Identity and access management
Remote to Okta integration: Okta users from Remote, with the Remote SCIM app or custom
With an integration between Remote and Okta, every person working through Remote becomes an Okta user with department, employee number and manager, and that user is deactivated when the employment in Remote ends. Remote has its own SCIM app in the Okta catalogue with which Okta imports employees and departments from Remote; KoppelHet comes in when you want to handle contractors, the work email, offboarding per country or confidential departures differently.
What the integration does
Organisations with staff in countries without an entity of their own use Remote as employer and Okta for access. With Remote's SCIM app those staff reach Okta, but the work email still has to go back to Remote by hand, and a departure only comes through at Okta's next import.
- In Remote the administrator creates a Customer API token for KoppelHet, with only the scopes the integration needs; Okta gets a service app with OAuth.
- As soon as an employment is created in Remote, KoppelHet stages the Okta user without activation, with a work email according to your naming rule.
- The work email goes back to Remote for employees; for contractors HR gets a notification.
- After onboarding KoppelHet activates the user on the start date; country and employment type decide the groups.
- On an offboarding KoppelHet deactivates the user on the end date Remote has confirmed.
What to watch for with Remote and Okta
- With Remote's SCIM app Okta reads employees and departments from Remote, but Okta cannot create, change or deactivate anything in Remote. The work email Okta issues therefore does not reach Remote by itself. KoppelHet writes the address back through Remote's API.
- According to Remote a change reaches Okta at the next sync; how often that runs is not in the guide. KoppelHet works on Remote's notifications, so a departure comes through on the end date and does not depend on the import schedule in Okta.
- Through Remote's API the work email can only be written for an employment that is invited or active, and not for contractors. KoppelHet writes the address back for employees and asks HR to fill it in themselves for contractors.
- Remote's SCIM data gives an email address with a type, personal or work. For a new employee often only the personal address is known. KoppelHet never uses the personal address as the login in Okta, but creates a work email with your naming rule.
- On an offboarding Remote first checks the country's rules, and the end date can still move afterwards. KoppelHet only deactivates the Okta user on the date Remote has confirmed, so a colleague in a country with a longer notice period does not lose access too early.
- Remote leaves confidential offboardings out of the list by default; they only come along with a separate parameter. Precisely with such a departure access must stop on time. KoppelHet therefore fetches them explicitly and deactivates on the end date, without the reason or the word confidential ending up in Okta.
- Remote warns that some configurations block deactivation when a user still has active dependencies. After the end date KoppelHet checks whether the Okta user is really deactivated and reports it to IT if not.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Why not just Remote's SCIM app?
It is often enough when departments suffice for groups and the work email in Remote does not need to be right. Choose custom work when country and employment type decide access, or when a departure must count on the day itself.
Do staff through Remote also belong in Dutch payroll?
No. Remote is their employer. They do need an account and access, and that is what this integration is about.
Is a leaver deleted from Okta?
No, deactivated. Deleting after the retention period remains IT's choice.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Standard: the Remote SCIM 2.0 app in the Okta catalogue, with a token from Remote (Company Settings, Integrations, Remote API, Full access). Okta reads name, email with type, employee number, department, manager and status; departments as groups through Import Groups. Okta writes nothing back to Remote.
- KoppelHet reads Remote through the Remote API (gateway.remote.com) with a Customer API token with limited scopes: GET /v1/employments, SCIM GET /v1/scim/v2/Users for the comparison, webhooks signed with X-Remote-Signature, confidential offboardings with include_confidential. Writing back with PATCH /v1/employments/{employment_id} (work_email for invited and active).
- To Okta through the Users API with an OAuth 2.0 service app (scopes okta.users.manage and okta.groups.manage): create without activation, activate and deactivate. If the SCIM app runs alongside, profile sourcing decides which source wins per attribute.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Remote | Field in Okta | Notes |
|---|---|---|
employment id | employeeNumber | |
Voornaam en achternaam | firstName en lastName | |
Naamgevingsregel | login en email | |
department | department | |
manager | managerId en manager | |
country | countryCode | |
Soort dienstverband | userType | |
status en einddatum | status (STAGED, ACTIVE, DEPROVISIONED) |
Related
Greenhouse → Remote
Greenhouse to Remote integration: foreign hires as EOR employment with the country's form
Recruitee → Remote
Recruitee to Remote integration: hires abroad straight into an employment at Remote
Remote → 4PS Construct
Remote to 4PS Construct integration: own employees of the construction entity from Remote in 4PS
Remote → Active Directory
Remote to Active Directory integration: accounts for colleagues in other countries