Identity and access management
BambooHR to Okta integration: employees from BambooHR as Okta users, on time at departure too
With an integration between BambooHR and Okta, every new employee in BambooHR becomes an Okta user with job title, department, location and manager, and access closes on the termination date in BambooHR. KoppelHet responds straight away to the notification from BambooHR, also for a departure with immediate effect, and deactivates in the time zone of the location.
What the integration does
Organisations that use BambooHR and Okta want access to close at the moment of departure. A leaver can now keep access until the next morning, and with a summary dismissal HR has to phone IT.
- HR creates a new employee in BambooHR with start date, job title, department and location.
- BambooHR reports the change; KoppelHet retrieves the employee and stages the user in Okta.
- On the start date the user becomes active and Okta assigns the apps of department and location through groups.
- The work email goes back to BambooHR, so HR has the right address in the record.
- On the termination date, in the time zone of the location, KoppelHet deactivates the user; for an agreed termination reason immediately.
What to watch for with BambooHR and Okta
- KoppelHet responds to the notification from BambooHR and deactivates immediately for agreed termination reasons, without waiting for a scheduled import.
- With offices in Europe and America the time zone makes half a working day of difference. KoppelHet deactivates at the end of the last working day in the time zone of the location in BambooHR.
- Interns and contractors are not always recorded as employees in BambooHR. KoppelHet agrees per type of employment who gets an account.
- BambooHR gives the manager as an email address, while Okta expects a reference to a user. KoppelHet looks up the manager's Okta user, so approvals in apps behind Okta reach the right person.
- A change that reaches BambooHR from Okta can overwrite HR data. KoppelHet only writes back the work email; everything else stays leading in BambooHR.
- A deleted record in BambooHR is usually a mistake, not a departure. KoppelHet does not deactivate then, but reports it to IT.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
What about audit logging, GDPR and our integration platform?
Every action of the integration is in the audit logging of the KoppelHet platform. You are the controller and KoppelHet is the processor, under a data processing agreement; compensation data from BambooHR stays outside the integration. An existing integration platform is left alone.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- KoppelHet reads BambooHR through event-based webhooks (employee.created, employee.updated with monitor fields, employee.deleted), signed with HMAC SHA-256, and the changed-employees endpoint as a safety net. terminationDate and supervisorEmail are read-only; the work email goes back through update-employee (workEmail).
- Okta is written through the Users API (create without activation, activate, deactivate) or through a Custom Identity Source with the Identity Sources API.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in BambooHR | Field in Okta | Notes |
|---|---|---|
employeeNumber | employeeNumber | |
preferredName of firstName | firstName | |
lastName | lastName | |
Naamgevingsregel | login en email | |
jobTitle | title | |
department | department | |
division | division | |
location | city en countryCode | Through a table per location, also for the time zone |
supervisorEmail | managerId en manager | Looked up through the manager's Okta user |
employmentStatus en terminationDate | status (STAGED, ACTIVE, DEPROVISIONED) |
Related
Ashby → BambooHR
Ashby to BambooHR integration: hire, changed start date and employment status in BambooHR
BambooHR → 4PS Construct
BambooHR to 4PS Construct integration: employees from BambooHR in the 4PS company of their location
BambooHR → Active Directory
BambooHR to Active Directory integration: accounts in your own domain from HR
BambooHR → ADP iHCM
BambooHR to ADP iHCM integration: salary, bonuses and commissions to Dutch payroll