The ServiceNow SAP SuccessFactors integration automates employee lifecycle management by synchronizing HR data between SuccessFactors and ServiceNow's HR Service Delivery (HRSD) and User Administration modules. This integration solves critical business problems including automated user provisioning, access management during employee transfers, and maintaining accurate organizational hierarchies for IT service delivery. HR teams, IT administrators, and service desk managers rely on this integration to ensure consistent employee data across systems. The integration supports bi-directional data flow with SuccessFactors as the authoritative source for employee master data, organizational structures, and position information flowing into ServiceNow, while ServiceNow can push back case status updates and service fulfillment data. Primary automation triggers include real-time employee lifecycle events (new hires, terminations, transfers) and scheduled bulk synchronization jobs that leverage OData API calls managed through the ServiceNow IntegrationHub SuccessFactors spoke.
Prerequisites
- •ServiceNow Tokyo release or later with IntegrationHub Professional license
- •SAP SuccessFactors Employee Central module with OData API access enabled
- •SuccessFactors system administrator privileges to create API users and configure permissions
- •ServiceNow HR Service Delivery (HRSD) plugin activated (com.sn_hr_core)
- •MID Server installed and configured for outbound integrations if firewall restrictions apply
- •SuccessFactors Compound Employee API and Position Management API permissions configured
- •ServiceNow Integration Hub SAP SuccessFactors spoke installed from the ServiceNow Store
Architecture Overview
The integration utilizes the official ServiceNow IntegrationHub SAP SuccessFactors spoke, which provides pre-built Actions for common SuccessFactors operations including employee queries, organizational data retrieval, and position management. Authentication is established using OAuth 2.0 SAML Bearer Assertion flow, with credentials securely stored in ServiceNow Connection & Credential Alias records that reference the SuccessFactors API endpoint and authentication certificates. Data flows primarily uni-directionally from SuccessFactors to ServiceNow through scheduled Flow Designer flows and event-driven integrations that trigger on employee lifecycle changes, with all API calls using SuccessFactors OData v2 protocol. A MID Server is typically required for production deployments due to SuccessFactors API security requirements and to enable proper certificate-based authentication for SAML assertions. The integration respects SuccessFactors API rate limits of 2000 calls per hour per company code, with built-in retry logic and error handling managed through the IntegrationHub spoke's Connection Alias configuration.
Sourdough: ServiceNow Monitoring and Analytics
A Chrome extension for ServiceNow Admins and Developers with essential tools, analytics, graphs and monitoring features.
Free to install. Pro $5/month after a 14-day no-card trial.
Pro requires the ServiceNow admin role. Upgrade inside the extension.
Implementation Steps
Install and configure the SAP SuccessFactors IntegrationHub spoke
Navigate to System Applications > All Available Applications > All and search for 'SAP SuccessFactors' to locate the official IntegrationHub spoke. Install the spoke which includes pre-built Actions for employee data synchronization, organizational hierarchy management, and position lookups. After installation, verify the spoke appears under IntegrationHub > Spokes and confirm all dependent applications are properly activated. The spoke installation will automatically create the necessary application registry entries and connection templates required for SuccessFactors integration.
Create SuccessFactors API user and generate SAML certificates
In your SuccessFactors Admin Center, navigate to Company Settings > Integration Settings and create a dedicated API user with appropriate permissions for Employee Central, Position Management, and Organizational Management APIs. Generate or upload X.509 certificates for SAML authentication, ensuring the certificate includes the API user's details and has a validity period of at least one year. Configure the OAuth2 SAML Bearer Assertion flow in SuccessFactors by registering the certificate and noting the Company ID, User ID, and API endpoint URLs. Document the SuccessFactors API endpoint format which typically follows https://api[datacenter].successfactors.com/odata/v2/[companyId]/.
