Integrating SailPoint with SuccessFactors

Integration

This is an integration and requires additional licensing or subscriptions to utilize it. For more information, contact your customer success manager.

Connecting SailPoint to your SAP SuccessFactors Employee Central module allows you to seamlessly automate your joiner, mover, and leaver functions. This guide provides the information you need to configure bidirectional usage of SuccessFactors in SailPoint either as a managed resource or a source of identity data. You can use this connector to manage both users and employees.

Employee Central and user management modules must be enabled in SuccessFactors to use this SailPoint connector. For additional prerequisites, refer to Prerequisites.

Note

To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the SaaS Release Notes page.

Supported Features

The SuccessFactors connector supports the following features:

Full account aggregation
Single account aggregation
Full entitlement aggregation
Add entitlement(s) (only Static groups)
Remove entitlement(s) (only Static groups)
Delta aggregation for employees / users with employment
Multiple group objects.

The Group and Role entitlement objects are supported.

Note

Role entitlements are SuccessFactors permission roles from Manage Permission Roles (RBP).
Onboarding User aggregation and provisioning

Note

User aggregation only supports Onboarding users with e status (active_external_suite) or d status (inactive_external_suite). For more information on provisioning Onboarding users, refer to Default Update Account Attributes.
Onboarding Pre-Hire aggregation and provisioning under account types Employees

Note

To fetch Pre-Hire onboarding 2.0 should be enabled in SuccessFactors.
Create account provisioning
Update account provisioning
Enable and disable accounts through provisioning
Change account password

For more information on features, refer to Source Features.

The SuccessFactors connector supports the following features based on account types:

Operations	Users	Employees
Aggregation	Yes	Yes
Get Account	Yes	Yes
Create	Yes	No
Update*	Yes	Yes
Delete	No	No
Enable/Disable Users	Yes	No
Set Password	Yes	No
Add/Remove Entitlements (Static Group)	Yes	Yes

Aggregated Data

SailPoint aggregates the following information:

person
personal_information
address_information
email_information
phone_information
employment_information
job_information

Prerequisites

Configure at least one virtual appliance cluster and successfully test the connection. For more information, refer to the Virtual Appliance Reference Guide.
To perform connection tasks, you must have the following permissions:

Category Permission

Meta Data Framework Admin access to MDF OData API

Manage Integration Tools Manage OAuth2 Client Application

Note

The SuccessFactors connector may have certain restrictions to external IP addresses. As a result, it may not be able to make the API calls required for some connector features. Work with your SAP administrators to remove these restrictions as required.

Important

Employee Central and user management modules must be enabled in SuccessFactors to use the SailPoint connector.

Required Permissions

Certain operations may require specific permissions for the SuccessFactors service account. The operations are listed below along with the necessary permissions.

Operation	Required Permissions
Test Connection	Test Connection Permissions
Aggregation	Test Connection and Aggregation Permissions
Provisioning	Test Connection, Aggregation, and Provisioning Permissions

Assigning Permissions to a Role in SuccessFactors

These steps provide the basic information for assigning permissions to a role in SuccessFactors. For current detailed information about role-based permissions, refer to the SuccessFactors User Assistance Documentation.

In the Permission Settings section, select the Permission button to specify the permission you want to assign to the role.

The Permission Settings window displays.
The available permission categories are listed on the left side of the page. Select a permission category to view the different available permissions.
Select the permissions you'd like to grant to the role.
Go to Role Assignments and select Add Role Assignment, then provide the name and target population. For example, you can select Everyone with an Active status.
Select Done when you finish marking your selections.
Select Save Changes.

Test Connection Permissions

Category	Permission
General User Permission	SFAPI User Login
Employee Central API	Employee Central HRIS SOAP API

Aggregation Permissions

Note

The Manage Role-Based Permission Access permission is needed to fetch Roles and Group objects. If you do not want to provide the Manage Role-Based Permission Access permission, Roles and Groups attributes need to be removed from the account schema object.
The Manage User to Employee Export permission does not need to be provided on the service account if you only want to aggregate users from the SuccessFactors system and not the employees. If this is the case you must add the General User Permission to Company Info Access > User Search mandatory permission.

Category	Permission
Manage User	Employee Export
Metadata Framework	Admin Access to MDF OData API
Manage System Properties	Picklist Management and Picklists Mappings Set Up
Employee Central API	Employee Central Foundation OData API (read-only)
Employee Central API	Employee Central HRIS OData API (read-only)
NA	Manage Role-Based Permission Access
General User Permission	Company Info Access > User Search. For more information, refer to Aggregating External Users.

Provisioning Permissions

Category	Permission
Employee Central Import Settings	Import Employee Data
Employee Central API	Employee Central HRIS OData API (editable)

Providing Permissions to Service Accounts

To perform entitlement aggregation, follow these steps in SuccessFactors to provide Manage Role-Based Permission Access to the service account:

In SuccessFactors, go to Admin Center and search for Manage Role-Based Permission Access.
Select Add User.
Search through User Name and select the required user.
Select Grant Permission.

Aggregating External Users

To aggregate external users, add the User Search permission to the role along with all required permissions. Once you have granted permissions to the given role, perform the following steps:

Go to Admin Center and search for Manage Permission Roles.
Select the permissions role you created.
Create a new Add Role Assignment separately for External Users.
Go to the grant this role to section.
Select Add for external target population.
Go to Define whom you want to grant this role permission to, and then select Permission Group.
Go to Specify the target population whom the above granted users have permission to access, and then in the Target Population section, select the User Type as External Onboarding User.
Select External Onboarding User.
Select Done and Save the changes.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.

Category	Permission
Meta Data Framework	Admin access to MDF OData API
Manage Integration Tools	Manage OAuth2 Client Application