Should a first release integrate DingTalk, WeCom, or an enterprise OA system?
Integrate an enterprise collaboration platform in phase one only when it is a prerequisite for the core workflow. If staff must sign in through DingTalk, WeCom, or OA, organization structure controls data access, or an approval changes the business state, the release cannot be accepted realistically without it. If integration only sends group notices, adds a workbench shortcut, or removes one login, defer it until the independent loop is stable.
Map dependencies among employee, organization, role, approval, message, and business records. If removing the external platform still lets an authorized user sign in, find work, decide, and avoid duplicate maintenance, it is an experience enhancement. If the system cannot identify the manager, apply an approval, or satisfy the enterprise account policy, it belongs in phase one.
When comparing platform capabilities, constraints, and switching costs, also compare Should we build a website, WeChat mini program, or app first? and Can a website, mobile web, admin system, mini-program, and app share one product plan?; the linked guidance adds context that should be considered in the same decision.
| Capability | Include now when | Defer when | Main risk |
|---|---|---|---|
| SSO | Unique enterprise entry or account lifecycle is mandatory | Independent accounts are allowed for a small pilot | Wrong binding, failed offboarding, token leakage |
| Organization sync | Department or reporting line drives permission and flow | A few roles can be administered manually | Master-data conflict, deletion meaning, duplicates |
| Approval link | Approval is a prerequisite for contract, order, or other core state | The first release can approve internally | State divergence, duplicate callback, withdrawal recovery |
| Message and task | Without it the user cannot meet fulfilment or SLA | Work is visible in-system and infrequent | Duplicate/order, limits, sensitive disclosure |
| Workbench entry | Enterprise device permits only that route | URL or app access is acceptable | Container compatibility and navigation |
Assign a source of truth for employee ID, phone, department, and position rather than allowing two systems to overwrite each other. The enterprise directory normally owns employment and organization; the business application owns business roles and authorization range. Define add, change, deactivate, restore, merge, and temporary failure. Deactivate a person while retaining historic business records instead of destructive deletion.
SCIM RFC 7644 offers useful user, group, filtering, bulk, and error concepts even where the platform does not support SCIM. Follow current platform OAuth and callback rules; OAuth 2.0 Security BCP RFC 9700 covers common attacks but does not replace the target console.
The client supplies the chosen platform, administrator, app type, test organization, and internal approval timing. Wavesteam verifies current authorization, contacts, callbacks, and messaging in the DingTalk Open Platform or WeCom developer documentation. A custom OA requires its actual interface, examples, and test environment.
Even a mandatory integration should use only the fields and events the core flow needs: identity, employment state, department ID, and one approval result, for example. Do not collect salary, private phone, or unrelated departments because the API exposes them. Use stable IDs and a versioned mapping rather than department names.
Acceptance covers new employee, role change, offboarding, department rename, phone collision, duplicated and reordered callback, timeout, expired token, replay, and reconciliation. A successful message API call is not evidence the user read or completed work. If integration is deferred, phase one retains a stable internal user ID, mapping table, and event interface instead of using phone as a permanent key.
Wavesteam hands over field mapping, scopes, callback contract, synchronization recovery, tests, administrator procedure, and incident guide. The client controls the platform account and can revoke Wavesteam and export mappings when the provider or team changes.