# Provisioning

The SuccessFactors SaaS connector supports provisioning, allowing you to create and manage accounts and entitlements in SuccessFactors directly from SailPoint.

**Prerequisite:** Your system is configured for provisioning.

When SailPoint provisions new accounts to the source, it uses the attributes on the **Create Account** page as instructions or a template for what to include in the account. This page is also referred to as the *provisioning policy*.

When new access is granted on a source where a user does not already have an account, SailPoint automatically includes account creation in the provisioning. This applies whether provisioning is started from an access request or from an automated role or lifecycle state assignment.

For direct-connect sources, SailPoint automatically creates the account from this configuration. If the source is not configured as a direct-connect source, SailPoint creates and assigns a provisioning task to the source owner and includes the values for the source owner to use in manually creating the account.

> [!IMPORTANT]
>
> This section describes the default **Create Account** configuration. SailPoint recommends that you work with Services to define a provisioning configuration specific to your company's needs. Be sure to verify large changes to the provisioning policy before implementation. Failure to do so might cause provisioning to fail.

This topic contains information about the attributes supported by the connector's provisioning processes.

The attributes in the following list are only applicable for Users.

> [!CAUTION]
>
> Do not delete default User-specific attributes that you are provisioning from the account schema as they are required for provisioning operations.

- Username
- User.Status
- User.FirstName
- User.Email
- User.EmailType

  > **Note**
  >
  > Type of email address for the external user. If no value is provided, the attributes defaults to **O**. The possible values are:
  >
  > - **P** - Personal
  > - **B** - Business
  > - **O** - Other

## Default Update Account Attributes

The Update operation is supported for the attributes listed in the following table.

> [!NOTE]
>
> Onboarding Users in SAP SuccessFactors can have different statuses from one another. By default, the connector supports Onboarding Users with `d` and `e` statuses for the attributes listed as **Yes** in the **Onboarding Users** column below.

| Attribute | Users | Onboarding Users | Employees | Description |
| --- | --- | --- | --- | --- |
| Username | Yes | Yes | Yes | The user's username |
| User.Status | Yes | Yes | No | The user's status |
| User.FirstName | Yes | Yes | No | The user's first name |
| User.LastName | Yes | Yes | No | The user's last name |
| User.Email | Yes | Yes | No | The user's email address |
| User.EmailType | Yes | Yes | No | Type of email address for the external user. If no value is provided, the attributes defaults to **O**. The possible values are as follows: **P** - Personal, **B** - Business, **O** - Other. This attribute is mandatory and only applicable for Active or Inactive external users. |
| PrimaryEmailAddress | Yes | No | Yes | The user or employee's primary email address |
| BusinessPhone | Yes | Yes | Yes | The user or employee's business phone number |
| BusinessExtension | Yes | Yes | Yes | The user or employee's business phone number extension |
| BusinessPhoneCountryCode | Yes | Yes | Yes | The user or employee's business phone number country code |
| Person ID External | Yes | No | Yes | The person's unique identifier |
| IsContingentWorker | Yes | No | Yes | Indicates whether the Employee is Contingent Worker or not |
| Salutation | Yes | No | No | The person's salutation |
| FirstName | Yes | No | No | The person's first name |
| LastName | Yes | No | No | The person's last name |
| Date Of Birth | Yes | No | No | The person's date of birth |
| Gender | Yes | No | No | The person's gender |
| Country | Yes | No | No | The person's country of residence |
| Nationality | Yes | No | No | The person's nationality |
| Fax | Yes | No | No | The person's fax number |
| ServiceDate | Yes | No | No | The person's service start date |

> [!NOTE]
>
> For a user that does not have any employment data associated, the following attributes can't be updated:
>
> - Primary email address
> - Business Phone
> - Country code
> - Extension

## Provisioning of Email, Phone, and Username Attributes

The SuccessFactors connector can provision the following attributes:

- Business Phone
- BusinessExtension
- BusinessPhoneCountryCode
- Username
- PrimaryEmailAddress

The SuccessFactors connector considers the user's primary email address and business phone number as primary modes of communication.

### Configure the Connector to Provision Email, Phone, and Username Attributes

Provisioning the email address and phone number is based on the OData Queries that use the Picklist Option ID as an input.

