Recommendation to update permissions for 1Password SaaS Manager customers with existing BambooHR connections
BambooHR has made changes to its API permission model. Customers using a restricted Custom Access Level for SaaS Manager may need to update the permissions that SaaS Manager has been granted.
Reports access for employee data
SaaS Manager now uses BambooHR’s newer employee dataset API to sync employee data. This API requires the BambooHR integration user/API key to have Reports access. Without this permission, BambooHR may return a 403 Forbidden error and the integration will need to be reconnected after permissions are updated.
To fix this:
Log in to BambooHR as an administrator.
Navigate to Custom Levels, and select the custom role you created for SaaS Manager.
Select Access Level Settings > What can people with this access level do?, then select Reports.
Set Dashboard Access to View Only.
Select All Data.
Select Save.
Reconnect your BambooHR integration in SaaS Manager.
BambooHR uses an API key to grant access. This has the same permissions as the user who creates the key.
For this reason we recommend creating a Custom Access Level, and creating and assigning a new user account to this level.
This means you can securely restrict the BambooHR data fields that SaaS Manager has access to.
Create a Custom Access Level
Select the gear icon in the top-right corner of the page to go to the Settings page.
Select Access Levels, then select the + button, and select Custom Access Level.
Enter a name for your Custom Access Level, such as SaaS Manager Integration Permissions, and a description.
Select Next Step to open the What Can People with this Access Level Can Do screen.
Navigate to the Reports section, then do the following steps to turn on Reports access for SaaS Manager:
- Set Dashboard Access to View Only.
- Select All Data.
This is required for SaaS Manager to access BambooHR’s employee dataset API. Without this permission, BambooHR may return a 403 Forbidden error when SaaS Manager syncs employee data.
Go to Settings and select the box next to Company Field Settings. This is required for SaaS Manager to view the contents of dropdown lists in Bamboo.
Select Next Step again.
On the What Can People with this Access Level See step you can set the specific permissions to grant to SaaS Manager.
Configure the following fields as View Only:
Personal tab:
- Basic Info > Status
- Basic Info > Employee #
- Basic Info > First Name
- Basic Info > Last Name
- Basic Info > Preferred Name
- Contact > Work Email (set to Edit if you want to use the workflow step to update work email)
- Contact > Home Email (this is important for onboarding)
Job tab:
- Hire Date
- Employment Status > Employment Status: Date
- Employment Status > Employment Status
- Job Information > Job Title
- Job Information > Department
- Job Information > Division
- Job Information > Location
- Job Information > Reporting to
You will also need to complete the See About Themselves tab:
When you are done, click Save and Finish
Create a non-Employee user
Go back to the Settings page (click the gear icon in the top-right corner of the page).
Select Access Levels, then select the Custom Access Level you just created (likely called SaaS Manager Integration Permissions).
Select the small gear icon dropdown to the right of "Access Level Settings" and select Add a Non-Employee BambooHR User.
Now enter a name, such as First name SaaS Manager, and Last name Integration.
Enter an email address that you have access to.
If you use Google for your company email, you can enter a special email using a "+" character, as a separator. For example,
jane.doe+SaaSManager.bamboo@example.org
This will be sent to jane.doe@example.org as normal, but lets you use a distinctive email for the integration user account.
Set the Access Level dropdown to the Custom Access Level you just created (likely called SaaS Manager Integration Permissions).
Select Save.
Once the user has been created you'll receive a welcome email in the inbox of the email address you just entered.
Follow the steps in this email to create a password for the user.
Create an API key
Sign-in to BambooHR with the email and password you just created.
Select your profile icon in the bottom left, then select API Keys.
In the API Keys screen, select Add a new key.
Copy this API key and paste it into the API key field when you connect to BambooHR from SaaS Manager.
Comments
0 comments
Please sign in to leave a comment.