Identity and access management
Simployer to SailPoint integration: Simployer One as the authoritative source in SailPoint Identity Security Cloud
With an integration between Simployer and SailPoint, SailPoint gets an identity for every employee from Simployer One with department, division, country, manager and the right lifecycle state, so roles and access follow hiring, moves and departures. SailPoint has no connector for Simployer; KoppelHet reads Simployer One through the API and delivers the employees as a file to an authoritative source in SailPoint.
What the integration does
Organisations that use Simployer One for HR and SailPoint for roles and access reviews find no Simployer connector in SailPoint. Simployer itself aims its SCIM at Okta, Slack and Google Workspace, so the SailPoint team starts without a reliable HR source.
- An owner in Simployer One creates a separate access token for KoppelHet.
- The SailPoint team creates a Delimited File source as authoritative source and gives KoppelHet rights on that source only.
- Every hour KoppelHet reads the updated employees and looks up the names of department, office and manager.
- KoppelHet sends the file to the source, after which SailPoint aggregates straight away.
- A transform in SailPoint sets the lifecycle state based on the start and offboarding date.
What to watch for with Simployer and SailPoint
- SailPoint has no connector for Simployer. Simployer One does have a SCIM entry point, but Simployer only calls it tested with Okta, Slack and Google Workspace, and SailPoint's SCIM 2.0 connector does not mention use as an authoritative source. KoppelHet therefore delivers to a Delimited File source, which SailPoint does describe for that.
- The manager and dates are missing from Simployer's SCIM example. Yet those dates are exactly what the lifecycle in SailPoint needs. KoppelHet reads them from the regular Simployer One API and puts the start, end and offboarding date each in its own column.
- Simployer One has an offboarding date besides the end date of the employment, and it can fall earlier, for instance with garden leave. The transform in SailPoint sets the identity to inactive after the offboarding date when there is one, and otherwise after the end date.
- Office, department and manager are stored in Simployer One as references to another object. SailPoint links a manager through manager correlation to an account in the same source. KoppelHet therefore puts the manager's employee number in the file, and the names of office and department instead of their IDs.
- SailPoint requires uid, email and lastname for every identity. For a new colleague the work address in Simployer can still be empty, because it is only chosen during onboarding. KoppelHet then fills the address following the naming rule and never uses the private address from Simployer.
- Simployer One is widely used by organisations in several countries, and returns the country of employment per employee. KoppelHet delivers that country as its own column, so SailPoint can assign roles and policies per country, for instance for a local payroll application.
- A Simployer One access token gives owner rights on the whole account. KoppelHet only uses it to request employees updated since the previous run, without write calls, and recommends a separate token you can revoke on its own.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Can SailPoint not read Simployer's SCIM entry point directly?
Possibly, but the manager and dates are missing there, and Simployer does not name SailPoint as a tested service. For an authoritative source a full delivery with dates is more reliable.
What rights does KoppelHet get in SailPoint?
Only the rights to update this one source.
Does salary data go to SailPoint?
No. The file only contains the fields identities and roles need.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Simployer One through the HRM One API (api.alexishr.com/v1) with an access token as bearer: employee with employeeNumber, workEmail, employmentCountry, endDate and offboardDate, references to office, department and manager, filter on updated.
- SailPoint Identity Security Cloud with a Delimited File source as authoritative source; KoppelHet sends the CSV through the import-accounts API, which starts the aggregation straight away. Required attributes uid, email and lastname; Manager Name through manager correlation; Lifecycle State through a transform on startDate, endDate and offboardDate.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Simployer | Field in SailPoint | Notes |
|---|---|---|
employeeNumber | uid en employeeNumber | Key of the identity |
Voornaam | firstname | |
Achternaam | lastname | |
workEmail of naamgevingsregel | email | |
Afdeling en divisie | department en division | |
Kantoor | location | |
employmentCountry | country | |
Leidinggevende (verwijzing naar medewerker) | manager | As the manager's employee number |
Startdatum, endDate en offboardDate | startDate, endDate en offboardDate |
Related
Recruitee → Simployer
Recruitee to Simployer integration: hired candidates with employment and salary in Simployer One
Simployer → Active Directory
Simployer to Active Directory integration: accounts in your own domain from Simployer
Simployer → ADP iHCM
Simployer to ADP iHCM integration: salary, bonuses and end of employment from Simployer One to ADP iHCM
Simployer → AFAS Profit
Simployer to AFAS integration: Dutch employees from Simployer One in AFAS payroll