Identity and access management
Workday to SailPoint integration: complete HR data as the basis for access governance
With an integration between Workday and SailPoint, SailPoint receives a complete, checked list of workers from Workday, supplemented with data from local systems, so roles and access are right from the first working day. New colleagues are in SailPoint before they start, and workers with missing data are first referred to HR.
What the integration does
Organisations that govern access with SailPoint and use Workday as HR system get the basis from SailPoint's standard Workday connector. Some data the roles need is calculated in SailPoint and not refreshed on every interim update, so roles are sometimes only right after the next full processing.
- KoppelHet fetches the workers from Workday, including new colleagues who start later.
- KoppelHet calculates what the roles need, such as job code, hire date and username, and fills in from local systems where Workday lacks something.
- Workers with missing required data are held back. HR sees them in the KoppelHet platform and completes them in Workday.
- The data goes to SailPoint, which processes it immediately.
- SailPoint creates or updates identities and grants or revokes access based on roles.
What to watch for with Workday and SailPoint
- SailPoint has its own Workday connector, and for a standard situation we recommend it. KoppelHet comes in when the HR data first has to be completed or merged before SailPoint can base roles on it.
- According to SailPoint, an interim update of its Workday connector does not pick up changes in calculated data. KoppelHet calculates that data before SailPoint reads it, so an interim update includes it too.
- SailPoint's Workday connector only includes new colleagues who have not started yet in a full processing run. With KoppelHet they are included as soon as the hire is completed, so SailPoint can create an identity before the first working day.
- KoppelHet delivers the data to SailPoint as a file and has SailPoint start processing straight away, rather than waiting for the next scheduled moment.
- Workday often does not hold Dutch local data, such as the employee number from Dutch payroll. KoppelHet adds it per worker, so SailPoint has one source instead of two sources with duplicate identities.
- This delivery writes nothing back to Workday. If the work email has to go back to Workday, KoppelHet arranges that separately, or you use SailPoint's own Workday connector for it.
- In SailPoint KoppelHet only gets the rights to update this one source, and no admin rights over the whole environment.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
When do we choose SailPoint's own Workday connector?
When Workday provides all the data the roles need and no local sources have to be added. Then an extra step through KoppelHet is unnecessary, and we say so.
Who maintains the roles and rules in SailPoint?
The customer's IAM team or its SailPoint partner. KoppelHet delivers the HR data and monitors its quality.
What if required data is empty in Workday?
KoppelHet then holds that worker back and HR sees in the platform what is missing. That way SailPoint gets no identity with half the data.
Does this also work with SailPoint IdentityIQ?
The principle is the same: KoppelHet delivers a prepared HR source. How IdentityIQ reads it, we agree per customer.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Workday is read through a RaaS report with an Integration System User, including workers with a Hire that starts later. Employee_ID and Contingent_Worker_ID get a prefix per series.
- SailPoint Identity Security Cloud receives a CSV as a multipart form through the import accounts API of a Delimited File source (authoritative source), which starts the aggregation immediately. Lifecycle states prehire and inactive based on startDate and endDate. SailPoint's Workday connector only reads pre-hires with OAuth 2.0 in a full aggregation; delta aggregation does not refresh calculated attributes and custom IDs.
- API client with only the rights for import accounts, preferably as sub-admin of this source. Write-back to Workday through Workday Web Services or the account update of the Workday connector.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Workday | Field in SailPoint | Notes |
|---|---|---|
Employee_ID of Contingent_Worker_ID | Account ID (uid) | With a prefix per series, so numbers do not clash |
Preferred name | firstname en lastname | |
Naamgevingsregel | User Name | |
Work email | Work Email | Completed per the naming rule when Workday does not have it yet |
Job profile | Functiecode voor rollen | Through a lookup table to the codes the roles use |
Supervisory organization | department | |
Manager | manager | |
Company en location | company en location | |
Hire date | startDate | Basis for the prehire lifecycle state |
Termination date | endDate | Basis for the inactive lifecycle state |
Related
Ashby → Workday
Ashby to Workday integration: hires to Workday, with a check on outcome and phone number
Bullhorn → Workday
Bullhorn to Workday integration: a consultant's first placement as a hire in Workday
Carerix → Workday
Carerix to Workday integration: a placed candidate becomes a pre-hire and starts the hire
Greenhouse → Workday
Greenhouse to Workday integration: hires as pre-hires, interim staff and contractors included