When someone joins, changes teams, or leaves, IdentityPilot turns the HR update into the right accounts, groups, licenses, and device steps. It keeps checking what exists against policy, fixes drift, and records every change, so audits are simple lookups.
Connects: SAP SuccessFactors · Active Directory · IT Service Management
The problem
A new hire often means the same request repeated across directory, email, licenses, chat, and devices. A move to another team adds new groups while old ones linger. Offboarding works only if every checklist item is done. That is too much identity risk for busy IT teams to carry by memory.
When an audit asks who had which access in March, the proof is scattered across tickets, spreadsheets, and inboxes.
IdentityPilot turns the HR record into the source of truth for access. You define which accounts, groups, licenses, and device steps each role needs. From then on, HR changes create, adjust, or disable access automatically, and every action is recorded with the rule that caused it.
Lifecycle automation
SAP SuccessFactors gets the new-hire record. IdentityPilot creates the directory account, groups, mailbox, licenses, and device order through IT Service Management. It waits for the laptop to be ready before onboarding is complete. Day one starts with access that works.
An employee moves from R&D to sales. IdentityPilot compares the new role with policy and changes only what needs to change: department, groups in Active Directory, and role-specific access. Old permissions are removed instead of carried forward. Privilege creep stops.
HR sets the last day. IdentityPilot disables access across connected systems at the right time: sign-in, groups, apps, and managed devices. Records stay for audit, but the person can no longer use them. If they return, the rehire starts from clean history.
How it works
IdentityPilot keeps two views: what policy says each person should have, and what connected systems actually show. Its job is to keep those views matched.
01
Joiners, movers, and leavers start in SAP SuccessFactors. IdentityPilot reads HR as the source of truth and does not write back to it.
02
Your rules translate each HR record into expected access: accounts, groups, licenses, devices, and platform settings for this person right now.
03
IdentityPilot reads Active Directory and IT Service Management to see what is actually there, including manual changes.
04
When expected and actual access differ, IdentityPilot updates the connected systems and records why. It runs after each event and performs a full nightly check.
IdentityPilot works as a reconciliation loop. Source systems send joiner, mover, and leaver events; the engine builds one person record, compares expected access with current access, and sends only the changes needed to bring each target back in line.
System at rest. Waiting for upstream events.
01
Source systems such as SAP SuccessFactors and IT Service Management publish lifecycle events. IdentityPilot reads them in one direction.
02
The core engine turns those events into one person record, then compares expected state from policy with current state from connected systems.
03
When something is missing or extra, the actions engine writes the right changes to targets such as Active Directory, IT Service Management, Confluence, and Citrix.
Capabilities
If someone edits a directory group by hand, IdentityPilot treats it as drift: current access no longer matches policy. The next event or nightly sweep finds it, fixes it, and records what changed. The directory you audit is the directory your policy expects.
For any account, IdentityPilot can show the previous value, new value, trigger, timestamp, and rule version. The platform records changes it makes and drift it finds, and it does not write a value without a source. That makes access reviews evidence, not reconstruction.
No rip-and-replace. SAP SuccessFactors stays the HR source of truth, Active Directory and IT Service Management are read and updated, and IdentityPilot keeps them aligned. Adding another system means adding a connector; policy and reconciliation stay the same.
Test a policy change before it writes to production. IdentityPilot shows which accounts, groups, and devices would change across connected systems, then you decide whether to apply it.
Questions
SAP SuccessFactors, Active Directory, and IT Service Management keep doing their jobs; IdentityPilot reads them, compares access with policy, and writes only the needed corrections. Adding another system later is a connector, not a re-platforming project.SAP SuccessFactors as the HR source of truth, plus Active Directory and IT Service Management for identities and devices. IdentityPilot reads the SAP source system, compares it with the target systems, and updates the targets when something changes. Each new system is a connector; the core platform stays the same.SAP SuccessFactors is read as the source of truth and is not written by IdentityPilot. Corrections go only to the managed systems.Pricing
Pricing is based on active employees. Plans start at 250 employees, include every connector and workflow, and scale with your estate — talk to sales for a quote.
Monthly price
Custom
Connectors and workflows are included. Integration work is billed time and materials.
Starter
For 250+ employees, with every connector and workflow included.
Growth
Automatic volume discounts as your estate grows.
Enterprise
For estates over 3,000 employees, plus SSO/SCIM, on-prem agents, access reviews, and rollout planning.
Book a demo and watch one HR record create accounts, order the device, update access, and leave a clean audit trail.
GDPR COMPLIANT