Identity and access management
Factorial to Ping Identity integration: employees from Factorial as users in PingOne
With an integration between Factorial and Ping Identity, every new employee in Factorial becomes a user in PingOne, in the population of their legal entity and with job title, country and manager. On the day access stops in Factorial, the user can no longer sign in to PingOne.
What the integration does
Organisations that use Factorial for HR and PingOne as their identity provider find apps for other identity providers in Factorial's Marketplace, but not for PingOne. New colleagues are then created by hand, and a departure in Factorial does not reach PingOne by itself.
- Factorial gets a company token and webhook subscriptions on employees and contract versions; PingOne gets a Worker app with the Identity Data Admin role.
- We choose a population in PingOne per legal entity.
- For a new employee KoppelHet creates the PingOne user with sign-in blocked until the start date.
- On the start date KoppelHet enables sign-in and the teams' groups.
- On the day access stops in Factorial, KoppelHet blocks sign-in; deletion follows after the retention period.
What to watch for with Factorial and Ping Identity
- Factorial has its own apps for Okta and JumpCloud among others, but not for PingOne. PingOne only knows LDAP Gateway, SCIM and Workday as inbound provisioning sources. KoppelHet therefore fills PingOne through the user API, with the Factorial ID as externalId.
- Factorial gives an employee's country as a lower-case code, such as es. PingOne only accepts a country code as two upper-case letters. KoppelHet converts the code, so a user is not rejected and policies per country in PingOne work.
- On a termination in Factorial HR chooses a date on which access stops, separate from the end of the contract. KoppelHet blocks sign-in to PingOne on the access date, so someone cannot reach other apps for weeks because their contract ends later.
- Factorial sends a separate notification when a termination is reverted. That also happens when HR wants to move a scheduled date. KoppelHet does not immediately enable sign-in to PingOne again, but waits for the new termination or an hour without a new notification.
- A move to another legal entity starts in Factorial with a new contract on a date, and until that day the employee stays with the old entity. PingOne only moves a user to another population with a separate call. KoppelHet makes that call on the effective date, so MFA devices and history move along.
- When reactivated in Factorial, only the employee can change their email address afterwards. With PingID a username in PingOne is fixed after creation. KoppelHet links on the Factorial ID and not on the address, so a returning colleague gets their existing PingOne user back.
- Factorial notifications have no ID of their own and can arrive more than once. KoppelHet compares each notification with the current PingOne user and only writes when something differs, so a repeated notification causes no new change or audit entry in PingOne.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Does Factorial have an app for PingOne?
Not that we found. Factorial has apps for other identity providers; for PingOne KoppelHet builds the flow.
What happens if HR reverts a termination?
KoppelHet waits briefly for a new termination. If none comes, the user stays active.
Does pay data go to PingOne?
No. KoppelHet only stores and sends the fields for the user.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- KoppelHet reads Factorial through the Factorial API (version 2026-10-01 in the path): employees with email, country (lower case), active, is_terminating, terminated_on, legal_entity_id and manager_id, contract versions and legal entity changes. Webhooks employees/employee/create_with_contract, update, terminate and unterminate and contracts/contract_version/create; up to twenty attempts in 48 hours, no ID per delivery.
- PingOne with a Worker app with the Identity Data Admin role: users through /v1/environments/{envID}/users with externalId, username (unique, at most 128 characters, immutable with PingID), title and address.countryCode (ISO 3166-1 alpha-2, upper case); population.id through the population sub-resource; sign-in through the separate enabled call; groups through the Platform API.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Factorial | Field in Ping Identity | Notes |
|---|---|---|
id | externalId | |
first_name en last_name | name.given en name.family | |
email | email en username | |
Functie (contractversie) | title | |
country | address.countryCode | In upper case |
legal_entity_id | population | |
Teams | Groepen | |
active, is_terminating en terminated_on | Aanmelden aan of uit |
Related
Factorial → 4PS Construct
Factorial to 4PS Construct integration: fitters and site managers with their cost centre as a dimension in 4PS
Factorial → Active Directory
Factorial to Active Directory integration: domain accounts from Factorial
Factorial → ADP iHCM
Factorial to ADP iHCM integration: contract versions and terminations of the Dutch entity to ADP
Factorial → AFAS Profit
Factorial to AFAS integration: employees and contracts from Factorial in AFAS Profit Payroll