Identity and access management
Talentech to Google Workspace integration: Google accounts from PeopleCore, with Google as the sign-in for Talentech ID
With an integration between Talentech PeopleCore and Google Workspace, every employee that HR completes in Talentech gets a Google account with job title, department, location and manager, and the account is suspended after the end of employment from the resignation application. Talentech only offers signing in with Google through SAML; KoppelHet creates the accounts and writes the Google address back as the Talentech ID email.
What the integration does
Organisations that use Talentech PeopleCore as their HR system and Google Workspace as their workplace often let employees sign in to Talentech ID through Google. IT still creates the Google account by hand, and the address in Talentech ID must match it exactly.
- HR completes the profile of a new employee in PeopleCore, with contract and position.
- KoppelHet creates the Google account in the unit of entity and location, suspended until the start date.
- The Google address goes back to PeopleCore as business email and as the Talentech ID email.
- A new position adjusts job title, department, unit and manager in Google.
- After the end date from the resignation application KoppelHet suspends the account.
What to watch for with Talentech and Google Workspace
- For signing in to Talentech ID with Google, the Google administrator creates a SAML app with the primary Google address as Name ID. The address in Talentech ID must therefore equal the Google address. KoppelHet writes the new Google address back to Talentech ID through the API, so sign-in works from the first day.
- Talentech has a SCIM API for user management, but calls it not a full SCIM implementation and built mainly for Entra ID. KoppelHet works from PeopleCore; the HR data decides the Google account, and only the address goes back to Talentech ID.
- A manager is stored in PeopleCore as a superior position. KoppelHet looks up who holds that position and sets their Google address as manager. If the position is vacant, KoppelHet picks the position above, so the org chart in Google gets no gap.
- A position in PeopleCore has a legal entity and a location. KoppelHet translates that combination into an organisational unit in Google, so policies for apps and devices can differ per country or site.
- An employee still in draft in PeopleCore gets no Google account. Only when HR completes the profile and there is a contract does KoppelHet create the account, so a candidate who drops out does not take up a licence.
- A resignation application in PeopleCore has a last working day and an end date of employment. KoppelHet suspends the Google account after the end date, or already after the last working day if you want, for example during garden leave.
- PeopleCore cannot query employees by modification date, and we found no notifications for this data. KoppelHet keeps the previous state and compares every hour, so Google only receives real changes and no account is updated needlessly.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Must the domain be verified in Talentech?
For user management through Talentech ID, Talentech requires a verified primary domain. We arrange that at the start with your Talentech contact.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Talentech PeopleCore API (api.talentech.io/peoplecore) with a JWT from the token service (client credentials) and scopes peoplecore-employees:read and :write, peoplecore-positions:read, peoplecore-contracts:read and peoplecore-resignations:read. GET /v1/Employees (isDrafted, talentechIdEmail, businessContactInformation.businessEmail, positionId), /v1/Positions (jobTitle, departmentId, locationId, legalEntityId, superiorPositionId, isVacant), /v1/EmployeeResignApplications (lastDayOfWork, employmentEndDate). Writing back with PATCH /v1/Employees/{employeeId} and PUT /v1/Employees/{employeeId}/TalentechIdEmail.
- Google SSO for Talentech ID through a custom SAML app in the Google Admin console (Name ID format EMAIL from Primary email; attributes email, given_name and family_name). To Google through the Admin SDK Directory API (users with externalIds, name, primaryEmail, password, orgUnitPath, organizations, relations type manager and suspended) with a service account with domain-wide delegation.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Talentech | Field in Google Workspace | Notes |
|---|---|---|
employeeId | externalIds (type organization) | |
Voornaam en achternaam | name.givenName en name.familyName | |
Naamgevingsregel | primaryEmail | |
jobTitle (positie) | organizations.title | |
departmentId (positie) | organizations.department en groepen | |
legalEntityId en locationId (positie) | orgUnitPath | |
Medewerker op superiorPositionId | relations (type manager) | |
employmentEndDate (ontslagaanvraag) | suspended = true | |
primaryEmail (Google) | businessEmail en talentechIdEmail |
Related
Recruitee → Talentech
Recruitee to Talentech integration: hired candidates with a contract on a position in Talentech
Talentech → Active Directory
Talentech to Active Directory integration: accounts in your own domain from PeopleCore
Talentech → ADP iHCM
Talentech to ADP iHCM integration: salaries and resignations from PeopleCore to Dutch ADP payroll
Talentech → AFAS Profit
Talentech to AFAS integration: employees, contracts and salaries from Talentech PeopleCore in AFAS