Identity and access management
Dayforce to Okta integration: Dayforce as the HR source for Okta, with dates ahead and the right manager
With an integration between Dayforce and Okta, Dayforce becomes the HR source for Okta. Every employee from Dayforce gets an Okta user with job title, department, country and the manager of their primary work assignment, and a hire or termination recorded ahead in Dayforce is processed in Okta on the right day.
What the integration does
Organisations that run HR and payroll in Dayforce and use Okta as their access gateway often put new employees into Okta with a report export. Hires recorded weeks ahead in Dayforce arrive too late, managers are wrong for employees with several work assignments, and a termination is only processed after the export.
- The organisation creates an API user in Dayforce with a role that only sees the fields and organisational units needed, and the Okta account team enables a custom HR source.
- KoppelHet requests the employees updated since the last run, and separately the hires and terminations recorded ahead.
- KoppelHet delivers the employees to the HR source in Okta, with the manager of the primary work assignment and groups per organisational unit.
- Okta creates or updates the user and assigns the apps that belong to the groups.
- On the day after the termination KoppelHet removes the employee from the HR source, and Okta deactivates the user.
What to watch for with Dayforce and Okta
- The Okta catalogue has a Dayforce connector built and maintained by a partner, not by Okta itself. Organisations that do not have it or need more, such as the manager per work assignment or rules per country, have KoppelHet deliver Dayforce through the entry point Okta offers for a custom HR source.
- Dayforce stores managers both per employee and per work assignment. Okta knows one manager per user. KoppelHet gives Okta the manager of the primary work assignment, so approvals in apps behind Okta reach the day-to-day manager.
- Without a filter Dayforce returns the whole population. KoppelHet limits each run to employees who have been updated and to the parts Okta needs, so a large group does not offer all its employees to Okta every quarter of an hour.
- Hires and terminations are often recorded weeks ahead in Dayforce. KoppelHet searches for them separately and requests the data as it applies on the effective date, so the Okta user has the job and groups of the new role on the start date.
- What Dayforce returns through the API depends on the API user's role. If a right is missing, that field is missing from the response. KoppelHet checks after every run that job, department and manager are filled before delivering anything to Okta.
- Dayforce can record an account for single sign-on per employee. If employees sign in to Dayforce through Okta, KoppelHet can write the Okta login back there, so a new colleague can also open their payslip on day one.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Why not the Dayforce connector in the Okta catalogue?
It may be enough. It comes from a partner with its own licence. If you do not have it, or want the manager per work assignment and your own rules per country, KoppelHet delivers Dayforce through Okta's custom HR source.
Does the IT team need access to Dayforce?
No. Only KoppelHet's API user, with a role HR manages in Dayforce.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Dayforce is read through the RESTful Web Services (/V1/Employees) with filterUpdatedStartDate, filterUpdatedEndDate and filterUpdatedEntities, filterHireStartDate and filterTerminationStartDate, and per XRefCode with expand for WorkAssignments, EmploymentStatuses, EmployeeWorkAssignmentManagers, Contacts and SSOAccounts, with contextDate on the effective date.
- Okta is fed through the Identity Sources API (Custom Identity Source) with sessions, bulk-upsert, bulk-groups-upsert and bulk-group-memberships-upsert, and bulk-delete on termination (Okta deactivates). Profile attributes as strings only, at most 200 per request.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Dayforce | Field in Okta | Notes |
|---|---|---|
XRefCode | externalId en employeeNumber | Fixed key |
FirstName en LastName | firstName en lastName | |
Contacts (zakelijk e-mailadres) of naamgevingsregel | login en email | |
WorkAssignments (Job, Department) | title en department | |
WorkAssignments (Location, land) | countryCode en groep | |
EmployeeWorkAssignmentManagers van de primaire toewijzing | managerId | |
EmploymentStatuses | Eigen attribuut status (tekst) | |
Termination date | Uit de HR-bron (deactiveren) |
Related
Ashby → Dayforce
Ashby to Dayforce integration: have Dayforce validate the hire first, then save it
Bullhorn → Dayforce
Bullhorn to Dayforce integration: first placement of an employee as an employee in Dayforce
Carerix → Dayforce
Carerix to Dayforce integration: successful placement as a validated new employee in Dayforce
Dayforce → 4PS Construct
Dayforce to 4PS Construct integration: technicians and site managers from Dayforce in 4PS, with cost centre and end date