Identity and access management
Sympa to Google Workspace integration: Google accounts from Sympa, next to Sympa's Google sign-in
With an integration between Sympa and Google Workspace, every new employee from Sympa gets a Google account in the organisational unit of their entity, with job title, department and manager, and the account is suspended after the employment ends. Sympa itself only offers signing in to Sympa with Google; KoppelHet handles creating, changing and suspending accounts.
What the integration does
Organisations that use Sympa as their HR system and Google Workspace as their workplace sometimes already let staff sign in to Sympa with Google. IT still creates the Google accounts by hand, based on a list from HR, and the address then also has to go into Sympa.
- The Sympa administrator creates a dedicated API interface for KoppelHet, with only the fields Google needs and read and update rights on the email field.
- In Google KoppelHet gets a service account with domain-wide delegation, limited to users, groups and file transfer.
- Every hour KoppelHet reads the changed employees and creates new Google accounts in the unit of their entity, suspended until the start date.
- The Google address goes back to Sympa, so the Google sign-in to Sympa also knows the right address.
- After the employment ends KoppelHet suspends the account and transfers the files after the retention period.
What to watch for with Sympa and Google Workspace
- Sympa's Marketplace lists only single sign-on for Google Workspace, at € 64 per month invoiced a year in advance. Sympa adds that this sign-in does not transfer data and that users need a UPN as their username. KoppelHet makes sure the Google address and the username in Sympa match, so that sign-in works on day one.
- Sympa supplies data through interfaces that an administrator composes, with exactly the fields an integration may see. KoppelHet asks for a dedicated interface without salary, national ID or bank details, so the Google integration sees nothing it does not need.
- A read request to Sympa goes to a pre-calculated reporting database. A change usually appears there within a minute, but sometimes only after thirty minutes. KoppelHet therefore reads every hour with a generous overlap in time, so a change that lands late in that database is not missed.
- For a table with validity dates Sympa can return the state on a given day. KoppelHet requests a transfer that HR enters in advance with today's state, so the account only moves to the new organisational unit on the effective date.
- Google records the manager with their Google address. In a Sympa interface the manager field can carry that person's email address. KoppelHet sets the relation directly with it, even if the manager works at another entity.
- Sympa allows one hundred requests per hour per interface by default, for reading and writing together. Writing addresses back uses them as well. KoppelHet bundles the hourly read into a few requests with $top and $skip, so there is room to write back a day with many new colleagues.
- Google bills a suspended account like an active one. KoppelHet suspends on the end date from Sympa, transfers the Drive files to the manager after the retention period and then deletes the account, so no licences are left hanging.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Does this work with several entities and domains?
Yes. For each entity in Sympa we record the domain and the organisational unit in Google.
Does the integration see salaries in Sympa?
No. The interface for KoppelHet only contains the fields for the account.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- KoppelHet reads Sympa through the Sympa Integration API (OData v4) on a dedicated interface on api.sympahr.net with X-ApiKey, with $filter on modified, $top and $skip, the at= parameter for the valid state of tables with effectivity, and a target field on the manager's datacard field. The work address goes back with PATCH on the interface's unique key. By default 100 requests per hour per interface; GET reads from the reporting database (delay usually under a minute, up to 30 minutes).
- To Google through the Admin SDK Directory API (users with externalIds, name, primaryEmail, orgUnitPath, organizations, relations type manager and suspended; groups and members) and the Data Transfer API, with a service account with domain-wide delegation.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Sympa | Field in Google Workspace | Notes |
|---|---|---|
Personeelsnummer | externalIds (type organization) | |
Roepnaam of voornaam | name.givenName | |
Achternaam | name.familyName | |
Naamgevingsregel per entiteit | primaryEmail | |
Functie | organizations.title | |
Organisatie-eenheid | organizations.department en groepen | |
Entiteit | orgUnitPath | |
Leidinggevende (e-mail via doelveld) | relations (type manager) | |
Einddatum dienstverband | suspended = true | |
primaryEmail (Google) | Werk-e-mail in Sympa |
Related
Greenhouse → Sympa
Greenhouse to Sympa integration: hired candidate as a data card with contract row in Sympa
Recruitee → Sympa
Recruitee to Sympa integration: hired candidates as a data card in Sympa
SmartRecruiters → Sympa
SmartRecruiters to Sympa integration: ready to onboard becomes a data card in Sympa
Sympa → 4PS Construct
Sympa to 4PS Construct integration: fitters of the Dutch employer from Sympa in 4PS, with cost centre as a dimension