Create Connection and Credential records in ServiceNow
Navigate to Connections & Credentials > Connections and create a new Connection record using the SAP SuccessFactors connection type template. Configure the connection with your SuccessFactors API base URL, company ID, and specify OAuth 2.0 SAML Bearer Assertion as the authentication method. Create a corresponding Credential record under Connections & Credentials > Credentials, uploading the private key file and certificate generated in SuccessFactors, and associate it with the Connection record. Test the connection using the built-in test functionality to verify successful authentication and API connectivity.
Configure employee data field mapping and transformation rules
Navigate to Human Resources > Administration > Data Sources and create a new integration data source for SuccessFactors employee data. Define field mappings between SuccessFactors Employee Central fields (such as personIdExternal, firstName, lastName, jobTitle, department) and ServiceNow sys_user and sn_hr_core_profile tables. Configure transformation rules for handling different data formats, particularly date fields, organizational hierarchies, and custom SuccessFactors fields that need to be mapped to ServiceNow choice lists or reference fields. Set up data validation rules to ensure data quality and prevent synchronization errors from invalid or incomplete employee records.
var transformer = new GlideRecord('sys_transform_map');
transformer.initialize();
transformer.name = 'SuccessFactors Employee Transform';
transformer.source_table = 'u_sf_employee_staging';
transformer.target_table = 'sys_user';
transformer.insert();
// Create field mapping for employee ID
var fieldMap = new GlideRecord('sys_transform_entry');
fieldMap.initialize();
fieldMap.map = transformer.getUniqueValue();
fieldMap.source_field = 'personIdExternal';
fieldMap.target_field = 'employee_number';
fieldMap.coalesce = true;
fieldMap.insert();Build Flow Designer flows for employee lifecycle automation
Navigate to Process Automation > Flow Designer and create flows for each employee lifecycle event: new hire provisioning, employee updates, transfers, and terminations. Configure the flows to use the SuccessFactors spoke Actions such as 'Get Employee Details' and 'Query Employee Data' to retrieve real-time employee information. Implement error handling and retry logic within each flow to manage API failures, network timeouts, and data validation errors. Create subflows for common operations like organizational hierarchy updates and position data synchronization to promote reusability across different employee lifecycle scenarios.
// Sample script step within Flow Designer for employee data processing
(function process(inputs, outputs) {
var employee = inputs.sf_employee_data;
var user = new GlideRecord('sys_user');
if (user.get('employee_number', employee.personIdExternal)) {
user.first_name = employee.firstName || '';
user.last_name = employee.lastName || '';
user.title = employee.jobTitle || '';
user.department = employee.department || '';
user.manager = employee.managerId || '';
user.active = employee.status == 'Active';
user.update();
outputs.success = true;
outputs.user_sys_id = user.getUniqueValue();
}
})(inputs, outputs);Set up organizational and position data synchronization
Create scheduled Flow Designer flows to synchronize organizational hierarchy and position data from SuccessFactors Foundation Objects including FOCompany, FODepartment, FODivision, and FOPosition entities. Configure these flows to run daily or weekly depending on your organization's change frequency, using the SuccessFactors spoke's 'Query Foundation Object' Action to retrieve organizational structures. Map SuccessFactors organizational data to ServiceNow's sys_user_group, cmn_department, and sn_hr_core_position tables, ensuring proper parent-child relationships are maintained. Implement delta synchronization logic to process only changed records since the last successful sync, improving performance and reducing API call consumption.
// Scheduled Script Execution for org data sync
var restMessage = new sn_ws.RESTMessageV2();
restMessage.setEndpoint('https://api4.successfactors.com/odata/v2/Company123/FODepartment');
restMessage.setHttpMethod('GET');
restMessage.setRequestHeader('Authorization', 'Bearer ' + getAccessToken());
restMessage.setRequestHeader('Accept', 'application/json');
var response = restMessage.execute();
if (response.getStatusCode() == 200) {
var departments = JSON.parse(response.getBody()).d.results;
departments.forEach(function(dept) {
var deptRecord = new GlideRecord('cmn_department');
deptRecord.addQuery('u_external_id', dept.externalCode);
deptRecord.query();
if (!deptRecord.next()) {
deptRecord.initialize();
deptRecord.u_external_id = dept.externalCode;
}
deptRecord.name = dept.name;
deptRecord.head_count = dept.headCount || 0;
deptRecord.insertOrUpdate();
});
}Configure real-time event handling for employee lifecycle changes
Set up SuccessFactors Intelligent Services Center (ISC) or configure webhook notifications to trigger real-time synchronization for critical employee lifecycle events. Create inbound integration endpoints using Scripted REST APIs in ServiceNow to receive SuccessFactors event notifications for new hires, terminations, job changes, and organizational transfers. Configure these endpoints to validate incoming payloads, authenticate the source, and trigger appropriate Flow Designer flows for immediate processing. Implement idempotency controls to prevent duplicate processing of the same lifecycle event and ensure data consistency across both systems.
