Import organizational data from SAP SuccessFactors (preview)

You can import organizational data into Microsoft 365 with the SAP SuccessFactors connector. Here's how.

Prerequisites

Before you can set up a connection between SAP SuccessFactors and Microsoft 365, you'll need the following information about your SAP SuccessFactors environment from your SAP SuccessFactors Administrator.

For direct connections

• Company ID
• DataCenter URL
• User ID
• API key
• Completed steps within SAP SuccessFactors described below in Step 2

For connections via middleware

• If you're hosting a Proxy API, we support client secret-based authentication. Ask your Proxy API owner to provide these credentials: Token URL; Proxy URL; ClientID; and Client Secret. These are used to fetch an access token to call the Proxy API.

• The Proxy API should forward requests to your SAP SuccessFactors instance, accept OData requests such as $expand and $select, and return responses unchanged in structure.

Steps

1. Set up your SAP SuccessFactors connection

Applies to: Microsoft 365 Global Administrator

1. Start the import from the Data Connections page on the Organizational Data in Microsoft 365 page (Home > Setup > Migration and imports > Organizational Data in Microsoft 365 > Data Connections).

   1. You can also start the import by selecting Copilot on the left, then select Agents & connectors.
   2. Under Connectors, select Your connections.
   3. Select Add connection.
   4. At the bottom of the page, under People, and next to SAP SuccessFactors, select Add.

2. Select Get started (if this is the first time you're importing data), or New import (if you've already imported data).

3. On the Select connection type page, select Start SuccessFactors setup.

4. Select the apps and services with which you'd like to share data. By default, all public reserved attributes are shared across Microsoft 365 and Viva apps and services. Use this page to select apps with which to share application-specific and custom data. You can change your selections at any time within Settings. Under each app, select View app specific attributes to see a list of attributes that can be accepted by that app. You'll set attribute-specific access later. When you're done, at the bottom, select Next.

   

5. Choose how you'd like to connect to SAP SuccessFactors. You can connect directly using a certificate, or through a secure intermediary layer.

   

   If you're connecting directly

   • On the Download your SAP SuccessFactors certificate page, select Download certificate. A x509 certificate file will download called "publicKey.pem." Open the file in a text editor and copy its contents. Share this with the SAP SuccessFactors admin.

   • Read the acknowledgment note and select Next.

   • On the right, select Download default mapping to access a JSON mapping file, which includes the default attribute mapping for the apps with which you're sharing data. To customize how you map your data to each app's required attributes, you can edit the file. For custom mapping, you'll use this file in a later step.

   If you're connecting through middleware

   • There's several types of information you'll need from your proxy API owner, such as Token URL, Proxy URL, Client ID, and Client Secret. Refer to the on-screen guidance for more details.

   • On the right, select Download default mapping to access a JSON mapping file, which includes the default attribute mapping for the apps with which you're sharing data. To customize how you map your data to each app's required attributes, you can edit the file. For custom mapping, you'll use this file in a later step.

6. Under Set up SAP SuccessFactors connection:

   1. Enter a name for your connection.

   2. If connecting directly, contact your SAP SuccessFactors admin to complete the steps in SAP SuccessFactors described below in Step 2. Enter the SAP SuccessFactors Company ID, DataCenter URL, User ID, and API key provided by the SAP SuccessFactors admin.

      

   3. If connecting through middleware, contact your Proxy API owner to complete the steps below. Enter the Token URL, Proxy URL, ClientID, and Client Secret provided by your proxy API owner. These credentials are used to fetch an access token to call the Proxy API.

      

   4. Select how frequently you want SAP SuccessFactors to send data to Microsoft 365: weekly or monthly.

   5. If you want, select Prioritize Organizational Data in Microsoft 365. Learn more about this setting.

7. Confirm you agree to the terms of transferring your data using the SAP SuccessFactors API.

8. At the bottom of the page, select Validate credentials.

9. After your credentials are validated, map reserved attributes to the imported data. This means you'll match attributes from your SAP SuccessFactors data to their corresponding attributes for the apps with which you're sharing data. Any imported attributes that you don't match to reserved attributes are used as custom attributes and can't be renamed.

