S2 develops an array of physical security solutions for large corporations, including access control, video surveillance, event monitoring, digital signage, live Internet-sourced, real-time data and information feeds, mobile applications, and cloud-based services.
How does this integration work?
The Envoy + S2 integration streamlines the process of logging and assigning access cards to visitors. When a visitor signs in, Envoy automatically creates an entry for the visitor in your S2 activity log. S2 then assigns the visitor an access card with the appropriate expiration date and access level.
If you use Envoy’s block list feature, you can use the Envoy + S2 integration to kick-off security measures when an unwanted visitor tries to sign in. When visitors match to keywords on your block list, you can choose to trigger an event in S2. You can then configure S2 to take specific actions, like turn on security cameras or alert your security team.
Enabling the Envoy + S2 integration
Note: You’ll need to be an administrator on your S2 account to complete this integration and the API must be enabled on your S2 Netbox. "System Setup" credentials are needed to authenticate the API requests being made and are required when using the S2 endpoints. Either become an administrator or ask your admin for help before completing these steps:
Under Access Control, find S2 Security.
In the API step, paste or type your S2 URL in the Enter your URL field, and click “Next step.”
S2 on-premise NetBox must have an accessible public IP for Envoy to connect.
Note if non standard ports (http:80 & https:443) are used, this must be accounted for in setup.
If your S2 is configured across multiple partitions, be sure to enable "Multi-partition Mode".
On the Access Levels step, you'll choose which Envoy visitors sync to S2, as well as their permission levels
The default access level can be defined here, as well as custom access levels per Envoy visitor type.
Setting an Envoy visitor type to "none — disallow" will prevent the visitor type from being recorded as a person record in S2.
On the Credentials step, you'll choose which type of visitors will receive a QR code encoded using Wiegand 26-bit card numbers to be used for entry at an unguarded turnstile
The default setting for Facility code 0 and optional
The minimum and maximum card number can also be set to prevent the QR code from overlapping with an employees' predefined card number
On the Options step, you’ll choose where Envoy identifiers are stored, as well as how Envoy visitors that match Block List entries are treated in S2, including the ability to trigger an S2 event.
Choose if you’d like to sync 1) all visitor entries or 2) based on Envoy’s block list.
Locate the Choose preferred block list detection dropdown.
Choose if you’d like
to sync Envoy data every time a blocklist keyword is matched OR
only when the block list contact denies a visitor access.
To set up an event trigger when a blocklist entry syncs to S2, choose your event trigger from the Trigger an event when blocklist entries sync dropdown.
If you do not want to set up an event trigger, select "none" and you’re all done.
The "Customize" step allows you to define how Envoy fields are mapped in S2, how Signed-out Envoy guests are treated in S2, and more:
Map the "Host's Name" as an optional UDF in S2 (User Defined Field).
Map Envoy's QR code as an optional UDF in S2.
Use an Envoy-Generated ID (which addresses a known "wildcard" short coming in S2's default numeric person identifier).
Remove the person record in S2 record upon visitor sign-out from Envoy.
Envoy Protect + S2
If your company has Envoy Protect enabled they can edit their existing S2 integration, click on Step 2 Access Levels and click the checkbox to enable the "Envoy Protect" option. After they do that they go ahead and re-save the integration.
Before using the Envoy Protect + S2 Integration
If you haven't yet set up the integration, follow the steps from Enabling the Envoy + S2 integration first.
You'll also have to ensure that email address and last name match accordingly across S2 and Envoy as those are the fields that the integration will use to activate and deactivate employee profiles.
You'll have to set all employee profiles in S2 as expired before using Envoy Protect. Envoy will not take the responsibility of expiring all employee profiles on your behalf for this integration.
How does it work?
The employee has answered the preconfigured questions by the Envoy admins.
They pass screening based on the set of rules
(i.e. Have you been in contact with someone feeling ill over the past 14 days?)
The employee will be approved for the day that they filled out the screening for (set by the Protect Health Check Window).
When they go to the office the next day, the employee will need to "check-in" in order for their credentials to reactivated to allow them to enter the building.
❗️Tip: If your company doesn't have Envoy protect, sign up here to become a part of the beta program.
S2 Netbox required configuration
Note: If you are using an on-premise NetBox, the following configurations must be followed.
Ensure the S2 API feature is enabled on your S2 Netbox. The “Enabled” checkbox should be checked in the “API” section, which you can find in your S2 Netbox under the following menus, Configuration -> Site Settings -> Network Controller -> Data Integration.
In order for events to show up in the activity log, they need to have at least one action (Configuration -> Alarms -> Events -> Actions) created for an Event (E.g. Envoy visitor)
In order for the activity log to function, there should be at least one Network Node. The node does not need to be real (Configuration -> Site Settings -> Network Nodes -> Type: MicroNode)
If entries are not manually signed out, they expire in 24 to 48 hours depending on the timezone. The entries use local machine time, not GMT time and they are not reported via the API.
Note: Since there are two static IP addresses that would potentially connect to the S2 NetBox, "No" should be selected for "Limit Session to single IP address" to ensure that S2 doesn't block one of the two static IP addresses.
How Envoy Visitors entries look in S2
In the example below, the company Second Street Labs created an S2 event called Envoy Block list Visitor Registered. They configured the integration to sync all visitor entries. Additionally, they want to trigger the new event they created when a block list visitor is denied access.
Visitor Sophia Fitzroy signed in at 17:28. Her entry appears in the activity log as a record, but there are no additional triggered events.
Visitor Grey Ryer signed in at 18:12. His entry also appears in the activity log as a record, but, additionally, the Envoy Block list Visitor Registered event triggered since he was denied access.
How to view people created in S2 through the sign in event
In the example below, the visitor Sarah Smith has signed in with Envoy and is now accessible as a Person in S2.
Locate the visitor through Administration -> People Search
Note: If you want to automatically set access levels for visitors through Envoy, you will need to assign “Events” in Access Levels (Configuration -> Access Control -> Access Levels)
How access cards are assigned to Envoy Visitors in S2
Assigning access cards to visitors currently requires a few easy steps. Once visitors are signed out, their card will be unassigned in S2. Please follow the instructions below to assign a card to your visitors:
Log in to your S2 NetBox admin panel.
Visit the URL defined in step 4 of “Enabling the Envoy + S2 integration”.
Login using the credentials defined in step 5 of “Enabling the Envoy + S2 integration”.
Select “People Search” under the “Administration” menu in your S2 NetBox admin panel.
Search the “Find People” page using the first or last name fields based on the visitor’s information and click “Search”.
The new visitor can be selected by clicking the corresponding name in the “Name” column in the “People Search” results.
It is recommended to find the visitor by both “Name” and “Modified” columns to ensure the most recent entry for this visitor is selected.
The “People Information” page for this visitor allows a card to be assigned. Click the “Read” button under “Read Credential”.
If the card profile has already been configured, then the identifier on the back of the card can simply be entered, instead of reading.
After clicking “read”, scan the visitors unassigned card on a reader. This will assign the physical un-assigned card to the Envoy visitor’s entry in S2.
Please refer to S2 documentation if Card Formats have not yet been assigned.
Please refer to S2 documentation if Access Levels have not yet been defined.
Ready to sign up?
Get started in minutes. No credit card required. See plans and pricing →