Identity and access management
Zoho People to Google Workspace integration: Google accounts based on HR, not on app assignment
With an integration between Zoho People and Google Workspace, a new employee from Zoho People gets a Google account with department, job title, location and manager, and the account is suspended after the last working day from the offboarding process in Zoho People. Zoho Directory can create Google accounts itself when IT assigns a user to the Google Workspace app; KoppelHet comes in when the account must follow what HR records in Zoho People.
What the integration does
Organisations that use Zoho People as their HR system and Google Workspace as their workplace often look at Zoho Directory first. There a Google account only appears when IT assigns the app, while HR keeps the start and departure date in Zoho People.
- HR records a new employee in Zoho People with department, job title, location and start date.
- KoppelHet creates the Google account in the unit of the location, suspended until the start date.
- The Google address goes back to Zoho People, in the field you choose for it.
- Changes in department, job title or manager go through every fifteen minutes.
- After the last working day KoppelHet suspends the account; after the retention period the files go to the manager.
What to watch for with Zoho People and Google Workspace
- Zoho Directory creates a Google account when a user is assigned to the Google Workspace app. With the Delete Users option on, Zoho Directory deletes the Google account again when the assignment lapses, including mail and Drive. KoppelHet suspends first on departure and only deletes after transferring the files.
- In Zoho Directory the status in Google follows the status in Zoho Directory itself, and IT manages that. A departure in Zoho People therefore only reaches Google if someone also disables the user in Zoho Directory. KoppelHet reads the Date of Exit directly from Zoho People.
- For provisioning from Zoho Directory a Google administrator must sign in with the same email address as in Zoho Directory. KoppelHet uses a service account with domain-wide delegation, so the integration does not depend on a personal administrator account.
- A Zoho People administrator chooses whether the Date of Exit is filled when a resignation is approved, or only on the last working day. In the first case KoppelHet schedules the suspension ahead; in the second KoppelHet suspends as soon as the date appears.
- By default Zoho People closes a leaver's own login at half past eight in the morning after the last working day. KoppelHet suspends the Google account in the night before, so Gmail and Drive do not stay open longer than Zoho People itself.
- Zoho People returns at most two hundred employees per request and can filter on changes after a point in time. Asking too much gets you blocked for five minutes. KoppelHet requests only the changes every fifteen minutes, so other Zoho integrations are not hit by a block.
- The email field in Zoho People is also the login for Zoho People. Writing the Google address back there therefore changes the employee's sign-in. We agree per customer whether KoppelHet fills that field or a separate field for the work email, with Zoho's separate write scope.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Can't we just use Zoho Directory?
Zoho Directory creates and deletes Google accounts based on assignment by IT. If you want accounts to follow the start and departure date from Zoho People, KoppelHet handles that.
What happens to a leaver's mail and files?
The account is suspended first. After the retention period the files go to the manager and only then is the account deleted.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Zoho People API with OAuth 2.0 (header Authorization Zoho-oauthtoken). Read through GET /people/api/forms/employee/getRecords with sIndex, limit (maximum 200) and modifiedtime, scope ZOHOPEOPLE.forms.READ; a five-minute block when exceeded. Write back through POST /api/forms/json/employee/updateRecord, scope ZOHOPEOPLE.forms.UPDATE. Data centre zoho.com or zoho.eu per customer.
- To Google through the Admin SDK Directory API (users with externalIds, name, primaryEmail, password on creation, orgUnitPath, organizations, relations type manager and suspended; groups and members) and the Data Transfer API, with a service account with domain-wide delegation.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Zoho People | Field in Google Workspace | Notes |
|---|---|---|
EmployeeID | externalIds (type organization) | |
First Name en Last Name | name.givenName en name.familyName | |
Naamgevingsregel | primaryEmail | |
Designation | organizations.title | |
Department | organizations.department en groepen | |
Location | orgUnitPath | |
Reporting To | relations (type manager) | |
Date of Exit | suspended = true | |
primaryEmail (Google) | Werkadres in Zoho People |
Related
Recruitee → Zoho People
Recruitee to Zoho People integration: hired candidates in the Zoho People employee form
Teamtailor → Zoho People
Teamtailor to Zoho People integration: hired candidates as a record in the Zoho People employee form
Zoho People → Active Directory
Zoho People to Active Directory integration: HR drives the domain account, not the other way round
Zoho People → AFAS Profit
Zoho People to AFAS integration: new hires and changes to Dutch payroll