(function process(/*RESTAPIRequest*/ request, /*RESTAPIResponse*/ response) {
try {
var requestBody = request.body.data;
var eventType = requestBody.eventType;
var employeeId = requestBody.employee.personIdExternal;
// Validate the webhook signature
if (!validateWebhookSignature(request)) {
response.setStatus(401);
return;
}
// Trigger appropriate flow based on event type
if (eventType === 'HIRE' || eventType === 'REHIRE') {
sn_fd.FlowAPI.getRunner().trigger('sf_new_hire_flow', {
employee_data: requestBody.employee
});
} else if (eventType === 'TERMINATION') {
sn_fd.FlowAPI.getRunner().trigger('sf_termination_flow', {
employee_id: employeeId,
termination_date: requestBody.terminationDate
});
}
response.setStatus(200);
response.getStreamWriter().writeString(JSON.stringify({status: 'success'}));
} catch (e) {
gs.error('SuccessFactors webhook processing error: ' + e.message);
response.setStatus(500);
}
})(request, response);Test integration functionality and implement monitoring
Execute comprehensive testing of all integration scenarios including new employee onboarding, existing employee updates, organizational changes, and termination processing using both scheduled synchronization and real-time event triggers. Navigate to System Logs > Outbound HTTP Requests to monitor API call success rates, response times, and error patterns, ensuring all SuccessFactors API calls complete successfully. Set up Integration Hub monitoring dashboards and configure email notifications for integration failures, API quota warnings, and data synchronization errors. Create business rules or Flow Designer flows to alert HR administrators when critical employee lifecycle events fail to process correctly, ensuring prompt resolution of integration issues.
// Monitoring script for integration health
var integration = new sn_ih_monitoring.IntegrationHealthChecker();
integration.setConnectionAlias('SuccessFactors_Connection');
integration.setThresholds({
response_time: 5000, // 5 second threshold
error_rate: 0.05, // 5% error rate threshold
quota_usage: 0.8 // 80% API quota usage warning
});
var health = integration.checkHealth();
if (!health.healthy) {
gs.eventQueue('successfactors.integration.unhealthy', null, health.issues.join(', '));
}Common Use Cases
Automated new hire user provisioning and access management
When a new employee is hired in SuccessFactors, the integration automatically creates corresponding ServiceNow user accounts with appropriate roles, department assignments, and manager relationships. This use case triggers Flow Designer flows that provision IT assets, create service desk tickets for equipment setup, and initiate security access requests based on the employee's job role and organizational position. The business value includes reduced manual effort for IT administrators, faster time-to-productivity for new hires, and consistent application of security policies across all new user accounts.
Employee termination and access deprovisioning automation
Employee termination events from SuccessFactors trigger immediate deactivation of ServiceNow user accounts, revocation of system access, and initiation of asset recovery workflows. The integration processes termination dates, final work days, and manager transitions to ensure proper handover of responsibilities and timely access removal. ServiceNow HRSD case management tracks the entire offboarding process, from IT asset collection to final access audits, providing HR and security teams with complete visibility into termination workflow completion.
Organizational restructuring and reporting hierarchy updates
When organizational changes occur in SuccessFactors such as department mergers, manager changes, or reporting structure modifications, the integration automatically updates ServiceNow user records, group memberships, and approval workflows. This use case ensures that service catalog approvals, incident assignments, and change approval processes reflect current organizational hierarchies without manual intervention. The integration also updates knowledge base permissions and service portal access based on new departmental assignments and roles.
