OIIdentity and access management
Exact HR to One Identity integration: employees from Exact Online in One Identity Manager
With an integration between Exact HR and One Identity Manager, the employees from payroll in Exact Online are ready in fixed files that One Identity Manager's CSV connector reads, with administration, department, location and manager. The end date from Exact becomes the exit date, on which One Identity Manager locks the accounts.
What the integration does
Organisations with payroll in Exact Online and One Identity Manager for accounts and rights now enter new colleagues twice. As a result One Identity Manager does not always know who leaves, and departments in One Identity differ from those in payroll.
- An Exact user without roles for personal data gives KoppelHet consent through an app in the Exact App Center.
- KoppelHet fetches the changed employees and their organisation data per administration and keeps a full state.
- Before every synchronisation KoppelHet writes the department file and the employee file to One Identity Manager's folder.
- One Identity Manager reads departments in tree order and then the employees.
- On the exit date One Identity Manager locks the identity and its accounts.
What to watch for with Exact HR and One Identity
- One Identity Manager has ready-made templates for a few cloud HR systems, such as SuccessFactors and Workday, but not for Exact. KoppelHet therefore delivers the employees from Exact Online as files for the CSV connector.
- Employee numbers in Exact are only unique within an administration. The CSV connector allows several key columns, so KoppelHet delivers administration and number as two columns. Two employees with number 100 in two administrations thus stay two identities.
- Exact can anonymise an employee. One Identity Manager builds account names and display names from the names in the file and would rename accounts after such anonymisation. KoppelHet recognises the flag in Exact and only delivers that employee with their exit date, without the replaced name.
- In One Identity Manager an import from a secondary system does not mark a missing record as outstanding. KoppelHet therefore keeps an employee with an end date in Exact in the file, with that date as exit date, so One Identity Manager sees the departure itself.
- Departments in Exact exist per administration, and two administrations can have a department with the same description. KoppelHet puts the administration above the department in the path and marks that column with Hierarchical sort order, so One Identity Manager reads them as separate departments, parents first.
- Exact stores a location description per employee. KoppelHet puts it in its own column, so the administrator in One Identity Manager can grant rights for buildings or printers per location without a second source.
- After an administration moves to another database, the sequence number for changes in Exact restarts. KoppelHet then reads the administration completely again. Because the file always contains the full state, One Identity Manager notices nothing of it.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Does this also work with Exact Globe?
This page is about payroll in Exact Online. Exact Globe on-premise is outside our scope.
Does the account address from One Identity come back to Exact?
No, Exact's payroll API is read-only. KoppelHet puts new addresses on a list for payroll.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Exact Online through the REST API with OAuth 2.0 (app in the Exact App Center, scope Hrm payroll), per {division} and GET only: /api/v1/{division}/sync/Payroll/Employees filtered on Timestamp (ID, EmployeeHID, FirstName, NickName, MiddleName, LastName, LocationDescription, Manager, StartDate, EndDate, IsActive, IsAnonymised), /payroll/EmploymentOrganizations (DepartmentDescription, JobTitleDescription) and /system/Divisions (DivisionMoveDate).
- One Identity Manager through the CSV connector: two files in one system connection, fixed header line, two key columns in the employee file, Hierarchical sort order on the department path, Read-only access and Data import in the synchronisation step (no MarkAsOutstanding); files directly or through a remote connection server.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Exact HR | Field in One Identity | Notes |
|---|---|---|
Administratie (division) | Sleutelkolom 1 | |
EmployeeHID | Sleutelkolom 2 | |
NickName of FirstName | FirstName | |
MiddleName + LastName | LastName | |
Administratie en DepartmentDescription | Afdelingspad | |
LocationDescription | Locatie | |
Manager (ID) | Sleutel van de leidinggevende | |
StartDate | EntryDate | |
EndDate | ExitDate |
Related
Exact HR → 4PS Construct
Exact HR to 4PS Construct integration: payroll costs from Exact Online payroll as a journal in 4PS, with cost centre and project as dimensions
Exact HR → Active Directory
Exact HR to Active Directory integration: accounts from payroll in Exact Online
Exact HR → AllSolutions
Exact HR to AllSolutions integration: payroll costs from Exact Online payroll as a journal posting in AllSolutions
ASExact HR → Arbodienst (SIVI)
Exact to occupational health service via SIVI: sick and recovery notifications from Exact Online payroll to the health service