SAP SuccessFactors

How it works

MuchSkills reads from SAP SuccessFactors on a schedule. New starters, leavers, manager changes and department changes arrive at the next sync, with no manual work on either side. Nothing is written back to SAP SuccessFactors.

MuchSkills signs in to the SuccessFactors OData API as a dedicated, read-only API user with its user name and password (HTTP Basic Authentication over HTTPS). We store the password encrypted.

Before you start

• A SAP SuccessFactors administrator on your side, or your SAP SuccessFactors implementation partner.
• A list of who should be in MuchSkills: everyone, or a selection by country, company, department or worker type.
• Your field names. SAP SuccessFactors installations name custom fields differently, so have your field list to hand for the technical session.

Steps

In SAP SuccessFactors

Your SuccessFactors administrator will recognise these Admin Center tools. Older instances show slightly different labels on the permission role screens; the permissions are the same. SAP SuccessFactors documentation

1. Create a dedicated API user. Create a user that only this integration uses, the way your team normally creates users in your instance. Do not use a person's own account.
2. Put it in its own permission group. In Admin Center, open Manage Permission Groups, choose Create New, give the group a name and add the API user as its only member.
3. Create a read-only permission role. In Admin Center › Manage Permission Roles, choose Create. Under Administrator Permissions › Employee Central API, select Employee Central HRIS OData API (read-only) and Employee Central Foundation OData API (read-only). Under Administrator Permissions › Manage User, select Employee Export, which also lets the user read people who have left. Under Administrator Permissions › Manage Integration Tools, select Allow Admin to Access OData/REST API through Basic Authentication, so the API user can sign in to the API. Select nothing that is editable. To share only some countries or legal entities, leave out the two Employee Central API permissions and give view access under User Permissions › Employee Central Effective Dated Entities and User Permissions › Employee Data instead, so the target population in the next step applies.
4. Assign the role to the group. On Manage Permission Roles, choose Add Role Assignment for the new role (older screens: Grant this role to...). Grant access to the permission group from step 2. In Define a Target Population, choose everyone, or only the groups of employees who should be in MuchSkills.
5. Give the API user a strong password. Set a long, unique password for the API user and keep it in your password manager. It is only used by this integration.
6. Keep the password from expiring, and allow our addresses. In Admin Center › Password & Login Policy Settings, open Set API login exceptions... and add the API user. Set Maximum Password Age to -1 so the password never expires, and add our two IP addresses, 13.51.77.53 and 16.170.107.61. If you also use IP Restriction Management for the whole instance, add them there too.
7. Note the connection details. The API user's user name, your company ID, the password and the API server for your data centre, for example https://api55.sapsf.eu for Frankfurt or https://api4.successfactors.com for Virginia. SAP lists every API server in its List of SAP SuccessFactors API Servers.

With MuchSkills

8. Send us the connection details. The API user's user name, your company ID, the API user's password and the API server URL for your data centre, through a secure channel we agree.
9. Join the technical session. Your SAP SuccessFactors administrator and our CTO map the fields and test the connection together.
10. Check a first sync. We sync a handful of people or one department. You check their names, managers, departments and any tags in MuchSkills.
11. Widen the scope. We switch the sync on for everyone in scope. From then on it runs every 5 hours.

Check it worked

• Team/Org › Members lists the people in scope.
• The people in scope have an invitation to create their MuchSkills profile.
• Managers see their direct reports in My Circle.

What you get

• SAP SuccessFactors stays the source of truth. People data is entered once, in SAP SuccessFactors, and MuchSkills follows.
• A skills layer on your HR system. Skills, certifications and project history sit next to the people records you already trust.
• Clean data for planning. Reporting lines, departments and tags arrive ready for filtering, gap analysis and Team Builder.

Important to know

What syncs. Only name and email are required. Sync as many of the other fields as you can, because each one makes MuchSkills more useful.

Data MuchSkills does not accept. These are blocked when data arrives and never stored, even if the source includes them: age or date of birth, salary or other compensation data, performance ratings, and political, religious or health data.

Who is included. Limiting what the integration user can see in SAP SuccessFactors is the preferred way, so nothing outside your scope leaves your system. The fallback is a country filter in MuchSkills; records outside it are ignored and not stored. Your security or compliance team decides which fits your rules.

Leavers are deactivated, not deleted. Project history and certificates stay on record.

Our IP addresses. MuchSkills always connects from the same two addresses: 13.51.77.53 and 16.170.107.61. If SAP SuccessFactors or your network limits access by IP address, add both to the allow list.

SAP is retiring Basic Authentication for APIs. SAP switches it off by default in the first half of 2027 and deletes it on 12 November 2027. If your instance has already switched it off for APIs, tell us before the technical session and we agree the way to connect.

Without Employee Central. If you run SuccessFactors talent modules without Employee Central, people data sits on the User entity and the Employee Central permissions in step 3 do not apply. Tell us before the technical session.

Troubleshooting