Employee transfer and role change processing
Employee transfers between departments, locations, or job roles trigger comprehensive updates to ServiceNow user profiles, including new manager assignments, department changes, location updates, and role-based access modifications. The integration coordinates with ServiceNow's HR Case Management to create transfer checklists, update asset assignments, and modify service entitlements based on new positions. Automated workflows ensure that security clearances, system permissions, and service catalog access are adjusted to match the employee's new responsibilities and clearance levels.
Position and compensation data synchronization for service costing
Regular synchronization of position data, salary bands, and cost center information from SuccessFactors enables accurate service costing, chargeback calculations, and resource planning within ServiceNow's Financial Management applications. This use case supports IT service financial management by providing current employee cost data for service portfolio analysis, project resource costing, and departmental service consumption reporting. The integration ensures that ServiceNow's service catalog pricing and internal billing processes reflect actual employee costs and organizational budget allocations.
Troubleshooting
OAuth SAML Bearer Assertion authentication failures with 401 Unauthorized errors
First, verify that the X.509 certificate configured in ServiceNow matches exactly with the certificate registered in SuccessFactors Admin Center, including proper certificate chain and validity dates. Check the System Logs > Outbound HTTP Requests for detailed error messages and examine the SAML assertion payload for correct audience, issuer, and subject values. Navigate to Connections & Credentials > Connections and test the connection directly, ensuring the SuccessFactors company ID, data center URL, and API user permissions are correctly configured. If authentication continues to fail, regenerate the SAML certificates in both systems and verify that the SuccessFactors API user has not been disabled or had permissions modified.
Employee data synchronization creates duplicate user records
Review the transform map configuration under System Import Sets > Transform Maps to ensure proper coalesce field settings are configured using unique identifiers like employee_number or email address rather than name fields. Check for data quality issues in SuccessFactors where employees might have multiple active records or inconsistent personIdExternal values that cause the matching logic to fail. Examine the Flow Designer flows processing employee data to verify that user lookup logic searches for existing records using multiple criteria before creating new ones. Implement additional validation steps in your flows to check for near-duplicate records and configure duplicate detection business rules on the sys_user table.
API rate limit exceeded errors during bulk synchronization operations
Analyze the Integration Hub connection logs to identify peak usage patterns and implement Flow Designer delays or batch processing to distribute API calls over longer time periods. Navigate to the SuccessFactors spoke configuration and adjust the connection retry settings to implement exponential backoff when rate limits are encountered. Modify scheduled synchronization flows to process employee data in smaller batches with configurable delays between batches, and consider running large bulk operations during off-peak hours. Review SuccessFactors API quotas with your SuccessFactors administrator to understand if quota increases are available or if multiple API users can be configured to distribute load.
Organizational hierarchy data appears incorrect or outdated in ServiceNow
Verify that the SuccessFactors Foundation Object APIs being queried include current effective dating and that your integration flows filter for active organizational records only. Check the field mappings for organizational data to ensure parent-child relationships are correctly established using SuccessFactors external codes rather than internal IDs that may change. Review the data synchronization timing to ensure organizational structure updates are processed before employee assignment changes to prevent temporary orphaned records. Implement data validation rules in your organizational sync flows to detect and alert on hierarchy inconsistencies such as circular references or missing parent departments.
Real-time webhook events from SuccessFactors are not triggering ServiceNow flows
Test the Scripted REST API endpoint independently using tools like Postman to verify it can receive and process SuccessFactors webhook payloads correctly. Check the ServiceNow instance access controls and ensure the webhook endpoint has proper authentication bypass rules configured for the SuccessFactors source IP addresses. Navigate to System Web Services > Scripted REST APIs and review the execution logs for any parsing errors or exceptions when processing incoming webhook data. Verify that the webhook configuration in SuccessFactors ISC includes the correct ServiceNow endpoint URL, authentication headers, and retry policies for handling temporary network failures.
