Rippling Integration

Overview

What the integration does

The Rippling integration makes Rippling the source of truth for who works at your company and who can use Fencer. Once connected:

Your employee directory feeds Identity Management. Fencer imports every person in your Rippling company with their name, work email address and active or inactive status. It matches each one to the accounts the same person holds in your other connected vendors, so you can see everyone’s access in one place.
Fencer access follows Rippling. When you give an employee access to Fencer in Rippling, they get a Fencer account in your organization with the Member role. When you take that access away, or Rippling terminates them, they lose access to your Fencer organization.
Your team signs in with Rippling. People can open Fencer from the Fencer tile in Rippling or choose Rippling on the Fencer login page. You can require Rippling sign-in for your whole organization.

Why use it

Onboarding and offboarding happen in one place. You no longer have to invite new hires to Fencer, or remember to remove them when they leave.
You get an authoritative identity list. With Rippling as your primary identity source, the names and emails in Rippling are the ones Fencer shows across your identity inventory.
You need fewer passwords. Employees use the Rippling sign-in they already have.

When to use it, and when not to

Use the Rippling integration when Rippling is your HR system of record and you want Fencer access to be granted and removed from Rippling.

Consider something else, or an additional integration, when:

You need SAML single sign-on or SCIM attribute control. The App Shop integration signs people in with OpenID Connect. If your security policy requires SAML, or SCIM provisioning you configure yourself, follow Rippling SSO and SCIM setup instead.
You need roles, groups, MFA status or last sign-in times for your identities. Rippling does not share them. Connect your identity provider as well, for example Google Workspace or Microsoft Entra.
You run several Rippling companies. A Fencer organization connects to exactly one Rippling company, and a Rippling company connects to exactly one Fencer organization.
You want a device or application inventory. The integration reads people only. For devices, use an endpoint integration such as Iru.

Installation

Prerequisites

A Rippling administrator who is allowed to install apps from the Rippling App Shop.
To connect an existing Fencer organization: the Fencer Admin role, or any role that can manage integrations, in that organization.
An active Fencer subscription.
To import your directory into Identity Management: a Fencer plan that includes Identity Management. Account provisioning and Sign in with Rippling work on any plan.
Every employee who should get Fencer access needs an email address in Rippling.

Option A: Install from the Rippling App Shop

In Rippling, open the App Shop, find Fencer and install it.
Review the permissions Fencer asks for and approve them. Rippling then sends you to Fencer.
What happens next depends on whether you already use Fencer:
- New to Fencer: Fencer creates your account and an organization named after your Rippling company, connects Rippling to it and opens a short onboarding. When you finish or skip onboarding, Fencer sends you back to Rippling.
- You already have a Fencer account with the same work email: Fencer asks you to sign in. Then it either creates a new organization for you (new purchase), or asks which of your existing organizations to connect (existing customer). Only organizations where you can manage integrations are listed.
In Rippling, give Fencer access to the employees who should use it (see After installing).

Option B: Connect from Fencer

In Fencer, go to Settings > Integration Settings.
Find Rippling under Available Integrations and click it.
Read the summary, click Continue, then click Connect Rippling.
Sign in to Rippling as an administrator and approve the requested permissions.
Rippling sends you back to Fencer, and the connection appears under Active Integrations with your company name. The first sync starts automatically.

After installing

Give employees access in Rippling. Use the Fencer app’s access settings in Rippling to choose who can use Fencer. Fencer adds them to your organization with the Member role within moments of the change, and at the latest during the nightly sync. You can change anyone’s role in Fencer afterwards; Rippling never overwrites roles.
Optional: make Rippling your primary identity source. Open the Rippling connection, click Edit and turn on Primary Identity Source. If Rippling was the first identity integration you connected, it is already the primary source.
Optional: require Rippling sign-in. First sign in with Rippling yourself. Then go to Settings > Authentication > Auth requirements and choose Require for Rippling. Fencer then accepts only Rippling sign-ins by employees of the Rippling company connected to your organization. Choose Deny to stop anyone signing in with Rippling.

Disconnecting

You can disconnect from either side:

In Fencer: open the Rippling connection under Settings > Integration Settings and click Disconnect.
In Rippling: uninstall the Fencer app. Fencer emails your organization’s admins to let them know the integration was disconnected.

Either way:

Rippling identities are removed from your identity inventory.
People whose Fencer accounts Rippling created lose access to your organization.
You, and anyone else who can manage integrations, keep access, so the organization is never locked out.
A Require Rippling sign-in rule is removed, so nobody is locked out. A Deny rule stays.

Your Fencer organization and everything else in it stay as they are. If you reconnect later, people get their access back with the roles they had before.

Data flows

Fencer only reads from Rippling. The one exception is that Fencer tells Rippling when the app is installed. Fencer reads:

Your company’s name.
Who installed the app.
Each person’s name, email addresses and active or inactive status.
The list of people you have given access to Fencer.

Fencer does not read departments, job titles, managers, compensation, start or end dates, devices or apps.

Flow	What it does	When it runs	Run it yourself
First sync	Imports your directory into Identity Management, then gives Fencer access to everyone you have granted it to in Rippling.	Shortly after you connect or reconnect.	Reconnect, or use Sync Employees.
Directory import	Re-imports every Rippling person. People who are inactive or no longer in Rippling are marked deprovisioned. Requires the Identity Management plan feature.	Every night.	Sync Employees.
Access sync	Adds people you have newly given access to, removes people whose access you took away, and refreshes names on accounts Rippling created.	Every night.	Sync Employees.
Real-time updates	Applies changes as Rippling reports them (see below).	Within moments of the change in Rippling.	Not needed. Sync Employees catches anything missed.
Sign in with Rippling	Signs a person in to Fencer. No directory data changes.	Each time someone signs in with Rippling or clicks the Fencer tile in Rippling.	Not applicable.

