Identity and access management
Personio to Okta integration: Okta accounts from Personio, with the Marketplace integration or custom
With an integration between Personio and Okta, every new employee in Personio gets an Okta user with department, job title, legal entity and manager, and access closes after departure. Personio offers its own Okta integration in the Marketplace that creates and updates users and deactivates them after the termination date; KoppelHet comes in when access must stop on the last working day already, when externals and multiple entities have their own rules or when the same change must also reach other systems.
What the integration does
Organisations that connect Personio and Okta with the Okta integration from the Personio Marketplace often see leavers take their remaining leave at the end of the contract. The Okta account then stays active for weeks after the last working day.
- HR records a new employee in Personio with legal entity, department, job title and start date.
- KoppelHet stages the user in Okta, with a login following the rule for that entity.
- On the start date the user becomes active; groups for entity, department and internal or external decide the apps.
- When department or manager changes, Okta adjusts groups and manager on the effective date.
- After the last working day KoppelHet deactivates the user; the termination date only decides when it is cleaned up.
What to watch for with Personio and Okta
- The Personio integration deactivates the Okta user at the end of the termination date. Personio also has a last working day, which can be weeks earlier because of leave taken. KoppelHet closes access on the last working day and only uses the termination date to clean up the account afterwards.
- To create an Okta profile, the Personio integration needs a first name, last name and email address in Personio. If that is the private address at hire, it becomes the Okta address. KoppelHet determines the login with a naming rule and keeps the private address out of Okta.
- A field only reaches Okta through the Personio integration if it is also ticked in the API credential settings in Personio. A new field missing there silently stays empty. KoppelHet checks on every run that all expected fields are filled and reports it when one is missing.
- Personio knows whether someone is internal or external. KoppelHet puts that into Okta, so group rules can give externals fewer apps and an end date of their own.
- Each legal entity in Personio can have its own email domain and groups. When someone moves to another entity, KoppelHet adjusts domain and groups and keeps the same Okta user.
- Okta Workflows has a Personio connector for building your own flows. Okta asks not to process sensitive data such as health data in it and keeps execution history for thirty days. Absence and salary therefore do not belong there; KoppelHet only reads persons and employments.
- Personio retries a notification for up to three days. KoppelHet also compares all active employees with Okta every day, so a departure does not depend on a single notification.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
What about audit logging, GDPR and our integration platform?
Every action of the integration is in the audit logging of the KoppelHet platform, which runs in the EU and is ISO 27001 certified. You are the controller and KoppelHet is the processor, under a data processing agreement; salary and absence stay outside the integration. An existing integration platform is left alone.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- The Okta integration is activated in Personio through Marketplace, Connect Okta, with an Okta API token and the Okta domain. Sync only runs from Personio to Okta; attributes must be enabled in the Personio API credentials. Okta Workflows has a Personio connector with List Employees, Read Employee and Update Employee.
- KoppelHet reads Personio through webhooks (employment.updated fires for department, job, manager, status, last_working_day and termination date, among others) and the Personio API v2, with read-only scopes on persons and employments.
- Okta is written through the Users API with an OAuth 2.0 service app, or through a Custom Identity Source with the Identity Sources API when KoppelHet replaces the Personio integration.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Personio | Field in Okta | Notes |
|---|---|---|
id | employeeNumber | |
first_name of preferred_name | firstName | |
last_name | lastName | |
Naamgevingsregel per entiteit | login en email | |
position | title | |
department | department | |
legal_entity | organization | |
supervisor | managerId en manager | |
employment type (INTERNAL, EXTERNAL) | userType | |
last_working_day en termination_date | status (ACTIVE, DEPROVISIONED) |
Related
Ashby → Personio
Ashby to Personio integration: hires with hours and entity as new employees in Personio
Bullhorn → Personio
Bullhorn to Personio integration: placements as a person with employment in Personio
Carerix → Personio
Carerix to Personio integration: successful placement as a new employee in Personio
Greenhouse → Personio
Greenhouse to Personio integration: hired candidates as employees in Personio