OIIdentity and access management
ADP Workforce Now to One Identity integration: Workforce Now as HR source for One Identity Manager
With an integration between ADP Workforce Now and One Identity Manager, every employee from Workforce Now becomes a Person with department, job, manager and dates, and One Identity Manager removes rights on the end date from ADP. Starling Connect has no ADP connector; KoppelHet fetches the employees through the Worker API, delivers them to the CSV connector that comes with One Identity Manager, and writes the work email back to ADP.
What the integration does
Organisations with ADP Workforce Now and One Identity Manager often read ADP through a report someone exports daily. A departure that HR enters ahead then removes rights too early, and HR retypes the work email that One Identity Manager creates into ADP.
- Through ADP KoppelHet gets access to the Worker API and the notifications, limited with People Access.
- In One Identity Manager we set up a CSV system connection with an employee file and a department file.
- KoppelHet updates the files after every ADP notification and runs a daily comparison.
- Together with you we agree what leave does to rights and which columns One Identity Manager uses.
- As soon as One Identity Manager has created a work email, KoppelHet sets it as the business email in ADP.
What to watch for with ADP Workforce Now and One Identity
- The Starling Connect release notes up to February 2026 contain no ADP connector, and the Cloud HR Systems module has templates for Workday, SuccessFactors and Dayforce. For Workforce Now KoppelHet uses the CSV connector that comes with One Identity Manager, without an extra subscription.
- ADP calls the associateOID unique across all of ADP, the workerID unique per client and the positionID unique per position. An employee with two positions thus stays one row in the file, with the associateOID as key; the primary position decides department and manager.
- For a departure with a future date ADP sets the position to terminated straight away, but the employee stays active until that date. KoppelHet only fills ExitDate and leaves the Person active, so One Identity Manager revokes rights on the last working day and not on the day HR enters the departure.
- Workforce Now has a separate notification for leave. One Identity Manager has no leave status of its own. KoppelHet puts leave in a column of its own, so you can choose in One Identity Manager whether long-term leave, for example, temporarily revokes remote access.
- Employees that ADP has archived are only returned by the Worker API with an extra header. Without that header they drop out of the comparison. KoppelHet does request them, so former employees stay in the file with their ExitDate until after the period you keep accounts.
- The CSV connector only reads. KoppelHet therefore writes the work email that One Identity Manager creates back to ADP itself, which can add and change business email addresses through the API, also in the new generation of Workforce Now. Payslips and ADP notifications then carry the right address.
- ADP returns sensitive fields such as date of birth and social security number masked by default. KoppelHet does not request them unmasked, so they never end up in a file on the One Identity Manager server.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Why files and not a direct connector?
One Identity has no ADP connector. The CSV connector comes with One Identity Manager; KoppelHet makes sure the files are always current and complete.
What happens with a departure HR enters ahead?
The Person stays active until the end date. Only then does One Identity Manager revoke the rights.
Does the integration write back more than the work email?
No. Writing other fields back to ADP can follow later as an extension.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- ADP Workforce Now Worker Management API: GET /hr/v2/workers ($top, $skip, $filter), Content-Type application/json;archived=true for archived employees, sensitive fields masked unless masked=false; notifications worker.hire, worker.rehire, worker.onLeave, worker.terminate and worker.workAssignment.modify; writing back with /events/hr/v1/worker.business-communication.email.add and .email.change; People Access on the Marketplace profile.
- One Identity Manager CSV connector: system connection with employee and department file (UTF-8, header row), key column per file, hierarchical sort order on the department path, read-only, synchronisation step as data import; through a remote connection server where needed. Starling Connect release notes (27-02-2026) without an ADP connector.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in ADP Workforce Now | Field in One Identity | Notes |
|---|---|---|
associateOID | Sleutelkolom (Person) | |
workerID | PersonnelNumber | |
person.legalName | FirstName, LastName | |
workAssignments (primair): jobTitle | Kolom functie | |
workAssignments (primair): homeOrganizationalUnits | Afdelingspad (hiërarchie) | |
workAssignments (primair): reportsTo | Kolom leidinggevende | |
hireDate, terminationDate | EntryDate, ExitDate | |
worker.onLeave | Kolom verlof | |
Werkadres (One Identity Manager) | businessCommunication.email (ADP) |
- ADP – Worker Management API Guide for ADP Workforce Now (PDF)
- ADP – Worker Termination API Guide for ADP Workforce Now (PDF)
- One Identity Manager 9.1.2 – CSV Connector User Guide (PDF)
- One Identity Manager 9.3 – Administration Guide for Connecting to Cloud HR Systems (PDF)
- One Identity – Starling Connect Release Notes (PDF)
Related
ADP Workforce Now → 4PS Construct
ADP Workforce Now to 4PS Construct integration: employees with company, dimensions and statistics group in 4PS
ADP Workforce Now → Active Directory
ADP Workforce Now to Active Directory integration: accounts in your own domain, with expiry date and rehire from ADP
ADP Workforce Now → AFAS Profit
ADP Workforce Now to AFAS integration: Dutch employees from the US HR system in AFAS Profit
ADP Workforce Now → AllSolutions
ADP Workforce Now to AllSolutions integration: employees with department, cost centre and manager in AllSolutions