Identity and access management
Personio to Ping Identity integration: users in PingOne per legal entity
With an integration between Personio and Ping Identity, every new employee from Personio gets a user in PingOne, in the population of their legal entity and with job title, department, team and manager. After the last working day in Personio that user can no longer sign in, and external staff get their own population with their own rules.
What the integration does
Organisations with Personio as their HR system and PingOne as their identity provider keep two lists of employees. IT creates users based on an email from HR, and someone taking leave for their final weeks can often keep signing in until the contract end date.
- Personio gets an API client with read-only rights on persons, employments and org units; PingOne gets a Worker app with the Identity Data Admin role.
- For each legal entity in Personio we set up a population in PingOne, plus one population for external staff.
- KoppelHet creates the user as soon as the employee is in onboarding in Personio, with sign-in blocked until the start date.
- Department and team from Personio become groups in PingOne; a change updates the members.
- After the last working day KoppelHet blocks sign-in; deletion follows after the contract end date and the retention period.
What to watch for with Personio and Ping Identity
- KoppelHet fills PingOne through Ping's user API, without another identity provider in between.
- An employment in Personio has the status ONBOARDING, ACTIVE, LEAVE or INACTIVE. Leave counts as LEAVE, not as a departure. KoppelHet only blocks sign-in in PingOne at INACTIVE or after the last working day, unless you agree otherwise for a particular type of leave.
- Personio returns departments and teams as separate org units with a type and only an ID. KoppelHet fetches the names separately and creates separate groups per department and per team in PingOne, so applications can be driven by either.
- Personio knows whether someone is internal or external. PingOne puts every user in exactly one population. KoppelHet gives external staff their own population, so you can set stricter MFA or a shorter session there than for your own employees.
- Personio's employment list can be filtered on updated_at and returns at most 50 results per page, with a link to the next page. The nightly run only asks for what changed since the previous run, so a large environment is not fetched in full every night.
- Personio accepts an email address for only one person, and PingOne stores one email address per user. KoppelHet puts the work address according to the naming rule in PingOne and leaves the private address from Personio out.
- Personio keeps notifications for thirty days and can resend them. If PingOne or KoppelHet is unreachable for a while, KoppelHet requests the missed notifications again and processes them in order, so a block is not overwritten by an older change.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
What happens to administrators and service users in PingOne?
They are in their own population and the integration leaves them alone. KoppelHet only touches users with a Personio ID.
Does the integration read salaries or absence in Personio?
No. The API client only has read rights on persons, employments and org units.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Personio through webhooks (employment.updated and the effective-date notifications) and the Personio API v2: /v2/persons and /v2/persons/{id}/employments (status ONBOARDING, ACTIVE, LEAVE, INACTIVE; type INTERNAL or EXTERNAL; org_units with type department or team; legal_entity, supervisor, position.title, termination with termination_date and last working day; filter updated_at.gt, limit at most 50, cursor through _meta.links.next.href). Missed notifications up to thirty days back through the redelivery endpoint.
- PingOne with a Worker app (Identity Data Admin): users through /v1/environments/{envID}/users or the SCIM entry point, population.id per entity (changed through the population sub-resource), groups and members through the Platform API, custom attributes in the user schema, sign-in blocked through enabled.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Personio | Field in Ping Identity | Notes |
|---|---|---|
person.id | externalId | |
preferred_name of first_name | name.given | |
last_name | name.family | |
Naamgevingsregel per entiteit | username en email | |
position.title | title | |
org_units (type department) | Groep en eigen attribuut afdeling | |
org_units (type team) | Groep per team | |
supervisor.id | Eigen attribuut leidinggevende | |
legal_entity.id en type | population.id | |
status en last_working_day | Blokkeren of toestaan van aanmelden |
Related
Ashby → Personio
Ashby to Personio integration: hires with hours and entity as new employees in Personio
Bullhorn → Personio
Bullhorn to Personio integration: placements as a person with employment in Personio
Carerix → Personio
Carerix to Personio integration: successful placement as a new employee in Personio
Greenhouse → Personio
Greenhouse to Personio integration: hired candidates as employees in Personio