for employees and users with employment), Group and Role entitlements (static groups only), and create, update, enable and disable for users only. Requires a virtual appliance cluster, permissions on the MDF OData API and OAuth2 Client Application, and Employee Central with user management.
- KoppelHet reads Employee Central through the OData API with OAuth 2.0, on lastModifiedDateTime per entity and with asOfDate on the start date, and delivers a CSV to a Delimited File source through the import-accounts API, which starts the aggregation right away. Lifecycle states prehire and inactive through a transform on startDate and endDate.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in SAP SuccessFactors | Field in SailPoint | Notes |
|---|---|---|
PerPerson.personIdExternal | uid (User Name) | |
PerPersonal.preferredName of firstName | firstname | |
PerPersonal.lastName | lastname | |
PerEmail (zakelijk type) of naamgevingsregel | email (Work Email) | |
EmpJob.jobCode | jobCode | For roles defined worldwide on job code |
EmpJob.department | department | |
EmpJob.company | company | |
EmpJob.managerId | manager | |
EmpEmployment.startDate en endDate | startDate en endDate (lifecycle state) | |
Personeelsnummer salarisadministratie | nlEmployeeNumber |
Related
Ashby → SAP SuccessFactors
Ashby to SAP SuccessFactors integration: hire as a new employee in Employee Central
Bullhorn → SAP SuccessFactors
Bullhorn to SAP SuccessFactors integration: placements as employees or contingent workers in Employee Central
Carerix → SAP SuccessFactors
Carerix to SAP SuccessFactors integration: successful placement as a new employee in Employee Central
Greenhouse → SAP SuccessFactors
Greenhouse to SAP SuccessFactors integration: a hire as a new employee in Employee Central