Identity and access management
ADP iHCM to Okta integration: ADP as the HR source for Okta, with groups per country
With an integration between ADP iHCM and Okta, ADP becomes the HR source for Okta. Every employee from iHCM gets an Okta user with job title, department, manager and country, and joins the groups for their department and country; after the leaving date Okta deactivates the user and access to all connected apps.
What the integration does
Organisations that run payroll and personnel in several European countries with ADP iHCM and use Okta as their access gateway often put new employees into Okta by hand or with a CSV file. Apps that differ per country are assigned by hand, and leavers keep access until next month's file.
- The organisation grants KoppelHet read access in ADP to workers and notifications, and the Okta account team enables a custom HR source.
- ADP reports a new employee; KoppelHet fetches the worker and picks the primary work assignment.
- KoppelHet delivers the employee to the HR source in Okta, with department and country as groups.
- Okta creates the user and assigns the apps that belong to the groups.
- After the leaving date KoppelHet removes the employee from the HR source, and Okta deactivates the user.
What to watch for with ADP iHCM and Okta
- iHCM records the country of the workplace for every work assignment. KoppelHet turns that into a group per country in Okta, so a new colleague in Spain automatically gets the local apps and a colleague in the Netherlands does not.
- On a rehire ADP sends the same notification as for a new employee. Because KoppelHet gives Okta the ADP reference number as the fixed key, Okta reactivates the old user instead of creating a second login.
- ADP sends the departure notification again when the date or reason changes. KoppelHet then adjusts the moment the employee leaves the HR source, so Okta does not deactivate on a date HR has already moved.
- In Okta's HR source every field is text. KoppelHet writes the hire and leaving date from ADP in one fixed format, so rules in Okta can act on those dates, for example an app that only comes after the probation period.
- ADP returns at most a hundred workers per request, Okta accepts two hundred per delivery. For the daily full comparison KoppelHet first collects all workers from ADP and then delivers them to Okta in one session.
- Employees in iHCM can have a manager and a supervisor. KoppelHet gives Okta the manager ('Reports to'), because ADP also sends leave requests there, so approvals in apps behind Okta follow the same line.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Does salary data go to Okta?
No. KoppelHet only reads person and work assignment data; salary and BSN stay in ADP.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- ADP iHCM is read through the Worker Management API (GET /hr/v2/workers with $top at most 100 and $skip; per worker on associateOID or workerID) and notifications worker.hire, worker.terminate and worker.workAssignment.modify. Fields include workerID/idValue, legalName, workAssignments (primaryIndicator, jobTitle, homeOrganizationalUnits, homeWorkLocation/address/countryCode, assignmentCostCenters, reportsTo, hireDate) and workerDates/terminationDate.
- Okta is fed through the Identity Sources API (Custom Identity Source, Anything-as-a-Source) with sessions, bulk-upsert for users, bulk-groups-upsert and bulk-group-memberships-upsert for department and country, and bulk-delete on departure (Okta deactivates). At most 200 entities per request; profile attributes as strings only.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in ADP iHCM | Field in Okta | Notes |
|---|---|---|
Reference number (workerID) | externalId en employeeNumber | |
Known As of First Name | firstName | |
Last Name | lastName | |
Work Email of naamgevingsregel | login en email | |
Job Title | title | |
Organisation Unit | department en groep | |
Location (landcode) | countryCode en groep per land | |
Reports to | managerId | |
Cost Centre | costCenter | |
Date of Join en Date of Leaving | Eigen attributen als tekst |
Related
ADP iHCM → Active Directory
ADP iHCM to Active Directory integration: network accounts per country, with an expiry date for temporary contracts
ADP iHCM → Coupa
ADP iHCM to Coupa integration: approved Coupa expenses as a variable pay field in ADP iHCM NL
DyADP iHCM → Dyflexis
ADP iHCM to Dyflexis integration: employees and contracts in scheduling, hours back to ADP
ADP iHCM → Microsoft Entra ID
ADP iHCM to Entra ID integration: accounts from ADP payroll, with the right licence in every European country