Identity and access management
HR2day to Okta integration: HR2day as the HR source for Okta
With an integration between HR2day and Okta, every new employee in HR2day becomes an Okta user with job title, department, employer and manager, and is deactivated after the last contract. KoppelHet delivers the employees as its own HR source in Okta, with rules for on-call staff, multiple contracts and multiple employers.
What the integration does
Organisations that use HR2day for staff and payroll and Okta for access to applications such as the care record, the rostering app and Microsoft 365 often create users in Okta after a form from the manager. On-call workers with one short contract after another therefore sometimes get a second account, or keep access between two contracts.
- HR records a new employee and contract in HR2day.
- KoppelHet picks up the change and delivers the employee to the HR2day source in Okta.
- Okta creates the user; group rules grant the apps of employer, department and job.
- If an on-call worker gets a new contract within the agreed period, it stays the same Okta user.
- After the end date of the last contract KoppelHet removes the employee from the source and Okta deactivates the user.
What to watch for with HR2day and Okta
- Okta offers the entry point Anything-as-a-Source for a custom HR source. The Okta account team switches it on, and KoppelHet delivers the HR2day employees to it.
- HR2day runs on Salesforce, and Okta can use Salesforce as a profile source. That only covers Salesforce users, not the employees and contracts HR2day keeps in its own objects. KoppelHet reads those HR2day objects.
- Okta processes a delivery in one session at a time per source, with at most 200 employees per request and 50 requests per session. For an organisation with more than 10,000 employees KoppelHet therefore splits a full delivery over several sessions; daily only the changes go.
- In Okta's HR source every attribute is text and holds a single value. An employee with two contracts at two foundations therefore gets one main contract for job and department, and the other employer goes into a group.
- On-call staff in care often get a series of short contracts. If less than the agreed period lies between two contracts, KoppelHet keeps the employee in the source, so Okta does not deactivate and recreate the user.
- Okta does not delete users who disappear from the HR source, but deactivates them. A leaver thus remains traceable for audit and a possible return.
- HR2day shares a daily maximum of API requests with other integrations on the same environment. KoppelHet only requests the changes since the previous run, so other integrations with HR2day keep room.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
What if an employee works at two foundations?
It stays one Okta user. The main contract determines job and department; both employers go into Okta as groups, so the apps of both are available.
What about audit logging, GDPR and our integration platform?
Every action of the integration is in the audit logging of the KoppelHet platform. You are the controller and KoppelHet is the processor, under a data processing agreement; payroll data from HR2day stays outside the integration. An existing integration platform is left alone.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- HR2day is read through the Salesforce REST API on the HR2day objects (custom objects with a namespace), filtered on modification date, through a connected app with a read-only integration user.
- Okta is fed through the Identity Sources API (Custom Identity Source, Anything-as-a-Source) with sessions and bulk-upsert, bulk-groups-upsert and bulk-group-memberships-upsert, and bulk-delete on departure (Okta deactivates). Limits according to Okta include one active session per source, 200 entities or 200 KB per request, 50 requests per session, all profile attributes as strings, no arrays.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in HR2day | Field in Okta | Notes |
|---|---|---|
Personeelsnummer | employeeNumber | |
Roepnaam of voornaam | firstName | |
Achternaam met tussenvoegsel | lastName | |
Naamgevingsregel | login en email | |
Functie van het hoofdcontract | title | |
Afdeling (kostenplaats) | department | |
Werkgever | organization | |
Leidinggevende | managerId | |
Soort arbeidsrelatie | userType | |
Einddatum laatste contract | verwijderen uit de bron (deactiveren) |
Related
Exact Online → HR2day
Exact Online to HR2day integration: cost centres and cost units to HR2day, payroll journal per division
HR2day → Active Directory
HR2day to Active Directory integration: accounts per school or location from HR
HR2day → Microsoft Entra ID
HR2day to Entra ID integration: Microsoft 365 accounts for care, education and childcare
HR2day → Google Workspace
HR2day to Google Workspace integration: one Google account per employee, also with several employment relationships