Identity and access management
ADP Workforce Now to Ping Identity integration: PingOne users from Workforce Now, with the right leaving date
With an integration between ADP Workforce Now and Ping Identity, every employee from Workforce Now gets a PingOne user in the population of their company or country, with job title and manager, and is disabled on the last working day. PingOne has no ADP source; KoppelHet processes ADP's notifications, writes through PingOne's SCIM API and writes the email address back to ADP.
What the integration does
Organisations with ADP Workforce Now for HR and PingOne for sign-in and MFA often load users with a CSV file from ADP. A departure that HR enters ahead then locks the colleague out too early, and on a rehire they have to register MFA again.
- Through ADP KoppelHet gets access to the Worker API and the notifications, limited with People Access.
- PingOne gets a Worker app with the Identity Data Admin role and a custom attribute for the manager.
- Together with you we record which companies or countries go to which population and what leave does.
- At go-live we link existing PingOne users to their associateOID.
- After that KoppelHet processes every notification and sets the PingOne address as business email in ADP.
What to watch for with ADP Workforce Now and Ping Identity
- As inbound source PingOne only knows an LDAP gateway, SCIM and Workday, and advises the SCIM Users API for imports. KoppelHet uses that API for Workforce Now and adds a return path to ADP, because SCIM in PingOne sends nothing back to the source.
- For a departure with a future date ADP sets the position to terminated straight away, while the employee stays active until the date itself. KoppelHet looks at the date and only disables the PingOne user on the last working day, so the colleague can sign in until that day.
- ADP sends a notification of its own on a rehire, and the associateOID stays with the person. KoppelHet searches PingOne on externalId and re-enables the existing user, so the returning colleague keeps their MFA registration.
- Workforce Now reports leave separately, and PingOne only knows enabled or disabled. Together with you we agree whether long-term leave disables the user; KoppelHet carries out that choice on the leave notification and reverses it on return.
- PingOne accepts one email address per user, and also uses it for notifications. ADP can add and change a business address through the API. KoppelHet writes the PingOne address back as the business address in ADP, so both systems hold the same address and no private address ever ends up in PingOne.
- Which employees the integration sees is decided by ADP through People Access on the profile for Marketplace applications. If several companies run in Workforce Now, the administrator limits access there to the companies that belong in this PingOne environment, and KoppelHet picks the population per company.
- PingOne returns at most two hundred users through SCIM without a next page, and ADP returns fifty employees per request by default. KoppelHet therefore compares daily per employee on externalId, so no leaver falls outside the comparison.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
When is a leaver disabled?
On the last working day from ADP, even if HR entered the departure weeks earlier.
Is a leaver deleted from PingOne?
No, the user is disabled. Deleting remains IT's choice.
What does the integration write back to ADP?
Only the business email address. More fields can follow later as an extension.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- ADP Workforce Now Worker Management API: GET /hr/v2/workers ($top default 50, $skip, $filter), notifications worker.hire, worker.rehire, worker.onLeave, worker.terminate and worker.workAssignment.modify; writing back with /events/hr/v1/worker.business-communication.email.add and .email.change; People Access on the Marketplace profile.
- PingOne through a Worker app with the Identity Data Admin role: SCIM /v2/Users with externalId, userName, one email value, nickName, title, active and population.id in the PingOneUser extension; lists up to 200 without pagination; manager as a custom attribute of type string.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in ADP Workforce Now | Field in Ping Identity | Notes |
|---|---|---|
associateOID | externalId | |
person.legalName | name.givenName, name.familyName | |
person.preferredName | nickName | |
Naamgevingsregel | userName en emails (één waarde) | |
workAssignments (primair): jobTitle | title | |
Bedrijf of homeWorkLocation | population.id | |
workAssignments (primair): reportsTo | Manager (eigen attribuut) | |
hireDate, terminationDate, verlof | active (enabled) | |
emails (PingOne) | businessCommunication.email (ADP) |
Related
ADP Workforce Now → 4PS Construct
ADP Workforce Now to 4PS Construct integration: employees with company, dimensions and statistics group in 4PS
ADP Workforce Now → Active Directory
ADP Workforce Now to Active Directory integration: accounts in your own domain, with expiry date and rehire from ADP
ADP Workforce Now → AFAS Profit
ADP Workforce Now to AFAS integration: Dutch employees from the US HR system in AFAS Profit
ADP Workforce Now → AllSolutions
ADP Workforce Now to AllSolutions integration: employees with department, cost centre and manager in AllSolutions