Identity and access management
Exact HR to Okta integration: employees from payroll in Exact Online as the HR source for Okta
With an integration between Exact HR and Okta, every employee from payroll in Exact Online becomes an Okta user, with administration, department, job, cost centre and manager. After the end date of the employment in Exact, Okta deactivates the user, so the apps behind Okta close.
What the integration does
Organisations that process payroll in Exact Online and use Okta for access do have an app in Okta to sign in to Exact Online, but no source that takes employees from payroll. Okta users are then created by hand, and a departure in Exact goes unnoticed in Okta.
- Payroll approves KoppelHet's app in Exact Online, and in Okta the account team enables a custom HR source.
- KoppelHet fetches per administration the employees changed since the previous run, with department, job and cost centre.
- KoppelHet delivers those changes to the HR source in Okta, with a group per administration.
- Okta creates or changes the user and assigns apps through the groups.
- After the end date of the employment KoppelHet removes the employee from the HR source and Okta deactivates the user.
What to watch for with Exact HR and Okta
- The Okta catalogue has an app for Exact Online, for sign-in and access to Exact itself. According to the catalogue, that app does not deliver employees from payroll as a source. KoppelHet does that through Okta's custom HR source; the Exact sign-in app can stay.
- Employee numbers in Exact are only unique within one administration, and Okta uses the external ID to decide whether a user already exists. KoppelHet builds that ID from administration and number, so two employees numbered 100 in two administrations do not end up on one Okta user.
- Exact returns changed employees based on a sequence number, which restarts when Exact moves an administration to another database. KoppelHet reads the administration again in full after such a move. Okta recognises existing users by the external ID, so that full run creates no duplicate users.
- Okta has its own cost centre field in the user profile. KoppelHet fills it with the cost centre Exact stores with the organisation of the employment, so Okta rules and reports use the same code as the internal charging in Exact.
- In Exact an employee points to their manager's internal ID, always in the same administration. KoppelHet replaces it with that manager's external ID in Okta, so approvals in Okta reach the right person. A manager from another administration is filled in according to an agreed rule.
- Payroll data in Exact Online can only be read through the API. The Okta login address therefore does not go back to the business email field in Exact automatically; KoppelHet puts new addresses in a list for payroll.
- Exact limits the number of API requests per administration, and an Okta session takes at most two hundred users per request. KoppelHet only fetches changed employees and bundles them per run into one session, so there is room left in Exact for integrations with accounting and expenses.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
We already have the Exact Online app in Okta. Is this still needed?
That app handles access to Exact. This integration makes Exact the source for who is employed, and those are two different things.
Does this also work with Exact Globe?
This page is about payroll in Exact Online. For Exact Globe on your own server we look case by case.
Do salaries end up in Okta?
No. Only name, administration, department, job, cost centre, manager and the employment dates.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Exact Online through the REST API with OAuth 2.0 (an app in the Exact App Center, scope Hrm payroll), per {division} and GET only. /api/v1/{division}/sync/Payroll/Employees with a filter on Timestamp (EmployeeHID, FirstName, MiddleName, LastName, NameComposition, NickName, BusinessEmail, Manager, StartDate, EndDate), /payroll/EmploymentOrganizations (DepartmentDescription, JobTitleDescription, CostCenter) and /system/Divisions (DivisionMoveDate).
- Okta through the Identity Sources API (Custom Identity Source): sessions, bulk-upsert with externalId and text attributes only (at most 200 per request), bulk-groups-upsert and bulk-group-memberships-upsert for the administrations, bulk-delete at the end of employment (Okta deactivates).
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Exact HR | Field in Okta | Notes |
|---|---|---|
Administratie + EmployeeHID | externalId en employeeNumber | |
FirstName of NickName | firstName | |
MiddleName + LastName volgens NameComposition | lastName en displayName | |
BusinessEmail of naamgevingsregel | email en login | |
Administratie (division) | organization en groep | |
DepartmentDescription | department | |
JobTitleDescription | title | |
CostCenter | costCenter | |
Manager | managerId | Key of the manager in the same administration |
EndDate van het dienstverband | Uit de HR-bron (deactiveren) |
Related
Exact HR → 4PS Construct
Exact HR to 4PS Construct integration: payroll costs from Exact Online payroll as a journal in 4PS, with cost centre and project as dimensions
Exact HR → Active Directory
Exact HR to Active Directory integration: accounts from payroll in Exact Online
Exact HR → AllSolutions
Exact HR to AllSolutions integration: payroll costs from Exact Online payroll as a journal posting in AllSolutions
ASExact HR → Arbodienst (SIVI)
Exact to occupational health service via SIVI: sick and recovery notifications from Exact Online payroll to the health service