Identity and access management
Unit4 HR to SailPoint integration: employees from Unit4 ERPx as an authoritative source in SailPoint
With an integration between Unit4 HR and SailPoint, every approved employee from Unit4 ERPx becomes an identity in SailPoint, with company, organisational unit, cost centre, job, manager and the employment dates. KoppelHet delivers the Unit4 data as a file to a Delimited File source, with one row per employee and the main employment first.
What the integration does
Organisations with HR in Unit4 ERPx and SailPoint for access management often load employees into SailPoint with a report from Unit4. That report shows an employee with two employments on two rows, includes entries that are not yet approved and does not know the effective date of a transfer.
- In Unit4 a machine client is created for KoppelHet; SailPoint gets no access of its own to Unit4.
- KoppelHet fetches the changed employees with employments and relations, and skips entries in a workflow.
- KoppelHet creates one row per employee, with the values that apply on the day of delivery.
- KoppelHet loads the file into the Delimited File source, after which SailPoint updates the identities.
- After the end of the last employment the lifecycle state becomes inactive and SailPoint revokes access.
What to watch for with Unit4 HR and SailPoint
- An employee can have several employments at once in Unit4, and SailPoint turns a duplicate User Name into an identity exception. KoppelHet therefore creates one row per employee, with the main employment in the regular columns and the jobs of the other employments in a multi-valued column.
- In a transform SailPoint only uses the first value of a multi-valued attribute. KoppelHet therefore does not calculate the lifecycle state from a list of employments, but delivers a start date of the first and an end date of the last employment as separate columns.
- Organisational unit, cost centre and manager are stored in Unit4 as relations with a date from and to. KoppelHet puts the relation valid on that day in every file, so SailPoint only switches roles on the day of the transfer, even if HR entered it weeks earlier.
- A new employee can first sit in an approval workflow in Unit4. KoppelHet only includes them in the file once that workflow is done, so SailPoint does not create an identity with access for an entry that is still rejected.
- SailPoint finds the manager through manager correlation on an account in the same source. In Unit4 the manager is a relation to another resource number. KoppelHet replaces it with that manager's User Name, including company, so the correlation also works across companies.
- Unit4 only issues a machine client through a user with the SUPER or SYSTEM role. A SailPoint connector signing in to Unit4 itself would need those broad rights. In this setup that key stays with KoppelHet, and SailPoint only sees the file with the fields it needs.
- Unit4 recommends fetching changes from the start of the previous run, so nothing falls between two runs. KoppelHet applies those changes to its own full state and always delivers SailPoint the whole file, in which every employee appears exactly once.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
What if someone has two jobs?
The main employment determines the fixed fields; the other jobs are in a separate column that roles can use.
Does payroll data go to SailPoint?
No. Only name, company, organisation, job, manager, work email and the employment dates.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Unit4 ERPx through the ObjectAPI (GET /v1/objects/employees) with OAuth 2.0 client credentials through Unit4 Identity Services (scope u4erp, M2M user with role SUPER or SYSTEM). Incremental with a filter on lastUpdated ge the start of the previous run; fields include companyId, personId, nameInformation, status, employments and relatedValues with date from and to; an entry in workflow returns 202.
- SailPoint Identity Security Cloud with a Delimited File source as authoritative source (multi-valued attributes supported). Required identity attributes uid (unique across all profiles), email and lastname; Manager Name with manager correlation; Lifecycle State through a transform on the dates.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Unit4 HR | Field in SailPoint | Notes |
|---|---|---|
companyId + personId | uid (User Name) | Unique across all companies |
E-mail uit Unit4 of naamgevingsregel | email (Work Email) | |
nameInformation (achternaam) | lastname | |
nameInformation (voornaam) | firstname | |
Organisatie-eenheid en kostenplaats (relaties, op datum) | Identity attributes voor eenheid en kostenplaats | |
Functie van het hoofddienstverband | Identity attribute voor functie | |
Functies van overige dienstverbanden | Meerwaardige kolom voor rollen | |
Leidinggevende (relatie) | Manager Name | As the manager's uid |
Begin- en einddatum van de dienstverbanden | Lifecycle State (via transform) |
Related
Greenhouse → Unit4 HR
Greenhouse to Unit4 HR integration: accepted offer as an employee in the right Unit4 company
Recruitee → Unit4 HR
Recruitee to Unit4 HR integration: hired candidate as employee in Unit4, validated before it is saved
SmartRecruiters → Unit4 HR
SmartRecruiters to Unit4 HR integration: hire on the position from SmartRecruiters, with onboarding status back
Teamtailor → Unit4 HR
Teamtailor to Unit4 HR integration: hired candidates as employees in Unit4 ERPx, with company and position