10. Select Download default mapping to access a JSON file with the list of reserved attributes and the recommended mapping. You can edit this file to customize the mapping. Once you've reviewed the file and made your edits (if any), at the bottom of the screen, select Browse to upload it.

    

11. On the next page, review your attribute mapping. To make changes, at the bottom of the screen select Back, and upload a new JSON mapping file with your edits. Otherwise, if everything looks correct, select Next, then on the next screen select Validate mapping.

12. If you sent any app-specific or custom data to any destination in Step 4, you'll choose which apps can access those attributes you mapped in Step 9. Learn more about how to map attributes to your chosen apps.

13. Review all the details, apps, and attribute mapping for the SAP SuccessFactors connection. If everything looks correct, select Confirm.

    Note

    If you set up periodic exports, your data will be validated for Viva and Microsoft 365 services requirements. Validation takes a few hours; however, it can take up to three days for your complete data upload to be available in the profile store. You can check the validation status on the Organizational data page in the Microsoft 365 admin center. When the validation is complete, a message lets you know that your data is in use and managed by Viva and Microsoft 365.

2. Steps within SAP SuccessFactors for direct connection

Applies to: SAP SuccessFactors Admin

1. Create/identify an API user to be used for OData API access. The UserId/Username of this user is required for future steps. This user is assigned permissions to access user data through the SAP SuccessFactors OData APIs.

2. Create an API Permissions Role

   1. In the SAP SuccessFactors Admin Center, navigate to Manage Permission Roles, and select Create to create a new role.

   2. Add a Role Name and Description for the new permission role. The name and description should indicate that the role is for API usage permissions.

   3. In the Add Permissions section, on the left under Administrator Permissions, search for "Employee Central API." This role requires the Employee Central Foundation OData API (read-only) and Employee Central HRIS OData API (read-only) permissions.

   4. Some permissions are required under the Employee Data section. This restricts which fields are ingested. Ensure the view column is selected for all the fields you want to share, such as User id, email, or manager. The relevant fields are listed under Standard Element on this page. A subset of these can be selected to start for testing, such as User id, email, and manager.

      Note

      The status and lastModified fields are required because they're used for filtering. These fields must always be included for the connector to work.

   5. Once all the permissions are set up, select Next and then save the permission role.

3. Create an API Permissions Group for the assigned role. Navigate to Manage Permission Groups in the Microsoft 365 admin center and create a new group. Search for the user created in Step 1 and assign that user to the newly created group, for example:

   

4. Assign the Permission Role to the new Permission Group. In Manage Permission Roles, select Add Role Assignments to assign the created role to the group. Name the role assignment whatever you want, then on the Grant Access To page, select the group you created in Step 2c, for example:

   

   Then, advance through the rest of the screens and select Save. You now have all the required permissions to create an OAuth token and fetch user data.

5. Register a new OAuth2 Client Application

   1. In the admin center, navigate to the Manage OAuth2 Client Applications page and select Register Client Application. Learn more.
   2. The Application Name can be anything but it must be unique, such as "Microsoft 365."
   3. Set the Application URL to any valid URL.
   4. Enable Bind to users and enter the User ID from Step 1 into the "User IDs" field. This ensures that only the created user is allowed to generate OAuth tokens.
   5. X.509 Certificate should contain the full public key copied in Step 2.
   6. After registering the client application, view it so you can copy the "API Key" for the next step.
   7. Save the following information and share it with the Microsoft 365 global admin to enter in the Microsoft 365 admin center:
      • Company ID is your SAP SuccessFactors company ID
      • DataCenter URL is your SAP SuccessFactors data center URL. See a list of SAP SuccessFactors API Servers.
      • User ID is the user that has the required API permissions. If you enabled bind to user, that user's id must be used in the "User ID" field.
      • A "Secret" or "SecretUri" is required depending on how you provide the API key.

How SAP SuccessFactors sends data to Microsoft 365

When you connect SAP SuccessFactors to Microsoft 365, SAP SuccessFactors sends a set of predefined source columns if using the default mapping file. These columns are mapped to fields in Microsoft 365. You can change these predefined fields by updating the mapping file.

Field mapping

The table below shows how SAP SuccessFactors fields correspond to Microsoft 365 fields in the default mapping file. Learn more about Microsoft 365 fields, including data type and formatting requirements.