Identity and access management
Zoho People to SailPoint integration: Zoho People as the authoritative source in SailPoint
With an integration between Zoho People and SailPoint, SailPoint gets an identity for every employee from Zoho People with department, designation, location, manager and a lifecycle state that follows from the start date and the Date of Exit. KoppelHet reads the Zoho People API and delivers the employees as a file to an authoritative source in SailPoint.
What the integration does
Organisations that use Zoho People for HR and SailPoint for roles and reviews often lack an HR source in SailPoint. Without an HR source SailPoint does not know who starts or leaves, and access reviews get stuck on accounts of former colleagues.
- In the Zoho API console we create a client with only the read scope on forms.
- The SailPoint team creates a Delimited File source as authoritative source with an identity profile.
- Every hour KoppelHet reads the changed records, updates the full state and sends the file to SailPoint.
- SailPoint aggregates straight away and assigns roles on department, designation and location.
- After the Date of Exit the transform sets the identity to inactive.
What to watch for with Zoho People and SailPoint
- KoppelHet delivers to a Delimited File source, so the SailPoint team does not have to build or maintain its own connector.
- In Zoho People HR changes a leaver's status by hand, and only from the last working day. The Date of Exit is often in there earlier. KoppelHet delivers the Date of Exit as its own column, so the transform in SailPoint works on that and not on a status someone can forget.
- Zoho People returns at most two hundred records per request and can filter on changes after a point in time. An authoritative source in SailPoint must still get the full state. Every hour KoppelHet only requests the changes, uses them to update its own full state and sends that as a file.
- Reporting To in Zoho People is a reference to another employee record. SailPoint links the manager through manager correlation to an account in the same source. KoppelHet therefore puts the manager's Employee ID in the column, so approvals and certifications land with the right person.
- The email field in Zoho People is also the Zoho login and can be a private address for a new colleague. SailPoint requires an email address but does not check whether it is a work address. KoppelHet checks the domain and otherwise fills the work address following the naming rule.
- Department, designation and location sit in a form the Zoho administrator can change. If they rename a department, all roles that run on the old name lose their members. KoppelHet reports a new or vanished value before the file goes to SailPoint.
- Zoho People blocks the whole environment for five minutes above four hundred requests per minute. KoppelHet spreads the nightly full request over the pages of two hundred, so other integrations with Zoho People do not come to a halt.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
What rights does KoppelHet get in SailPoint?
Only the rights to update this one source.
Does salary data go to SailPoint?
No. The client only reads the employee form, and the file only contains identity fields.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Zoho People API with OAuth 2.0 (Authorization: Zoho-oauthtoken) and scope ZOHOPEOPLE.forms.READ: GET /people/api/forms/employee/getRecords with sIndex, limit (at most 200) and modifiedtime in milliseconds; four hundred requests per minute, above that a five-minute block.
- SailPoint Identity Security Cloud with a Delimited File source as authoritative source; delivery through the import-accounts API, which starts the aggregation. Required attributes uid, email and lastname; Manager Name through manager correlation; Lifecycle State through a transform on startDate and endDate.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Zoho People | Field in SailPoint | Notes |
|---|---|---|
EmployeeID | uid en employeeNumber | Key of the identity |
FirstName | firstname | |
LastName | lastname | |
Werkadres of naamgevingsregel | email | |
Department, Designation en Location | department, title en location | |
Reporting To | manager | As the manager's Employee ID |
Date of Joining | startDate | |
Date of Exit | endDate |
Related
Recruitee → Zoho People
Recruitee to Zoho People integration: hired candidates in the Zoho People employee form
Teamtailor → Zoho People
Teamtailor to Zoho People integration: hired candidates as a record in the Zoho People employee form
Zoho People → Active Directory
Zoho People to Active Directory integration: HR drives the domain account, not the other way round
Zoho People → AFAS Profit
Zoho People to AFAS integration: new hires and changes to Dutch payroll