3079849 - Using Identity Provisioning Service(IPS) to run user data sync between SuccessFactors and Identity Authentication Service(IAS)

• How to run user sync in IPS?
• Can IPS user sync be scheduled to run automatically? If yes, how frequently?
• What are some of the important considerations for IPS user sync?

SAP SuccessFactors HCM Suite

SuccessFactors User profiles need to be synced to IAS for other dependent downstream applications, like SAC/People Analytics to function properly .

The user data sync between SuccessFactors and Identity Authentication Service(IAS) is handled via a separate application- Identity Provisioning Service (IPS). The SuccessFactors/IAS Integration process in Upgrade Center (KBA 2791410), also covers creation and/or configuration of IPS tenant to facilitate, user sync between the two applications.

How to run User sync from IPS?

The User Sync in IPS needs to be run from the Source System, which is SuccessFactors in this setup. The sync can be run manually(ad-hoc), or, in a scheduled & recurring manner, or, as a combination of both. For complete steps on running or scheduling the sync, please refer to this section of our help guide-> Running and Scheduling Jobs (User Sync)

IPS offers two types of Sync jobs->

• Resync Job (for 'full user sync) 
• Read Job (for 'delta' user sync)

The Read job will, in most cases, offer better performance than the Resync job, and is the only job type that can be scheduled to run in a recurring manner. But is possible to force a full sync after a defined number of delta sync runs, and that topic is also covered in the above linked guide.

What should be the frequency for scheduled sync?

The shortest duration that can be entered in the IPS Job Scheduler is 30 mins. Meaning, the most frequent schedule IPS sync can be run on is- once every 30 mins.

The frequency on the sync needs to be set in accordance to the business requirement.
The schedule should be kept long enough to ensure each run completes before another starts, to avoid sync failures. This is especially important for instances with large volume of users.

Some Important considerations for IPS

• In the IPS Source System for SuccessFactors, the upgrade process adds in a default sf.user.filter in the Properties tab, with placeholder Usernames like- username in 'sf_username1_placeholder','sf_username2_placeholder'.
  Before running the sync, these placeholder usernames will need to be replaced with actual SuccessFactors usernames (to run sync for selective users), or, the username condition needs to be removed entirely (to run sync for all users).
  
  
• IAS (and later on SAC/People Analytics ) requires emails to be unique. So, it is recommended that in the source system (SuccessFactors), all users have unique emails to avoid user sync issues.
      However, if it is necessary to keep duplicated emails in SuccessFactors, then the email duplication can also be handled via IPS transformation code to ensure IAS gets dummy but unique email for every user record. This process is detailed in the following section of our help guide-> Remove Dummy Emails Transformation
  
  
• The Check tool can help you find user data issues which may be causing the sync to fail or skip users. 
  
  Some examples of this:
  3365082 - Missing user in IPS sync
  3386915 - IPS sync job fails with "Email address is already used for <Per person UUID>" error
  
  
• If user filters are added/modified in the IPS configuration, after some or all users have already been synced, and a Resync is run- then it will delete any previously synced users, who are now rejected by the added/modified user filter, from IAS.
  
  
• Best practices for troubleshooting scenarios where it’s necessary to isolate a specific user, ensuring that other users remain unaffected.

        Recommended Steps:

1. Export the existing source system.
2. Create a new copy of the source system and upload the exported JSON file.
3. Adjust the sf.user.filter to include only the specific user(s).

4. Remove the group section from the  Source transformation of Copied Source system, or set the group to as below:

   "group": {
      "ignore": true,
      "mappings": [
   

5. Link the target system to the newly created copy of the source system.
6. Run the read sync job.

• Since the new copy source system is newly created, running jobs from it will not trigger deletions.

• Please ensure that groups are not provisioned in the new source system.

This approach helps minimize risk and allows safer, targeted troubleshooting.

Additional/Optional configurations available in IPS

• The IPS transformation rules can be modified for additional requirements, these are covered in detail in the following section of our Help guide-> Configure Transformations in SAP Cloud Identity Services - Identity Provisioning
  
  
• If there is a need to sync additional user data fields from SuccessFactors to IAS, beyond what is covered in the default IPS transformation and properties, that can also be achieved but please note that this is an implementation customization and as such is out of support scope, its execution should be done by an Implementation Partner, Professional Services or as a self-service by the customer IPS admin.

 For any doubts, feel free to contact IAS Experts DL : CSD CSUP TS SF HCM PLT IAS EXPERTS <DL_600830FAEFD732027EF22C0D@global.corp.sap>

• KBA 2791410 - Integrating SuccessFactors with SAP Cloud Identity Authentication Through the Upgrade Center
• KBA 3046724 - How to provision the manager from SAP SuccessFactors to Identity Authentication
• KBA 2149831 - SAP Professional Services / SAP Certified Partner / SAP Account Management Team [SuccessFactors Cloud]

SuccessFactors/IAS User sync,User sync,IPS user sync,SuccessFactors to IAS user sync,User sync to IAS,User sync from SuccessFactors to IAS , KBA , LOD-SF-PLT-IAS , Identity Authentication Services (IAS) With BizX , How To