Identity and access management
Sage HR to Okta integration: Okta users from Sage HR, with the Aquera connector or custom
With an integration between Sage HR and Okta, a new employee from Sage HR gets an Okta user with job title, team and manager, and Okta deactivates that user after the last working day of the termination in Sage HR. The Okta catalog lists a Sage HR connector from Aquera; without that licence KoppelHet delivers the employees through the Sage HR API as a custom HR source to Okta.
What the integration does
Organisations that use Sage HR for HR and Okta for access often set up a SAML sign-in to Sage HR first. Employees then still have to be entered in Okta by hand, and leavers stay active in Okta until IT notices.
- We first check whether you have Aquera's Sage HR connector; if so and it fits, we set that up.
- Otherwise a Sage HR administrator creates an API key for KoppelHet, and the Okta account team enables a custom HR source.
- Every hour KoppelHet reads the active and the terminated employees and delivers only the differences to Okta.
- A team change moves the user to the Okta group of the new team on the start date.
- After the last working day Okta deactivates the user; on a rehire the same user becomes active again.
What to watch for with Sage HR and Okta
- The Okta catalog lists Sage HR by Aquera, an HR-as-a-Master connector that according to the catalog creates, updates and deactivates, built and maintained by Aquera and not by Sage. If you have that licence, that is one route. If not, KoppelHet delivers through Okta's Custom Identity Source.
- Okta has no SAML app for Sage HR in its catalog; the Sage People SAML app belongs to a different Sage product. Sage HR itself asks for the login URL, the entity ID and the SHA-1 fingerprint of the identity provider for SAML. You set up that sign-in with a custom SAML app in Okta; the integration makes sure the users are already there.
- The email address is required when creating an employee in Sage HR, but the API cannot change it afterwards. The Okta address therefore cannot go back to Sage HR. KoppelHet uses the address from Sage HR as the Okta login when the domain belongs to your Okta environment, and otherwise reports it to HR.
- After a termination an employee no longer appears in Sage HR's list of active employees, but in a separate list with the end date. Okta does not see a missing user as a departure. KoppelHet reads both lists and delivers the leaver as a removal, so Okta deactivates.
- A rehire brings an employee back in Sage HR under the same ID. KoppelHet recognises that ID and makes the existing Okta user with the same login active again, instead of creating a second user with a new address.
- Sage HR sends no webhooks, and the API returns no office for an employee. KoppelHet compares with the previous state every hour and builds the Okta groups on team, with team_history for the date a change takes effect.
- Sage HR flags on-call workers with their own checkbox. KoppelHet puts those users in a separate Okta group, so they get, for example, the roster but not the VPN or the intranet.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Is there not already a Sage HR connector in Okta?
Yes, from Aquera, with its own licence. If you have it, it can be enough. Otherwise KoppelHet delivers as a custom HR source in Okta.
Can the Okta address go back to Sage HR?
No. The Sage HR API cannot change the email address after creation. HR fills in the work address straight away for a new employee.
What happens to the reason for leaving?
It stays in Sage HR. Okta only gets the date.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Sage HR REST API at {subdomain}.sage.hr/api with the X-Auth-Token header: GET /employees (email, first_name, last_name, employee_number, position, team, reports_to_employee_id, employment_start_date), GET /terminated-employees (termination_date), team_history per employee; pages with page and meta.next_page; no webhooks.
- Okta through a Custom Identity Source (Identity Sources API: one session per source at a time, bulk upsert of up to 200 profiles per request, string values only, bulk delete deactivates) or through the Users API with an OAuth 2.0 service app (lifecycle activate, deactivate and reactivate).
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Sage HR | Field in Okta | Notes |
|---|---|---|
employee_number | employeeNumber en externalId | |
first_name en last_name | firstName en lastName | |
email | login en email | Work address, filled in at creation |
position | title | |
team (met team_history) | department en groep per team | |
reports_to_employee_id | managerId | Converted to the employee number |
employment_start_date | Activeren op de startdatum | |
termination_date (terminated-employees) | Deactiveren |
Related
Recruitee → Sage HR
Recruitee to Sage HR integration: hired candidates as employees in Sage HR
Sage HR → Active Directory
Sage HR to Active Directory integration: domain accounts per team, with an expiry date from the termination
Sage HR → ADP iHCM
Sage HR to ADP iHCM integration: compensation and leavers from Sage HR to Dutch ADP payroll
Sage HR → AFAS Profit
Sage HR to AFAS integration: employees of the Dutch entity in AFAS Profit Payroll