Identity and access management
Nmbrs to Okta integration: payroll as the HR source for Okta
With an integration between Nmbrs and Okta, Nmbrs becomes Okta's HR source, so a new employee in Nmbrs becomes an Okta user with company, department, job title and the groups that grant access to apps. After the end date in Nmbrs KoppelHet removes the employee from the source and Okta deactivates the user.
What the integration does
Organisations with several BVs in Nmbrs that use Okta for access to their applications often create Okta users by hand after an email from payroll. Someone who changes BV then often keeps the access of the old place.
- Someone with the right Nmbrs login grants the integration read access to the companies once.
- KoppelHet delivers the employees of all companies to Okta as an HR source, with the departments as groups.
- Okta creates the users and, through your group rules, gives the apps of their branch.
- When someone changes BV or department, the user moves to the group of the new place in Okta and the old access lapses.
- After the end date KoppelHet removes the employee from the source and Okta deactivates the user.
What to watch for with Nmbrs and Okta
- With Anything-as-a-Source Okta offers an entry point for delivering a custom HR source. KoppelHet delivers Nmbrs there, with employees, departments as groups and their members, so Okta decides access rather than an IT script.
- Departments in Nmbrs are lists per company, and the same name occurs at several BVs. KoppelHet creates a separate group per company in Okta, so an employee of one BV does not get the apps of the same department at another BV.
- Employee numbers in Nmbrs are unique per company. Okta has one fixed key per user from the source; KoppelHet therefore puts the company code in front of the number.
- A move to another BV is in Nmbrs a leave from one company and a hire at the other. KoppelHet recognises the same person, so the Okta user remains and only the groups change.
- Okta stores data from such an HR source as text only. KoppelHet writes the dates from Nmbrs in a fixed format, so rules in Okta can work on start or end date.
- The integration uses Nmbrs' new interface, because the old one stops on 1 March 2027, and only reads personal, employment and organisation data. Pay and BSN do not reach Okta.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
We use Nmbrs through our accounting firm. Is that possible?
Yes. The firm creates an employer-level login for the integration.
What can be traced afterwards for an audit?
Every action of the integration is recorded in the audit logging of the KoppelHet platform. KoppelHet works with an ISO 27001 certified management system.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Nmbrs is read through the Nmbrs REST API with OAuth 2.0 and read-only scopes for employee and employment data and the company structure, per company; webhooks on changes. The SOAP API stops on 1 March 2027.
- Okta is fed through the Identity Sources API (custom identity source) with sessions, bulk-upsert for users (profile attributes as string only), bulk-groups-upsert and bulk-group-memberships-upsert for departments per company, bulk-delete on leaving and start-import.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Nmbrs | Field in Okta | Notes |
|---|---|---|
Bedrijf en personeelsnummer | externalId en employeeNumber | Company code before the number |
Roepnaam | firstName | |
Achternaam volgens naamstelling | lastName | |
Zakelijk e-mailadres of naamgevingsregel | login en email | |
Functie | title | |
Afdeling | department en groep | Group per department per company |
Bedrijf | organization | |
Leidinggevende | managerId | |
Datum in en uit dienst | Eigen attributen als tekst |
Related
ADP Workforce Now → Nmbrs
ADP Workforce Now to Nmbrs integration: the Dutch payroll group from ADP in the right Nmbrs company
AlexisHR → Nmbrs
AlexisHR (Simployer One) to Nmbrs integration: Dutch employees into payroll
BambooHR → Nmbrs
BambooHR to Nmbrs integration: Dutch payroll next to a global HR system
Bullhorn → Nmbrs
Bullhorn to Nmbrs integration: placements with hourly pay and end date in payroll