Govern access to Rippling, Workday, and any HRIS with Opal

Your HR system holds some of your most sensitive data: pay, bank details, and personal records. It’s also one of the places where admin access tends to be broad and standing. People get added to an admin group for a project, a quarter-end task, or an audit, and they stay there long after the work is done.

Opal now integrates with Rippling, joining Workday. That means you can govern access to your HR systems the same way you govern the rest of your stack, with requests, approvals, reviews, and expiry all in one place.

What you can do with Rippling in Opal

The Rippling integration brings your supergroups into Opal so access to them can be requested, approved, reviewed, and removed with the same rules you already use elsewhere.

• Request access just in time. People can request access to Rippling supergroups from the Opal web app or directly in Slack, so they ask for what they need when they need it.

• Make access time-bound. Rippling has no expiry on supergroup membership. Opal tracks the duration of each grant and removes access on its own schedule when the time is up.

• Review access with team context. Access reviews use Rippling departments and teams as context, so reviewers can see who belongs where before they approve or revoke.

• Route approvals to the right owners. Requests go to the owners who have the most context on who should have access and why.

• See who belongs to each supergroup. Opal gives you a clear view of supergroup membership, so you always know who has access today.

What syncs

Opal reads a defined set of objects from Rippling and only writes to the ones it manages.

• Active workers, matched by their Rippling work email. Workers without a work email are skipped.

• Editable supergroups, synced as groups you can grant and revoke from Opal.

• Departments and teams, synced for visibility only. Their membership comes from each employee’s Rippling record, so Opal doesn’t change it.

• Opal doesn’t create, update, or deactivate Rippling users. Permission profiles aren’t available because Rippling doesn’t expose them through its API.

Getting set up

Setup takes a few minutes if you have the right access ready.

• You need Opal admin status and Rippling admin access.

• Create the Rippling API token with an admin who can see every department, team, and supergroup you want to manage. The token only sees what its creator sees.

• Save the token when you create it. Rippling only shows it once.

• Grant these scopes: user.read, workers.read, departments.read, teams.read, supergroups.read, and supergroups.write.

• Self-hosted Opal needs version 1.1239.0 or later. If Rippling doesn’t show up under + App, contact Opal support.

• Tip: because Opal matches people by work email, limit who can edit work email in Rippling.

Full setup steps are in the Rippling integration docs.

Workday

Opal imports Workday user-based security groups and organization roles. You can manage membership of security groups from Opal and see organization roles alongside the rest of your access.

Setup takes a few steps in Workday. Grant the Opal security group the required domain permissions, add it to the Assign Roles business process policy, and activate pending authentication policy changes. Then import the groups and roles you want to manage in Opal.

Read the Workday integration docs for the full walkthrough.

Any other HR system

If your HR system isn’t Rippling or Workday, Opal can still keep access tied to your people data. Opal reads status, team, title, and manager from Okta, Entra, or Google.

That data lets access follow hires, moves, and exits. Opal can grant access on day one, rescope it when someone changes teams, and revoke it on their last day.

One place to govern access, whatever HR system you run

Opal works the same way across every HR system. Your access policy doesn’t depend on which HR vendor you use, and switching or adding one doesn’t mean rebuilding your controls.

Your HR system, SaaS apps, cloud, and infrastructure all live under the same requests, reviews, and expiry rules. Admins get one view of who has access to what, and employees get one place to ask for it.

Ready to try it? Read the Rippling docs or book a demo.