Identity and access management
SuccessFactors to Okta integration: Employee Central as the HR source for Okta users
With an integration between SAP SuccessFactors and Okta, every new employee from Employee Central automatically gets an Okta user with job title, department and manager, and access stops on the agreed day after departure. KoppelHet also handles multiple employments, conversion from contractor to employee, your own naming rules and a request in the service desk.
What the integration does
Organisations with SuccessFactors and Okta often reactivate contractors who join as employees by hand. A new colleague sometimes gets their private address as email address in Okta.
- HR enters a new employee in Employee Central, with a start date that may be weeks ahead.
- KoppelHet reads the data as it applies on the start date and stages the user in Okta, with a login following your convention.
- On the start date the user becomes active; groups for company, department and job decide the apps.
- When a contractor joins as an employee, KoppelHet links the new employment to the same Okta user.
- After the last working day of the last active employment the user is deactivated.
What to watch for with SAP SuccessFactors and Okta
- KoppelHet derives the status from the job information in Employee Central; status A is active. New colleagues are staged in Okta and become active on the start date. On departure KoppelHet sets the moment per termination reason, for example blocking immediately on summary dismissal.
- When a contractor in SuccessFactors becomes a permanent employee, they get a new employment. KoppelHet links the new employment to the existing Okta user, so the colleague keeps their account and apps.
- The email address marked as primary in SuccessFactors is often the private address for a new hire. KoppelHet uses the business email type or the naming rule, so a private address never becomes the Okta login.
- Pay data such as pay grade, pay group and the collective agreement pay scale fields do not go to Okta. If access must still depend on such a classification, KoppelHet only delivers the derived group to Okta, not the pay data itself.
- If someone has a temporary assignment abroad or two concurrent employments, a rule has to decide which employment determines department and manager in Okta. KoppelHet picks the employment at the Dutch entity and only deactivates when the last employment ends.
- SAP stops supporting Basic Authentication for SuccessFactors on 20 November 2026. KoppelHet only uses OAuth 2.0.
- A new colleague often needs a laptop on day one. KoppelHet can use the same hire from SuccessFactors to also create a request in the service desk, so the Okta account and the workplace work from the same data.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
What about audit logging, GDPR and our integration platform?
Every action of the integration is in the audit logging of the KoppelHet platform, traceable per employee. You are the controller and KoppelHet is the processor, under a data processing agreement; KoppelHet is ISO 27001 certified. The integration runs next to an existing integration platform and asks nothing of it.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- KoppelHet reads Employee Central through the OData API with OAuth 2.0, on lastModifiedDateTime per entity (PerPerson, PerPersonal, EmpEmployment, EmpJob, PerEmail) and with asOfDate on the start date.
- Okta is written through the Users API (create without activation, activate, deactivate) or through a Custom Identity Source with the Identity Sources API.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in SAP SuccessFactors | Field in Okta | Notes |
|---|---|---|
PerPerson.personIdExternal | employeeNumber | |
PerPersonal.preferredName of firstName | firstName | |
PerPersonal.lastName | lastName | |
Naamgevingsregel | login en email | Business email type, not the address marked isPrimary |
EmpJob.jobTitle | title | |
EmpJob.department | department | |
EmpJob.managerId | managerId en manager | |
EmpJob.company | organization | |
EmpJob.costCenter | costCenter | |
EmpJob.emplStatus en EmpEmployment.endDate | status (STAGED, ACTIVE, DEPROVISIONED) |
Related
Ashby → SAP SuccessFactors
Ashby to SAP SuccessFactors integration: hire as a new employee in Employee Central
Bullhorn → SAP SuccessFactors
Bullhorn to SAP SuccessFactors integration: placements as employees or contingent workers in Employee Central
Carerix → SAP SuccessFactors
Carerix to SAP SuccessFactors integration: successful placement as a new employee in Employee Central
Greenhouse → SAP SuccessFactors
Greenhouse to SAP SuccessFactors integration: a hire as a new employee in Employee Central