Connect SAP SuccessFactors to Entra ID

ezOnboard reads the OData API through a dedicated user’s permissions. Create a technical user with no employee data. In Manage Permission Groups, create an ezOnboard group with that user as its only member.

In Manage Permission Roles, create an ezOnboard role. Open Permission settings and grant the items below. Under Grant this role to, select the ezOnboard group. Leave editable API items unselected.

In Manage OAuth2 Client Applications, choose Register Client Application. Set Application Name to ezOnboard and Application URL to your portal address. Select Bind to Users and the ezOnboard user. Choose Generate X.509 Certificate, enter a Common Name and download the certificate. Save it securely; its private key is shown only once. Choose Register.

Open the application with View and copy the API Key. Find your Company ID under Show version information in the user menu, and your API server in Admin Center → API Center. You’ll need these, the private key and the API user ID in step 5.

The agent runs as a Windows service on your server with Windows Server 2019 or later. No domain join is required. It connects to SAP SuccessFactors, ezOnboard and Microsoft Graph over outbound HTTPS. No inbound firewall rules are needed.

Download the signed MSI and enrollment bundle from the portal. Save the install code. The portal shows it only once. Run the MSI and enter the code. The agent uses a local virtual account by default, with no password to manage. The installer checks outbound access and the clock before making changes. Domain and LDAP checks show “not needed”.

Add a Microsoft 365 connection in the portal. Choose the Directory and Licenses capabilities, then continue to Microsoft. Sign in as a Global Administrator and grant consent. The portal shows which capabilities have access. You can grant missing permissions later.

ezOnboard uses application permissions, not an administrator account or password. Revoke consent in Entra ID to remove its access. Each tenant connects to one organization.

In the portal, add SAP SuccessFactors as an HR source using the API key, certificate, API user and company ID. Your credentials are encrypted with your organization’s key and sent to your agent. The agent reads SAP SuccessFactors from your network. Nobody at ezOnboard can read the credentials.

Choose a field to match people across both systems, usually work email or employee ID. The agent checks SAP SuccessFactors every five minutes and catches up on any missed changes.

Choose which SAP SuccessFactors fields update each directory attribute. Start with the defaults below, add custom fields or combine values. For example, build a display name from first and last names, format a job title or look up an office address by site.

Blank SAP SuccessFactors fields leave directory values unchanged unless you configure the mapping to clear them.

Rules define who gets an account, which administrative unit it belongs to, how it’s named and which groups it joins. They also control offboarding. Use SAP SuccessFactors fields, such as department and site, to make those choices.

Our implementation team helps you write the rules. With approvals enabled, your team must approve each rule change before the agent uses it.

Run a dry run for your whole workforce. The agent matches SAP SuccessFactors records to existing accounts by employee ID, then work email, and previews changes without applying them. If two accounts match one person, that action stops for review.

Review the planned changes and the rules behind them in the portal. Adjust your rules and repeat the dry run until the results match your expectations.

Turn off dry run to apply changes. If a run would disable or move more accounts than your safety limits allow, it stops and alerts your team before making changes. We review the first runs with you.

HR continues working in SAP SuccessFactors. Your rules handle new accounts, updates and offboarding on schedule. Get alerts by email, in the portal or by webhook when a run stops, the HR feed stops updating or the agent stops reporting. An inactive feed never triggers offboarding.