Identity and access management
Deel to Okta integration: employees, EOR and contractors from Deel in Okta
With an integration between Deel and Okta, everyone who works for you through Deel, whether employee, EOR employee or contractor, gets an Okta user with job title, team, country and manager, and access stops when the contract ends. KoppelHet reads the people from Deel, applies its own rules per type of work relationship and keeps the same Okta account when someone moves between contract types.
What the integration does
Organisations with own staff, EOR employees and contractors in Deel and access through Okta often give contractors the same apps as permanent staff. Someone who moves from contractor to EOR gets a new account and loses their files.
- A contract is signed in Deel; the person shows there as not started.
- KoppelHet stages the user in Okta, with the type of work relationship and the country of the contract.
- On the start date the user becomes active; groups per type of work relationship decide which apps are available.
- When someone moves from contractor to EOR or to your own entity, it stays the same Okta user with new groups.
- After the last day of the last contract KoppelHet deactivates the user.
What to watch for with Deel and Okta
- For payroll only your own employees count, but for Okta everyone who works in your systems counts. The type of work relationship from Deel goes along, so a contractor in Okta can have different apps and an end date of their own than a permanent employee.
- When someone moves from contractor to EOR or to your own entity, Deel creates a new contract. KoppelHet links the Okta user to the person and not to the contract, so the colleague keeps their account and access.
- Anyone who has not started in Deel shows as not started. KoppelHet then stages the Okta user without the ability to sign in, and activates it on the start date.
- Deel provides the work email of the direct manager with every person. KoppelHet uses it to look up the manager's Okta user, even when the manager works at another entity or in another country.
- Deel stops sending notifications to an address after ten failed attempts, after about a day. KoppelHet monitors that and compares all active people in Deel with Okta every day, so the end of a contract never depends on a single notification.
- A manager has to exist in Okta before an employee can refer to them. If a new manager and their new team member come from Deel at the same time, KoppelHet first creates both users and sets the manager relationship in a second pass.
- Deel recommends deactivating a user when a contract ends rather than deleting them, for the audit trail and a possible rehire. KoppelHet therefore deactivates the Okta user and does not delete it.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Do contractors get an Okta account too?
If you want them to. The type of work relationship goes to Okta, so contractors fall into their own group with their own apps and end date.
What about audit logging, GDPR and our integration platform?
Every action of the integration is in the audit logging of the KoppelHet platform. You are the controller and KoppelHet is the processor, under a data processing agreement; only the fields in the design are transferred and payroll data from Deel stays outside the integration. An existing integration platform is left alone.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- KoppelHet reads Deel through the HRIS People API (worker_id, hiring_type, person_status ACTIVE, NOT_STARTED or INACTIVE, employments with client_legal_entity and termination_last_day, direct_manager.work_email) and webhooks such as Worker V2 Created, Updated and Deleted, signed with x-deel-signature (HMAC-SHA256), idempotent on event_id.
- Okta is written through the Users API with an OAuth 2.0 service app (create without activation, activate, deactivate) or through a Custom Identity Source with the Identity Sources API.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Deel | Field in Okta | Notes |
|---|---|---|
worker_id | employeeNumber | |
preferred_first_name of first_name | firstName | |
last_name | lastName | |
Naamgevingsregel | login en email | |
job_title | title | |
department | department | |
hiring_type | userType | Employee, EOR or contractor |
country | countryCode | |
direct_manager.work_email | managerId en manager | |
person_status en termination_last_day | status (STAGED, ACTIVE, DEPROVISIONED) |
Related
Ashby → Deel
Ashby to Deel integration: hires at the own entity as direct employee in Deel
Bullhorn → Deel
Bullhorn to Deel integration: first placement as a direct employee with a contract in Deel
Carerix → Deel
Carerix to Deel integration: successful placement as a person or contract in Deel
Deel → 4PS Construct
Deel to 4PS Construct integration: own employees of the construction entity in 4PS, with department and cost centre as dimensions