> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/integrations/hris/sap-successfactors.md).
# SAP SuccessFactors
SAP SuccessFactors is a SaaS human resources solution (HRIS) used by more than 13,000 global companies to manage workforce analytics, planning, core HR features such as payroll and employee service, and talent management.
DoControl leverages data collected by SAP SuccessFactors to expedite decision making. Captured data is actor metadata, such as user employment status, groups and departments that users belong to, and other relevant metadata such as title or personal email, or the name and email of the employee's manager.
After setting up the integration, DoControl captures data from employee records to calculate specific groups that can be leveraged in workflows. These [groups](/docontrol-user-guide/saas-data-monitoring/inventory/settings-groups.md#default-hr-groups) include:
* About-to-leave employees
* Current employee personal emails
* Former employee personal emails
* Former employee work emails
## Use cases
You can leverage the DoControl-SAP SuccessFactors integration to address these use cases:
* **Get full inventory visibility** - View all SAP SuccessFactors users, departments and [HR groups](/docontrol-user-guide/saas-data-monitoring/inventory/settings-groups.md#default-hr-groups), including terminated and about-to-leave employees. In a single glance, view your organizational posture to see: how many Google assets are accessible by former employees? How many employees share with their personal emails?
* **Trigger alerts** - You can get real-time notifications when anomalous behavior occurs, such as when an about-to-leave employee performs a burst download of files and sends them to his personal email account. To see all DoControl alert types that leverage HR metadata from SAP SuccessFactors, go to **Help > DoControl Alert Specifications**:
* Possible former employee accessed assets (DC30)
* File download by about-to-leave employee (DC33)
* Possible former employee publicly shared (DC34)
* Possible former employee externally shared (DC35)
* Burst download by about-to-leave employee (DC36)
* **Remediate future data exposure** - Define security workflows to handle a specific department in your organization, and prevent about-to-leave employees from downloading or externally sharing documents.
* **Get user metadata** - You can run a query to get user metadata for specific events. For example, if an employee in your organization changes user access for a Google Drive asset so it's now publicly shared, you can choose to remove the public sharing if the employee fulfills certain criteria.
* **Monitor risky identities** - Discover your internal SaaS identities to protect your organization from identity threats in Google Workspace.
## HRIS fields for integration
The default fields DoControl extracts for the HRIS integration include:
* **Users** - User’s avatar (picture), Work email, First name, Last name, Role, Department, Manager (full name), Manager (email), Employment status, Personal home email address, Job location, End employment date, Hire date.
* **Departments** - Department name and ID
## Integrate SAP SuccessFactors with DoControl
To integrate SAP SuccessFactors with DoControl for the first time, perform these steps:
1. [Configure SAP SuccessFactors admin permissions](#id-1.-configure-sap-successfactors-admin-permissions)
* [Define user settings](#define-user-settings)
* [Define user permissions](#define-user-permissions)
2. [Register a client application](#id-2.-register-a-client-application)
3. [Run DoControl-SAP SuccessFactors integration wizard](#id-3.-run-docontrol-sap-successfactors-integration-wizard)
{% hint style="warning" %}
You must be an **admin** user to integrate SAP SuccessFactors with DoControl.
{% endhint %}
## 1. Configure SAP SuccessFactors admin permissions
A user in SAP SuccessFactors needs to create an endpoint in SAP Cloud ALM to collect data from SAP SuccessFactors.
* Create a dedicated user in SAP SuccessFactors (for example, SFAPI).
* It's recommended not to use an existing personal or admin user.
### Define user settings
To prevent the user's password from expiring, create a login exception for the SFAPI user.
1. In SAP SuccessFactors, go to **Admin Center > Password & Login Policy Settings**.
2. Click **Set API Login Exceptions**.
3. Click **Add**, and enter the user name of the SFAPI user.
4. Set **Maximum password age (days)** = -1.
5. Enter the IP address of your SAP Cloud ALM tenant.\
You can look for the IP range of your SAP Cloud ALM tenant [here](https://help.sap.com/products/BTP/65de2977205c403bbc107264b8eccf4b/f344a57233d34199b2123b9620d0bb41.html). \
You can also enter the range `1.1.1.1-255.255.255.255` to cover any possible IP address.
{% hint style="info" %}
For more information, see [How to enable SFAPI in SuccessFactors](https://me.sap.com/notes/2161909).
{% endhint %}
### Define user permissions
To assign the required permissions to your dedicated SAP SuccessFactors user (SFAPI), you need to create a new permission group and add your SFAPI user to the group.
{% hint style="info" %}
The suggested permissions might vary based on the enabled module of functionality in your SAP SuccessFactors instance.