> [!NOTE]
>
> The picklist mapping is for the attribute update only. For multiple entries, press **Enter** to separate them. For example:
>
> ```text
> PrimaryEmailAddress=<Associated Picklist optionID>
> BusinessPhone=<Associated Picklist optionID>
> ```

To enter picklist mappings of these attributes for provisioning:

1. In the SailPoint source configuration, go to **Advanced Settings**.
2. In the **Picklist Mapping** field, enter the picklist mapping of attribute.

### Attribute Configuration in the SuccessFactors Connector

If you want to change the Picklist Option ID, update the `picklistMapping` attribute using the REST API:

```text
POST <url>/sources/<sourceID>
```

Where:

- **\<url\>** - The URL for the customer's SailPoint tenant
- **\<sourceID\>** - The Source ID (number) obtained through the UI

In the body of the POST, use form-data as follows:

- **Key** - `connector_picklistMapping`
- **Value** - `["PrimaryEmailAddress=optionID","BusinessPhone=optionID"]`

For example,

```text
["PrimaryEmailAddress=8448","BusinessPhone=10605"]
```

> [!NOTE]
>
> For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1/>) in the SailPoint Developer Community.

### Attribute Synchronization and Target Mapping

You must get the source ID before synchronizing attributes. The source ID is displayed at the end of the URL in your browser address. The source ID is also known as the front-end ID for a source.

For more information, refer to [Best Practices: Attribute Sync](<https://community.sailpoint.com/knowledge/Best-Practices-Attribute-Sync>).

You can add the user name, phone numbers, and email attributes and map these source attributes to identity attributes.

> [!NOTE]
>
> This API does not apply to flat file sources.

Then you can map those identity attributes to the SuccessFactors target system attributes using the REST API:

```text
POST <url>/sources/<sourceID>
```

Where:

- **\<url\>** - The URL for the customer's SailPoint tenant
- **\<sourceID\>** - The Source ID (number) obtained through the UI

In the body of the POST, use form-data as follows:

- **Key** - `connector_featureString`
- **Value** - `SEARCH, PROVISIONING, SYNC_ PROVISIONING, MANAGER_LOOKUP`

> [!NOTE]
>
> For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1/>) in the SailPoint Developer Community.

To get and set the attribute synchronization mapping:

1. Make a GET request with the following command:

   ```text
   GET <url>/sources/<source_ID>/attribute-sync-config
   ```
2. Set the target value with the following command:

   ```text
   PUT <url>/sources/<sourceID>/attribute=sync-config
   ```

To set up the `PrimaryEmailAddress`, `BusinessPhone`, and `Username` as target attributes, use the following command in the body:

```json
{
    "attributes": [
        {
            "name": "email",
            "displayName": "att_email",
            "enabled": true,
            "target": "PrimaryEmailAddress"
        },
        {
            "name": "workPhone",
            "displayName": "Work Phone Number",
            "enabled": true,
            "target": "BusinessPhone"
        },
        {
            "name": "uid",
            "displayName": "uid",
            "enabled": true,
            "target": "Username"
        },
        {
            "name": "PhoneCountryCode",
            "displayName": "PhoneCountryCode",
            "enabled": true,
            "target": "BusinessPhoneCountryCode"
        },
        {
            "name": "PhoneExtension",
            "displayName": "PhoneExtension",
            "enabled": true,
            "target": "BusinessExtension"
        }
    ]
}
```

## Provisioning Additional Attributes Using the ODATA API

The SuccessFactors connector can provision additional attributes for `/User`, `/EmpJob`, and `/EmpEmployment` ODATA APIs. Currently, this is supported only in the Update operation.

> [!NOTE]
>
> - User attributes must use the `User` prefix. For example, `User.city`.
> - EmpJob attributes must use the `EmpJob` prefix. For example, `EmpJob.managerId`.
> - EmpEmployment attributes must use the `EmpEmployment` prefix. For example, `EmpEmployment.isContingentWorker`.

To find the supported attributes you want to add:

1. In the SuccessFactors managed system, go to **Admin Center**.
2. Search for and then select, **ODATA API DATA Dictionary**.
3. Search for `User`, `EmpJob`, or `EmpEmployment`.

   A list of supported attributes displays.
4. Check `column sap:upsertable`, the value should be `true`.
5. Copy the attribute names.