Identity and access management
ADP Workforce Now to Okta integration: ADP as the HR source for Okta
With an integration between ADP Workforce Now and Okta, ADP becomes the HR source for Okta, so a new employee gets an Okta account with the right groups and a leaver is deactivated on their end date. KoppelHet delivers the employees from ADP's Worker API to the entry point Okta has for a custom HR source, and puts the Okta address back in ADP.
What the integration does
Organisations that use ADP Workforce Now for colleagues in the United States or Canada and Okta as their access gateway see a partner's ADP connector in the Okta catalog, with its own licence. Those without it create accounts through a ticket, and a departure HR entered in ADP weeks ahead only reaches Okta when someone opens the ticket.
- In ADP we link the application to the profile for Marketplace applications and use People Access to limit which employees are visible.
- In Okta the administrator creates a Custom Identity Source and an API token for KoppelHet.
- KoppelHet reads all employees once and then processes ADP's notifications.
- Per run KoppelHet opens a session in Okta, loads users, groups and memberships and starts processing.
- KoppelHet puts the work email that Okta assigns back in ADP.
What to watch for with ADP Workforce Now and Okta
- The Okta catalog lists ADP Workforce Now by Aquera, built and maintained by Aquera and not by Okta or ADP. According to the catalog it handles creating, updating, deactivating, attribute sourcing and write-back, among others. If you have that licence, that is the route. If not, KoppelHet delivers through Okta's Custom Identity Source.
- An Okta session takes two hundred entities per load and at most fifty loads, and only one session can run per source at a time, with five minutes between two sessions. ADP returns fifty employees per request by default. For the daily comparison KoppelHet first collects all employees from ADP and then loads them in as few sessions as possible.
- If HR enters a departure with a future date in ADP, the position is immediately set to terminated but the employee stays active until that date. KoppelHet looks at the date, not at the status of the position, and only deactivates the Okta user on the end date itself.
- Workforce Now has a separate notification for leave. Okta has no leave status. With you we agree whether long-term leave deactivates the Okta user or only removes a group; KoppelHet carries out that choice on the notification and on the return.
- Okta treats the externalId from the HR source as immutable. KoppelHet therefore uses ADP's associateOID, which stays with the person, and not the employee number per position. A rehire, which ADP sends with its own notification, thus lands on the same Okta user.
- Okta's Custom Identity Source is one-way. ADP Workforce Now can add and change the business email address through the API, also in the new generation of Workforce Now. KoppelHet therefore puts the Okta address back in ADP separately, so HR and payslips have the right address.
- ADP decides which employees the integration sees with People Access on the profile for Marketplace applications. If ADP also contains companies that do not belong in this Okta environment, the administrator restricts access there, so they do not appear as an HR source in Okta.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Is there not already an ADP connector in Okta?
Yes, from Aquera, with its own licence. If you have it, KoppelHet sets it up. Otherwise KoppelHet delivers through Okta's Custom Identity Source.
What happens with a departure HR records weeks ahead?
The Okta user stays active until the end date and is deactivated on that day, even though the position in ADP is set to terminated earlier.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- ADP Workforce Now Worker Management API: GET /hr/v2/workers (50 per page by default; Prefer: respond-async up to 1,000, not in WFN Next Gen; no $orderby; count with filter not supported), Content-Type application/json;archived=true for archived employees. Notifications worker.hire, worker.rehire, worker.onLeave, worker.terminate and worker.workAssignment.modify. Write-back with /events/hr/v1/worker.business-communication.email.add and .email.change. People Access on the Marketplace Data Connector Application Profile.
- Okta Identity Sources API (Custom Identity Source): create session, bulk upsert of users, groups and memberships (200 entities or 200 kB per load, at most 50 loads per session), trigger and follow status; bulk delete deactivates; one active session per source, five minutes between sessions, session expires after 24 hours; INCREMENTAL only; profile attributes as strings only.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in ADP Workforce Now | Field in Okta | Notes |
|---|---|---|
associateOID | externalId | Must never change in Okta |
legalName of preferredName | firstName, lastName | |
Naamgevingsregel | login en email | |
jobTitle (hoofdpositie) | title | |
homeOrganizationalUnits (afdeling) | department en groep | |
Bedrijf (company code) | organization en groep | |
reportsTo | managerId | |
hireDate, terminationDate | Eigen attributen (tekst) | |
email (Okta) | businessCommunication.email (ADP) |
Related
ADP Workforce Now → 4PS Construct
ADP Workforce Now to 4PS Construct integration: employees with company, dimensions and statistics group in 4PS
ADP Workforce Now → Active Directory
ADP Workforce Now to Active Directory integration: accounts in your own domain, with expiry date and rehire from ADP
ADP Workforce Now → AFAS Profit
ADP Workforce Now to AFAS integration: Dutch employees from the US HR system in AFAS Profit
ADP Workforce Now → AllSolutions
ADP Workforce Now to AllSolutions integration: employees with department, cost centre and manager in AllSolutions