Real-time updates cover these changes in Rippling:

Change in Rippling	What Fencer does
An employee is given access to Fencer, or their details change	Refreshes their identity, and adds them to your organization if they are active.
An employee with access is made inactive	Marks them deprovisioned and removes their access.
An employee is terminated or deleted	Marks them deprovisioned and removes their access.
Your company is renamed	Updates the company name shown on the connection.
The Fencer app is uninstalled	Disconnects the integration as described in Disconnecting.

Triggering a sync manually

Go to Settings > Integration Settings and open your Rippling connection.
Click Edit.
Under Manual Sync, click Sync Employees.

This runs the directory import and then the access sync straight away. You need permission to manage integrations to see the button. Possible messages:

“Employee sync has been queued and will complete shortly.” The sync has started and completes in the background.
“A sync is already in progress for this connection.” Wait for the current sync to finish.
“Unable to sync. Please ensure the connection is healthy.” The connection is broken. Click Reconnect on the same page first.

FAQs

I gave someone access in Rippling, but they are not in Fencer. Why?

Check these in order:

The sync hasn’t run yet. Click Sync Employees on the connection’s Edit page.
They have no email address in Rippling. Fencer skips people without one. Add a work email in Rippling, then sync again.
They are inactive in Rippling. Only active employees get access.
A deleted Fencer account already uses their email. Fencer won’t reuse it automatically. Contact support@fencer.dev to resolve it.

How quickly does someone lose access when they leave?

As soon as Rippling reports the termination, usually within moments. The nightly sync is a backstop if an update is missed.

Scenario: You terminate a contractor in Rippling at 3 pm. Fencer removes their membership right away. If Rippling created their account and it belongs to no other Fencer organization, the account is also deactivated and its open sessions end, so they can no longer sign in.

An employee already had a Fencer account before we connected Rippling. What happens?

Fencer adds their existing account to your organization; it does not create a second one. Rippling only manages their membership in your organization. Their account itself stays theirs: Rippling won’t rename, deactivate or reactivate it, and they keep any other organizations and sign-in methods they had. To use Sign in with Rippling, they sign in the way they normally do, then connect Rippling from Profile > Security > Connected sign-in accounts > Connect new.

Sign in with Rippling only signs in to an account Rippling created or one the person has connected to Rippling themselves. It never matches accounts by email alone. Either:

give them access to Fencer in Rippling, then have them sign in again; or
if they already have a Fencer account, have them sign in another way and connect Rippling from Profile > Security.

An account Rippling created belongs to Rippling until its owner proves their email address. Proving it another way, such as an emailed code, confirming the address or a password reset, makes the account theirs alone. Fencer then disconnects its Rippling sign-in and Rippling stops managing it. To keep using Rippling, they connect it again from Profile > Security.

Which email address does Fencer use?

The address Rippling marks as primary. Otherwise the work address. Otherwise the first one listed. Fencer prefers the work address because Rippling often lists a personal address first. Make sure each employee’s work email in Rippling matches the address they use in your other tools, so Fencer can match their identities.

Scenario: An employee’s work email in Rippling is sam@example.com, but Google Workspace has sam.lee@example.com. Fencer can’t match them by email, so it falls back to name matching and flags the match for review in Identity Management. Fixing the email in Rippling resolves it at the next sync.

Are contractors treated differently from employees?

No. Contractors are imported and provisioned exactly like employees.

Can I connect more than one Rippling company, or one company to several organizations?

No. If you try, Fencer refuses with one of these messages:

“Your organization is already connected to another Rippling company. Disconnect it first.”
“Your company is already connected to another Fencer organization. An admin of that organization has to disconnect Rippling before it can be connected here.”

To move a Rippling company to a different Fencer organization, disconnect it from the first one, then connect it to the second.

The connection shows as broken. What does that mean?

Click Reconnect on the connection’s Edit page in every case. Reconnecting re-authorizes Fencer with Rippling and runs a fresh sync. The messages mean:

“The Rippling integration … is not working as expected.” Fencer could no longer reach Rippling, usually because access was revoked in Rippling.
“Fencer could not read which employees have access in Rippling.” Fencer could not read your Fencer access list from Rippling, so it changed nothing.
“Rippling reported that no employees have access to Fencer, so no access was removed.” This is a safety guard. If Rippling suddenly reports nobody, Fencer assumes something is wrong rather than removing your entire team. If you really did remove everyone’s access, reconnecting confirms it.

Should Rippling be my primary identity source?

Make it primary if Rippling holds the most accurate names and emails for your people. The primary source’s names and emails are the ones Fencer shows for each person across Identity Management. Only one integration can be primary at a time. Choosing Rippling asks you to confirm replacing the current primary source.

Requiring it is a good choice when everyone who uses Fencer is in your Rippling company. Before you switch it on, make sure:

every admin can sign in with Rippling; and
outside users who are not Rippling employees, such as auditors or consultants, have another way in, because they won’t be able to sign in once Rippling is required.

What happens to our data if we uninstall?

See Disconnecting. In short:

Rippling identities leave your identity inventory.
Accounts Rippling created lose access.
Everything else in your organization stays.
Reconnecting restores access with people’s previous roles.

We approved new permissions for Fencer in Rippling. Do we need to do anything?

Yes. Rippling does not add new permissions to an existing install. Click Reconnect on the connection’s Edit page to approve them.

Why do Rippling accounts show “Active vendor account has no role information” in access reviews?

Rippling does not share application roles with Fencer, so this is expected for Rippling identities. Roles for the same person come from your other connected vendors.

Does Fencer change anything in Rippling?

No. Fencer only reads from Rippling, apart from telling Rippling that the app finished installing.