Identity and access management
Exact HR to Ping Identity integration: PingOne users per administration from Exact Online
With an integration between Exact HR and Ping Identity, every employee from payroll in Exact Online gets a PingOne user in their administration's population, with a group for their department. After the end date in Exact KoppelHet disables the user in PingOne, and an anonymised employee disappears after the agreed period.
What the integration does
Organisations that do payroll in Exact Online and use PingOne for sign-in now create PingOne users by hand as soon as payroll passes on a new colleague. A departure in Exact only reaches PingOne when someone remembers.
- An Exact user without roles for personal data gives KoppelHet consent; PingOne gets a Worker app with the Identity Data Admin role.
- KoppelHet fetches the changed employees and their department per administration.
- A new employee becomes a PingOne user in their administration's population and joins their department's group.
- KoppelHet updates name, department and work email when Exact changes, and puts new addresses on a list for payroll.
- After the end date KoppelHet disables the user and deletes them after the agreed period.
What to watch for with Exact HR and Ping Identity
- PingOne puts every user in exactly one population. KoppelHet gives each Exact administration its own population, so password policy and sign-in rules can differ per employer and a move to another administration becomes a change of population.
- The employee number in Exact is only unique per administration, but every employee also has an ID that according to Exact never changes. KoppelHet uses that ID as the external key in PingOne, so a user is not duplicated when payroll corrects a number.
- Exact has three email fields: the business address, the address of the linked Exact user and a private address. Exact only returns the last two with roles for personal data. PingOne accepts one address; KoppelHet only sends the business one and runs the integration under a user without those roles.
- Groups do not go through PingOne's SCIM entry point. KoppelHet creates a group per department from Exact through the Platform API, with the administration in the group name, so two administrations with a Sales department do not merge into one group.
- Exact only returns new and changed employees based on a sequence number, and a list from PingOne SCIM stops at 200 users. KoppelHet looks up each changed employee specifically in PingOne by the external key, and reads an administration completely again after a database move at Exact.
- When an employee is anonymised in Exact, a normal update would fill their PingOne user with replaced values. KoppelHet recognises the flag, no longer changes name and address in PingOne and deletes the disabled user after the agreed period.
- Through the API the payroll data in Exact can only be read. A work address that KoppelHet creates for PingOne according to the naming rule therefore cannot go back to the business email field automatically; KoppelHet puts it on a list for payroll.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Does PingOne have an Exact Online integration?
Not as an HR source, as far as we have found. KoppelHet delivers the employees through PingOne's SCIM and Platform API.
Does BSN or pay data go to PingOne?
No. The integration's Exact user has no roles for personal data, so Exact does not even return them.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Exact Online through the REST API with OAuth 2.0 (app in the Exact App Center, scope Hrm payroll), per {division} and GET only: /api/v1/{division}/sync/Payroll/Employees filtered on Timestamp (ID, EmployeeHID, FirstName, NickName, MiddleName, LastName, BusinessEmail, StartDate, EndDate, IsActive, IsAnonymised; Email and PrivateEmail only with roles for personal data), /payroll/EmploymentOrganizations (DepartmentDescription) and /system/Divisions (DivisionMoveDate).
- PingOne through a Worker app with the Identity Data Admin role: users through the SCIM API (population per administration, externalId, userName required, a single email value, active mapped to enabled; lists at most 200 without paging; /v2/Groups returns 501), groups and memberships through the PingOne Platform API.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Exact HR | Field in Ping Identity | Notes |
|---|---|---|
ID (GUID) | externalId | Never changes according to Exact |
Naamgevingsregel | username | |
NickName of FirstName | name.given | |
MiddleName + LastName | name.family | |
BusinessEmail of naamgevingsregel | email | |
Administratie (division) | population.id | |
DepartmentDescription | Groep (Platform API) | |
EndDate en IsActive | enabled |
Related
Exact HR → 4PS Construct
Exact HR to 4PS Construct integration: payroll costs from Exact Online payroll as a journal in 4PS, with cost centre and project as dimensions
Exact HR → Active Directory
Exact HR to Active Directory integration: accounts from payroll in Exact Online
Exact HR → AllSolutions
Exact HR to AllSolutions integration: payroll costs from Exact Online payroll as a journal posting in AllSolutions
ASExact HR → Arbodienst (SIVI)
Exact to occupational health service via SIVI: sick and recovery notifications from Exact Online payroll to the health service