Identity and access management
Personio to OneLogin integration: OneLogin users with roles from Personio
With an integration between Personio and OneLogin, every employee from Personio becomes a OneLogin user with job title, department, legal entity, manager and roles, and that user is suspended after the last working day. Personio has no integration of its own with OneLogin, so KoppelHet writes directly through the OneLogin API, with the Personio ID as a fixed key.
What the integration does
Organisations with Personio as their HR system and OneLogin for single sign-on find integrations for Okta and Entra ID in Personio's Marketplace, but not for OneLogin. IT therefore creates OneLogin users based on a message from HR, and only sees a departure when someone remembers.
- Personio gets an API client with read-only rights on persons, employments and org units; OneLogin gets an API credential with Manage Users.
- With the OneLogin administrator we record the roles per department, team and kind of employee, and the custom fields that must exist beforehand.
- As soon as someone is in onboarding in Personio, KoppelHet creates the OneLogin user as suspended, with roles and work email.
- On the start date KoppelHet sets the status to active; a change of department or team updates the roles.
- After the last working day KoppelHet sets the user to suspended; deletion only follows after the retention period.
What to watch for with Personio and OneLogin
- Personio has provisioning integrations for Okta and Entra ID in its own Marketplace, but we found none for OneLogin. Conversely, OneLogin has no directory for Personio. KoppelHet therefore fills OneLogin itself through the user API, without another identity provider in between.
- An employment in Personio is ONBOARDING, ACTIVE, LEAVE or INACTIVE, while OneLogin works with status codes such as 1 for active and 2 for suspended. KoppelHet translates ONBOARDING to suspended until the start date, LEAVE to active and INACTIVE to suspended, unless you choose otherwise for a type of leave.
- The manager is stored in Personio as a reference to another person. OneLogin wants a OneLogin user ID in manager_user_id. Because the Personio ID is in external_id, KoppelHet finds the manager again with a single lookup.
- Personio returns departments and teams as separate org units. OneLogin has one field for department but can hold several roles per user. KoppelHet puts the department in the department field and translates team and department together into roles, so apps can be driven by either.
- Personio knows whether someone is internal or external. In OneLogin a role decides which apps and policy apply. KoppelHet gives external staff their own role, so you can attach stricter MFA or fewer apps to it, for example.
- OneLogin refuses a second user with the same username within the subdomain, and Personio accepts an email address for only one person. KoppelHet builds the username with your naming rule and checks beforehand whether it exists, so two colleagues with the same name both get an account.
- Personio keeps notifications for thirty days and can resend them. If OneLogin was briefly unreachable, KoppelHet fetches the missed notifications and processes them in order, so a suspension is not reversed by an older change.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Can OneLogin read Personio itself?
We found no ready-made OneLogin directory for Personio. That is why KoppelHet delivers the users directly.
What happens to administrators and service users in OneLogin?
The integration leaves them alone. KoppelHet only touches users with a Personio ID in external_id.
Does the integration read salaries in Personio?
No. The API client only has read rights on persons, employments and org units.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Personio through webhooks and the Personio API v2: /v2/persons and /v2/persons/{id}/employments (status ONBOARDING, ACTIVE, LEAVE, INACTIVE; type INTERNAL or EXTERNAL; org_units with type department or team; legal_entity, supervisor, position.title, termination; filter updated_at.gt, limit at most 50, cursor). Missed notifications can be requested again up to thirty days back.
- OneLogin API v2 with an API credential with Manage Users: POST /api/2/users and PUT /api/2/users/{id} with username, email, firstname, lastname, title, department, company, external_id, manager_user_id, role_ids, status and custom_attributes, with mappings=sync. Username unique per subdomain; unknown custom field returns 400; no invitation email through the API.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Personio | Field in OneLogin | Notes |
|---|---|---|
person.id | external_id | |
preferred_name of first_name | firstname | |
last_name | lastname | |
Naamgevingsregel | username en email | |
position.title | title | |
org_units (type department) | department | |
legal_entity | company | |
supervisor.id | manager_user_id | Looked up through external_id |
org_units (type team) en type | role_ids | |
status en last_working_day | status (1 actief, 2 geschorst) |
Related
Ashby → Personio
Ashby to Personio integration: hires with hours and entity as new employees in Personio
Bullhorn → Personio
Bullhorn to Personio integration: placements as a person with employment in Personio
Carerix → Personio
Carerix to Personio integration: successful placement as a new employee in Personio
Greenhouse → Personio
Greenhouse to Personio integration: hired candidates as employees in Personio