Identity and access management
YouForce to SailPoint integration: Visma Raet as the authoritative source for roles
With an integration between Visma Raet YouForce and SailPoint Identity Security Cloud, YouForce becomes the authoritative HR source, so SailPoint has one identity per employee with job, organisational unit, manager and lifecycle. Roles then follow hiring, transfers, temporary assignments and departures in YouForce.
What the integration does
Organisations that base access on roles with SailPoint and use YouForce for HR make those roles depend on job and department. Employees temporarily working in another team now get their extra access through separate requests.
- The organisation grants KoppelHet read access to the basic data in YouForce through Visma.
- KoppelHet merges each person's employments, role assignments and temporary assignments into one record.
- KoppelHet delivers the data to the SailPoint source and starts processing straight away.
- SailPoint determines lifecycle and roles, including the extra roles for a temporary assignment, and creates or changes the accounts in the target systems.
- After the end of the last employment KoppelHet delivers the employee as inactive, so SailPoint revokes access.
What to watch for with Visma Raet YouForce and SailPoint
- SailPoint expects one identity per person, while YouForce can hold several employments per person. KoppelHet delivers one record with the main employment's data and a list of all organisational units, so roles can be based on both.
- A temporary assignment places someone with another team in YouForce without changing the employment. KoppelHet includes that unit in the list while the assignment runs, so SailPoint grants a role for that team and revokes it on the end date, without a separate request.
- YouForce leaves persons out of the IAM data after a set period. KoppelHet keeps delivering a leaver as inactive, so SailPoint bases the lifecycle on the end date and not on disappearing from the source.
- The manager is recorded in YouForce as a role on the organisational unit. KoppelHet translates that role into a manager for each employee, so certification campaigns in SailPoint reach the actual manager.
- YouForce comes in two variants, Beaufort and Business, and they do not supply the same fields. Beaufort, for example, lacks the employer; KoppelHet then derives it from the organisational unit, so roles per employer keep working.
- YouForce shows planned changes to an employment before they are processed. KoppelHet therefore delivers a transfer to SailPoint on the effective date, not only the day after HR Core has processed it.
- SailPoint rejects an identity without a work email address. If it is not yet in YouForce, KoppelHet fills an address from the naming rule; if you want, the final address then goes back to YouForce.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Does KoppelHet also create accounts in Active Directory or Entra ID?
Not in this setup. SailPoint creates the accounts; KoppelHet makes sure SailPoint has the right HR data.
What access does KoppelHet need in YouForce?
Only read access to basic data, approved by the organisation itself through Visma. We do not request BSN or home address.
Can contractors from another system also be in SailPoint?
Yes, as a separate source in SailPoint. The order of the identity profiles decides which source wins if someone is in both.
What about the GDPR?
You are the controller and KoppelHet is the processor, under a data processing agreement. The integration only reads the fields SailPoint needs.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- YouForce is read through the Youforce IAM API with the Youforce-IAM:Get_Basic scope (persons, employments, roleAssignments, assignments, costAllocations and the endpoint for indirect changes), on latestSync. Persons outside the historicaldays are not returned. Writing back the work address requires a separate write scope.
- SailPoint Identity Security Cloud gets a Delimited File source as authoritative source; KoppelHet sends the file through the import-accounts API, which starts aggregation straight away. The identity profile calculates the lifecycle state from startDate and endDate with a transform. departments is a multi-valued attribute in the account schema.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Visma Raet YouForce | Field in SailPoint | Notes |
|---|---|---|
Persoonsnummer | uid en employeeNumber | |
Roepnaam | firstname | |
Achternaam volgens gebruik achternaam | lastname | Required in SailPoint |
Zakelijk e-mailadres of naamgevingsregel | email | Required in SailPoint |
Functie (job profile) hoofddienstverband | jobCode en title | |
Organisatie-eenheid hoofddienstverband | department | |
Organisatie-eenheden van alle dienstverbanden en inzet | departments (lijst) | |
Rolverdeling op de organisatie-eenheid | manager | |
Werkgever | company | Not in every YouForce variant |
Begin- en einddatum dienstverbanden | startDate en endDate |
Related
ADP Workforce Now → Visma Raet YouForce
ADP Workforce Now to YouForce integration: requests for new Dutch hires and contract changes
Bullhorn → Visma Raet YouForce
Bullhorn to YouForce integration: a placement becomes a hire request
Carerix → Visma Raet YouForce
Carerix to YouForce integration: a placed candidate starts the hire workflow in YouForce
Darwinbox → Visma Raet YouForce
Darwinbox to YouForce integration: hires and pay changes from Darwinbox as a request in YouForce