Identity and access management
Visma Peple to SailPoint integration: employees, contracts and replacements from Peple as an authoritative source
With an integration between Visma Peple and SailPoint, every employee from Peple becomes an identity in SailPoint, with organisational unit, job, manager and a lifecycle state that follows from contracts and replacements. KoppelHet delivers a complete file that SailPoint can read without a Peple connector of its own, without BSN or personal data.
What the integration does
Organisations that use Visma Peple for HR and SailPoint for access management often load employees into SailPoint through a manual export. That export has no substitutes, misses employees with contracts at several units and lags behind Peple.
- In Visma Connect KoppelHet gets a client with only the export scopes for employees, contracts, organisational units and replacements.
- KoppelHet keeps a complete state of all employees with incremental exports and one full export per night.
- KoppelHet reports employees without a work email or with an unknown manager to HR.
- KoppelHet loads the file into the Delimited File source in SailPoint, after which SailPoint updates the identities.
- SailPoint calculates the lifecycle state from the dates and revokes access when contract or replacement has ended.
What to watch for with Visma Peple and SailPoint
- Peple allows two full exports per day per resource per tenant, and also offers incremental exports. A Delimited File source in SailPoint expects all accounts at every aggregation. KoppelHet builds that full state itself from the incremental exports and checks it every night against one full export.
- Peple has a separate export for replacements, with start and end date. KoppelHet puts those dates in the file next to the contract dates, so the transform in SailPoint only makes a substitute active while the replacement runs.
- An employee can have contracts at several organisational units in Peple. SailPoint only uses the first value of a multi-valued attribute in a transform. KoppelHet therefore delivers the unit of the main contract as a separate column, and all units in a separate multi-valued column for the roles.
- In Peple the manager is a user ID on the contract. SailPoint links a manager through manager correlation on that person's account in the same source. KoppelHet therefore puts the manager's employee number in the file, and reports it if it cannot be found.
- SailPoint requires a work email for every identity, but does not check whether it is a valid address. Peple returns the business address without an extra scope. KoppelHet checks the address itself and does not request the scopes for private contact details and BSN, so no private address ends up in SailPoint as the work email.
- Organisational units in Peple have a parent unit and their own start and end dates. KoppelHet puts the full path of the unit in the file, so SailPoint roles can work at board or location level, and leaves out units that have been closed.
- On Saturday evening Peple temporarily refuses exports for maintenance. KoppelHet then leaves the previous file in place instead of loading a partial file, so SailPoint does not see employees as gone.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Does a substitute get their own identity?
Yes, with a lifecycle state that is only active during the replacement.
Do BSN or personal data reach SailPoint?
No. KoppelHet does not request the scopes for contact and tax data.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Peple through the Visma.net HRM & Payroll Reporting API (Visma Connect client credentials) with scopes for the exports of employees, contracts, organizationunits and employeereplacement (POST command, GET query on jobId); incremental with changeTimestampAfter; two full refreshes per endpoint per tenant per 24 hours; 503 with Retry-After during maintenance. No exportcontactinformation or exporttaxinformation.
- SailPoint Identity Security Cloud with a Delimited File source as authoritative source (multi-valued attributes supported). Required identity attributes uid, email and lastname; Manager Name with manager correlation; Lifecycle State through a transform on contract and replacement dates.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Visma Peple | Field in SailPoint | Notes |
|---|---|---|
Personeelsnummer | uid (User Name) | |
businessemailaddress of naamgevingsregel | email (Work Email) | |
Achternaam en partnername volgens nameusage | lastname | |
Voornaam | firstname | |
Orgunit van het hoofdcontract (pad via orgunitparentid) | Identity attribute voor eenheid | |
Orgunits van alle lopende contracten | Meerwaardige kolom voor rollen | |
functionname en costcenter | Identity attributes voor functie en kostenplaats | |
manageruserid | Manager Name | As employee number, for manager correlation |
Contract- en vervangingsdatums | Lifecycle State (via transform) |
Related
Visma Peple → Active Directory
Visma Peple to Active Directory integration: accounts from Peple HRM & Payroll
ASVisma Peple → Arbodienst (SIVI)
Visma Peple to occupational health service via SIVI: sick and recovery notifications from Peple to the health service
Visma Peple → Microsoft Entra ID
Visma Peple to Entra ID integration: Microsoft accounts from Peple HRM & Payroll
Visma Peple → Exact Online
Visma Peple to Exact Online integration: cost centres ready in Exact and employee changes on a worklist