# Integrating SailPoint with SuccessFactors SaaS

> [!NOTE]
>
> **Integration**
>
> This is an integration and requires additional licensing or subscriptions to utilize it. For more information, contact your customer success manager.

Connecting SailPoint to your SAP SuccessFactors Employee Central module allows you to seamlessly automate your joiner, mover, and leaver functions. This guide provides the information you need to configure bidirectional usage of SuccessFactors SaaS in SailPoint either as a managed resource or a source of identity data. You can use this connector to manage both users and employees.

Employee Central and user management modules must be enabled in SuccessFactors to use this SailPoint connector. For additional prerequisites, refer to [Prerequisites](<#prerequisites>).

> [!NOTE]
>
> To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes](<https://community.sailpoint.com/release-notes/saas>) page.

## Supported Features

The SuccessFactors SaaS connector supports the following features:

- Full account aggregation
- Single account aggregation
- Full entitlement aggregation
- Add entitlement(s) (only Static groups)
- Remove entitlement(s) (only Static groups)
- Delta aggregation for employees / users with employment
- Multiple group objects.

  The `Group` and `Role` entitlement objects are supported.

  > **Note**
  >
  > Role entitlements are SuccessFactors permission roles from Manage Permission Roles (RBP).
- Onboarding User aggregation and provisioning

  > **Note**
  >
  > User aggregation only supports Onboarding users with `e` status (`active_external_suite`) or `d` status (`inactive_external_suite`). For more information on provisioning Onboarding users, refer to [Default Update Account Attributes](<https://documentation.sailpoint.com/connectors/successfactors/saas/help/provisioning.html#default-update-account-attributes>).
- Onboarding Pre-Hire aggregation and provisioning under account types Employees

  > **Note**
  >
  > To fetch Pre-Hire onboarding 2.0 should be enabled in SuccessFactors.
- Create account provisioning
- Update account provisioning
- Enable and disable accounts through provisioning
- Change account password

For more information on features, refer to [Source Features](<https://community.sailpoint.com/knowledge/Identity-Security-Cloud-Source-Features>).

The SuccessFactors SaaS connector supports the following features based on account types:

| Operations | Users | Employees |
| --- | --- | --- |
| Aggregation | Yes | Yes |
| Get Account | Yes | Yes |
| Create | Yes | No |
| Update\* | Yes | Yes |
| Delete | No | No |
| Enable/Disable Users | Yes | No |
| Set Password | Yes | No |
| Add/Remove Entitlements (Static Group) | Yes | Yes |

### Aggregated Data

SailPoint aggregates the following information:

- person
- personal\_information
- address\_information
- email\_information
- phone\_information
- employment\_information
- job\_information

## Prerequisites

- To perform connection tasks, you must have the following permissions:

  | Category | Permission |
  | --- | --- |
  | Meta Data Framework | Admin access to MDF OData API |
  | Manage Integration Tools | Manage OAuth2 Client Application |

> [!NOTE]
>
> The SuccessFactors SaaS connector may have certain restrictions to external IP addresses. As a result, it may not be able to make the API calls required for some connector features. Work with your SAP administrators to remove these restrictions as required.

> [!IMPORTANT]
>
> Employee Central and user management modules must be enabled in SuccessFactors to use the SailPoint connector.

## Required Permissions

Certain operations may require specific permissions for the SuccessFactors service account. The operations are listed below along with the necessary permissions.

| Operation | Required Permissions |
| --- | --- |
| Test Connection | [Test Connection Permissions](<#test-connection-permissions>) |
| Aggregation | [Test Connection](<#test-connection-permissions>) and [Aggregation Permissions](<#aggregation-permissions>) |
| Provisioning | [Test Connection](<#test-connection-permissions>), [Aggregation](<#aggregation-permissions>), and [Provisioning Permissions](<#provisioning-permissions>) |

### Assigning Permissions to a Role in SuccessFactors

These steps provide the basic information for assigning permissions to a role in SuccessFactors. For current detailed information about role-based permissions, refer to the [SuccessFactors User Assistance Documentation](<https://apps.support.sap.com/sap/support/knowledge/en/2116024>).

1. In the **Permission Settings** section, select the **Permission** button to specify the permission you want to assign to the role.

   The **Permission Settings** window displays.
2. The available permission categories are listed on the left side of the page. Select a permission category to view the different available permissions.
3. Select the permissions you'd like to grant to the role.
4. Select **Done** when you finish marking your selections.
5. Select **Save Changes**.

### Test Connection Permissions

| Category | Permission |
| --- | --- |
| General User Permission | SFAPI User Login |
| Employee Central API | Employee Central HRIS SOAP API |

### Aggregation Permissions

> [!NOTE]
>
> - The **Manage Role-Based Permission Access** permission is needed to fetch Roles and Group objects. If you do not want to provide the **Manage Role-Based Permission Access** permission, Roles and Groups attributes need to be removed from the account schema object.
> - The **Manage User** to **Employee Export** permission does not need to be provided on the service account if you only want to aggregate users from the SuccessFactors system and not the employees. If this is the case you must add the **General User Permission** to **Company Info Access \> User Search** mandatory permission.

| Category | Permission |
| --- | --- |
| Manage User | Employee Export |
| Metadata Framework | Admin Access to MDF OData API |
| Manage System Properties | Picklist Management and Picklists Mappings Set Up |
| Employee Central API | Employee Central Foundation OData API (read-only) |
| Employee Central API | Employee Central HRIS OData API (read-only) |
| NA | Manage Role-Based Permission Access |
| General User Permission | Company Info Access \> User Search. For more information, refer to [Aggregating External Users](<#aggregating-external-users>). |

### Provisioning Permissions

| Category | Permission |
| --- | --- |
| Employee Central Import Settings | Import Employee Data |
| Employee Central API | Employee Central HRIS OData API (editable) |

### Providing Permissions to Service Accounts

To perform entitlement aggregation, follow these steps in SuccessFactors to provide **Manage Role-Based Permission Access** to the service account:

1. In SuccessFactors, go to **Admin Center** and search for **Manage Role-Based Permission Access**.
2. Select **Add User**.
3. Search through **User Name** and select the required user.
4. Select **Grant Permission**.

### Aggregating External Users

To aggregate external users, add the User Search permission to the role along with all required permissions. Once you have granted permissions to the given role, perform the following steps:

1. Go to **Admin Center** and search for **Manage Permission Roles**.
2. Select the permissions role you created.
3. Go to the **grant this role to** section.
4. Select **Add for external target population**.
5. Go to **Define whom you want to grant this role permission to**, and then select **Permission Group**.
6. Go to **Specify the target population whom the above granted users have permission to access**, and then in the **Target Population** section, select the **User Type** as **External Onboarding User**.
7. Select **Everyone (External Onboarding User)**.
8. Select **Done** and **Save** the changes.