MID Server connectivity issues preventing SuccessFactors API access
Check the MID Server logs under System Diagnostics > ECC Queue to identify specific network connectivity or certificate validation errors when establishing connections to SuccessFactors APIs. Verify that the MID Server has proper network access to SuccessFactors data centers and that corporate firewall rules allow outbound HTTPS connections to api*.successfactors.com domains. Review the MID Server certificate store configuration to ensure it includes the necessary root and intermediate certificates for validating SuccessFactors SSL certificates. Test the integration connection directly from the MID Server host using curl or similar tools to isolate network versus ServiceNow configuration issues.
Pro Tips
- →Implement delta synchronization using SuccessFactors lastModifiedDateTime fields and ServiceNow's sys_import_state_comment table to track the last successful sync timestamp, reducing API calls and improving performance for large employee datasets. Configure your Flow Designer flows to store and retrieve these timestamps automatically, ensuring that only changed records are processed during scheduled synchronization runs.
- →Create custom business rules on the sys_user table that automatically trigger ServiceNow's User Provisioning Engine when employee data changes occur through SuccessFactors integration, ensuring that downstream applications and access management systems receive updates without additional manual configuration. This approach provides seamless integration with ServiceNow's identity management capabilities.
- →Leverage SuccessFactors Compound Employee API instead of individual entity APIs when retrieving comprehensive employee data to reduce the number of API calls required and improve integration performance. Configure your spoke Actions to use compound APIs that return employee, job, personal, and organizational data in single requests rather than making separate calls for each data type.
- →Implement comprehensive audit logging by creating custom tables to track all employee lifecycle events processed through the integration, including source timestamps from SuccessFactors, processing results, and any data transformation applied. This audit trail proves invaluable for compliance reporting, troubleshooting data discrepancies, and analyzing integration performance over time.
- →Use ServiceNow's Connection Alias retry and timeout configurations strategically by setting shorter timeouts for real-time employee lifecycle events to ensure rapid failure detection, while configuring longer timeouts and more retry attempts for bulk synchronization operations that can tolerate higher latency. This approach optimizes both user experience and data consistency.
- →Configure SuccessFactors integration monitoring using ServiceNow's Event Management to create intelligent alerting that distinguishes between temporary API issues and systemic integration problems. Set up event correlation rules that suppress duplicate alerts during known SuccessFactors maintenance windows and escalate persistent failures to appropriate technical teams automatically.
Known Limitations
- —SuccessFactors API rate limits restrict integrations to 2000 API calls per hour per company code, which can constrain real-time synchronization for large organizations with frequent employee data changes. Bulk synchronization operations may need to be scheduled during off-peak hours or distributed across multiple time windows to avoid quota exhaustion and ensure all employee data remains current.
- —The integration requires ServiceNow IntegrationHub Professional license which includes additional costs beyond base ServiceNow licensing, and the SuccessFactors spoke may have specific action execution limits depending on your IntegrationHub subscription tier. Organizations should evaluate spoke usage patterns against license quotas to avoid unexpected integration interruptions.
- —Complex SuccessFactors custom fields and picklist values may not map directly to ServiceNow field types, requiring custom transformation logic and potentially additional staging tables to handle data type conversions. Multi-language employee data and international character sets may require special encoding considerations and testing across different locale configurations.
- —Real-time integration depends on SuccessFactors Intelligent Services Center (ISC) availability and webhook reliability, with potential delays of 15-30 minutes for event processing during peak usage periods. Network connectivity issues between SuccessFactors data centers and ServiceNow instances can impact integration reliability, particularly for organizations with strict firewall policies.
- —Historical employee data synchronization may be limited by SuccessFactors data retention policies and API access permissions, potentially requiring separate data migration processes for comprehensive employee history. Terminated employee records may have limited API access depending on SuccessFactors configuration, affecting the ability to maintain complete audit trails in ServiceNow.
Frequently Asked Questions
Can the SuccessFactors integration handle multiple company codes within a single ServiceNow instance?