{% endhint %}
#### Assign permissions to your dedicated user
1. In SAP SuccessFactors, go to **Admin Center > Manage Permission Groups**.
2. Click **Create New** to create a new permission group.
3. Enter a group name; for example, `SFAPI_DC_GROUP`.
4. Select **Choose Group Members > People Pool > Username**.
5. Search for your SFAPI user and click the checkbox to add it.
6. Click **Done**.
#### Create a new permission role
1. In SAP SuccessFactors, go to **Admin Center > Manage Permission Roles**.
2. Click **Create New** to create a new permission role.
3. Enter a role name; for example, `SFAPI_DC_ROLE`.
4. Under **Permission Setting**s, click **Permission**.
5. Add the following [role permissions ](#role-permissions)to allow DoControl to collect the relevant data.
6. Under **Grant this role to**, click **Add** and select **Grant role to: Permission Group**.
7. Click **Select** and search for your SFAPI permission group. Check the box in front of it.
8. Make sure the rule is set to **Active**.
9. Save your new permission role.
### Role permissions
In SAP SuccessFactors, assign these permissions to the SFAPI permission role:
* **User permissions**
* General User Permission
* User Login
* SFAPI User Login
* **Administrator permissions**
* Manage Integration Tools
* Allow Admin to Access OData API through Basic Authentication
* Employee Central API
* Employee Central Foundation OData API (read-only)
* Employee Central HRIS OData API (read-only)
* Metadata Framework
* Admin access to MDF OData API
## 2. Register a client application
1. Sign in to [SAP SuccessFactors](https://help.sap.com/docs/SAP_SUCCESSFACTORS_PLATFORM/9f5f060351034d98990213d077dab38a/6b3c741483de47b290d075d798163bc1.html) as an administrator.
2. Navigate to **Admin Center > API Center > Manage OAuth2 client applications**
3. Choose **Register Client Application**.
4. When the **Register an application** page appears, enter your application's registration information:
* **Company** - The name of your company.
* **Application Name** - A unique name for your OAuth client.
* **Application URL** - A unique URL of the page that the client wants to display to the end user. For 3-legged OAuth, follow these steps:
* Go to the authorization page
* Confirm you grant access to the app
* **X-509 Certificate** - The certificate corresponding to the private and public keys used in the OAuth 2.0 authentication process. You can generate them by following one of these steps:
* [Create an X.509 certificate using your own tools](https://help.sap.com/docs/SAP_SUCCESSFACTORS_PLATFORM/9f5f060351034d98990213d077dab38a/637fdad7a8ae44e3b9f00e7504045eb3.html)
* [Create an X.509 certificate in SAP SuccessFactors](https://help.sap.com/docs/SAP_SUCCESSFACTORS_PLATFORM/9f5f060351034d98990213d077dab38a/13f815208a0f4452acc0977f55d395fd.html)
5. Click **Download** to download the X-509 certificate as a PEM file. The private key value will be used in the next step.
6. Click **Register** to save your registration.
7. Click **View** to see the generated API key in the registered application list. The API key is the client ID.
8. Save the key to enter as the **Client ID** in the next step.
## 3. Run DoControl-SAP SuccessFactors integration wizard
1. From the DoControl side menu, click **Integrations**.
2. Under the HRIS icon, click **Connect**.
3. Under Available, select **SAP SuccessFactors**.\
\
4. Enter these values:
* **API server** - Enter your account API server URL. A list of API servers can be found in the public list [here](https://help.sap.com/docs/SAP_SUCCESSFACTORS_PLATFORM/2abbb39286994389bb0f1f4418773a7c/af2b8d5437494b12be88fe374eba75b6.html?locale=en-US#api-servers). Search for your instance and copy the URL.
* **Company ID** - Login to SAP SuccessFactors. Go to the upper right-hand side, click on your profile image, and then click **Show version information**. Locate the **Company ID** value in the modal that pops up.
* **Person ID** - Login to SAP SuccessFactors. Go to the upper right-hand side, and click on your profile image. In the **Me** tab, look under **Biographical information**, and copy your **Person ID**.
* **Client ID** - Enter the API key generated during the [Register a client application](#register-a-client-application) step.
* **Client secret** - Login to SAP SuccessFactors. Open the X-509 certificate that you downloaded in the the [Register a client application](#register-a-client-application) step. Copy the contents of the encrypted private key from `Begin encrypted private key` to `End encrypted private key` and paste it here.
5. Click **Save**.
6. Click **Authorize**.
7. Your SAP SuccessFactors account is now connected.
8. It may take few hours for the data collection to complete.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.docontrol.io/docontrol-user-guide/integrations/hris/sap-successfactors.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