Yes, the integration supports multiple SuccessFactors company codes by creating separate Connection and Credential records for each company, with Flow Designer flows configured to process data from multiple sources into appropriate ServiceNow domains or business units. You'll need to implement company-specific field mapping and transformation rules to ensure proper data segregation and routing. The SuccessFactors spoke Actions can be configured with different connection aliases to target specific company endpoints, and you can use ServiceNow's domain separation features to maintain data isolation between different organizational entities.
How does the integration handle employee privacy and GDPR compliance requirements?
The integration supports privacy compliance through ServiceNow's data protection features including field encryption, access controls, and data retention policies configured on employee-related tables. You can configure the SuccessFactors spoke to exclude sensitive personal information from synchronization or implement field-level encryption for protected data elements. ServiceNow's privacy framework allows you to track data lineage, implement right-to-be-forgotten requests, and configure automated data purging based on retention policies. The integration logs can be configured to exclude personally identifiable information while maintaining sufficient detail for troubleshooting and audit purposes.
What happens to ServiceNow user accounts when employees are temporarily inactive in SuccessFactors?
The integration can be configured to handle temporary employee statuses such as leave of absence, sabbatical, or suspension by mapping SuccessFactors employee status codes to ServiceNow user account states rather than simply active/inactive flags. Flow Designer flows can implement business logic to temporarily disable user accounts while preserving access rights and group memberships for easy reactivation. You can configure different processing rules for various temporary statuses, such as maintaining email access during medical leave but disabling VPN access, and set up automated reactivation when employees return to active status in SuccessFactors.
How can I customize the integration to sync SuccessFactors learning and development data?
The SuccessFactors spoke can be extended to synchronize learning data by creating custom Flow Designer flows that query SuccessFactors Learning Management APIs for course completions, certifications, and training requirements. You'll need to create custom ServiceNow tables to store learning data or leverage existing HR Service Delivery learning record types if available. Configure field mappings for learning-specific data elements such as course completion dates, certification expiry dates, and required training assignments, and implement business rules that trigger compliance notifications or access modifications based on certification status changes.
Does the integration support SuccessFactors Employee Central Payroll data synchronization?
While the core SuccessFactors spoke focuses primarily on Employee Central master data, position information, and organizational structures, it can be extended to access payroll-related data through custom API calls if your SuccessFactors license includes Employee Central Payroll APIs. However, payroll data synchronization requires additional security considerations, field-level encryption, and compliance controls that must be implemented separately. Most organizations limit payroll data integration to summary information such as cost center assignments and salary bands for service costing purposes rather than detailed compensation data. Consult with your SuccessFactors administrator regarding API permissions and data access policies for payroll information.
Can I configure different synchronization frequencies for various types of employee data?
Yes, you can create multiple scheduled Flow Designer flows with different execution frequencies tailored to specific data types and business requirements. Critical employee lifecycle events such as new hires and terminations can be configured for real-time processing through webhooks, while organizational structure changes might sync daily and position data weekly. Configure separate flows for high-frequency updates like manager changes, moderate-frequency updates for department transfers, and low-frequency updates for organizational hierarchy changes. This approach optimizes API usage while ensuring that time-sensitive data remains current and less critical information updates on appropriate schedules.
How do I troubleshoot data mapping issues when SuccessFactors field values don't match ServiceNow choice lists?
Create data transformation scripts within your Flow Designer flows or transform maps that include lookup tables for mapping SuccessFactors picklist values to ServiceNow choice list options, with fallback logic for handling unmapped values. Implement validation flows that log unmapped values to a staging table for review and resolution by administrators. You can configure the integration to either reject records with invalid choice values, map them to default values, or create new choice list options automatically based on SuccessFactors data. Use ServiceNow's Import Set Transform functionality to create reusable field value mapping scripts that can be maintained independently of the main integration flows and updated as business requirements change.
Test Your Knowledge
Quick 3-question quiz — see how your ServiceNow skills stack up.
A list view on a table with millions of records is slow. Best fix?
Select an answer to continue