Identity and access management
Talentech to Okta integration: Okta users from PeopleCore, with the Okta sign-in to Talentech ID
With an integration between Talentech PeopleCore and Okta, every employee HR completes in Talentech gets an Okta user with job title, department, location, legal entity and manager, and Okta deactivates that user after the employment end date from the resignation application. The Okta address goes back to Talentech ID, so the Okta sign-in to Talentech works from the first day.
What the integration does
Organisations that use Talentech PeopleCore for HR and Okta as their identity provider often arrange the Okta sign-in to Talentech ID first. That sign-in creates no users, and the HR-driven provisioning Talentech describes only names Entra ID.
- KoppelHet gets a client in Talentech's token service with read scopes for employees, positions, contracts and resignation applications, and write rights on the Talentech ID email.
- In Okta the account team enables a custom HR source for KoppelHet.
- Every hour KoppelHet compares PeopleCore with the previous state and delivers only the differences to Okta.
- After creation KoppelHet sets the Okta address in Talentech ID.
- After the end date from the resignation application KoppelHet delivers the removal and Okta deactivates the user.
What to watch for with Talentech and Okta
- Talentech only supports Okta as a sign-in to Talentech ID, through OpenID Connect and as a paid service Talentech sets up itself. The HR-driven provisioning in Talentech's documentation only names Entra ID as a target. For Okta users from PeopleCore, KoppelHet builds the integration.
- At the first sign-in through OpenID Connect, Talentech ID matches the user by the email claim. If the address in Talentech ID differs from the Okta address, Talentech cannot find the user. KoppelHet sets the Okta address in Talentech ID through the API after creation.
- For that sign-in Talentech requires an ID that is unique per user and never changes, usually the sub claim. Okta supplies its own user ID for it. KoppelHet never creates a second Okta user for the same employee, so that ID stays the same on a job change.
- On a job change Talentech closes the current contract and starts a new contract on another position. Job title, department, location and entity hang on that position. KoppelHet recognises the pair as a change of the same employee and updates title and groups in Okta, instead of deactivating and creating again.
- In PeopleCore the manager follows from the superior position, which can be vacant. Okta expects the key of another user in managerId. KoppelHet looks up the holder of the superior position, or the position above if it is empty, and puts their Talentech ID in managerId.
- KoppelHet does not deliver employees still in draft in PeopleCore to Okta. Only a completed profile with a contract becomes an Okta user, so a candidate who drops out does not take up an Okta licence.
- The PeopleCore employee list can only be filtered on name, resignation and Talentech ID, not on change date. Okta takes at most two hundred profiles per request in a custom HR source. KoppelHet therefore compares with the previous state itself and only sends Okta the real changes.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Doesn't Talentech's Okta sign-in create users?
No. It only handles signing in to Talentech ID. KoppelHet creates the users in Okta from PeopleCore.
When is a leaver deactivated?
By default after the employment end date from the resignation application. With garden leave it can be after the last working day.
Does the integration read salaries in Talentech?
No. The client gets no scope for salaries or national IDs.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Talentech PeopleCore API (api.talentech.io/peoplecore) with a JWT from the token service (client credentials): GET /v1/Employees (isDrafted, talentechId, businessContactInformation.businessEmail, positionId, hasActiveResignation), /v1/Positions (jobTitle, departmentId, locationId, legalEntityId, superiorPositionId, isVacant), /v1/Contracts and /v1/EmployeeResignApplications (lastDayOfWork, employmentEndDate). Write-back with PUT /v1/Employees/{employeeId}/TalentechIdEmail.
- Okta through a Custom Identity Source (Identity Sources API: session, bulk upsert of up to 200 profiles per request, string values only, bulk delete deactivates) or through the Users API with an OAuth 2.0 service app. Sign-in to Talentech ID with an OIDC app in Okta, set up by Talentech.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Talentech | Field in Okta | Notes |
|---|---|---|
employee id (Talentech) | externalId | |
Voornaam en achternaam | firstName en lastName | |
businessContactInformation.businessEmail of naamgevingsregel | login en email | |
jobTitle (positie) | title | |
departmentId (positie) | department en groep | |
locationId (positie) | city of groep per locatie | |
legalEntityId (positie) | organization | |
superiorPositionId | managerId | Holder of the superior position |
employmentEndDate (ontslagaanvraag) | Verwijderen uit de HR-bron | |
login (Okta) | talentechIdEmail |
Related
Recruitee → Talentech
Recruitee to Talentech integration: hired candidates with a contract on a position in Talentech
Talentech → Active Directory
Talentech to Active Directory integration: accounts in your own domain from PeopleCore
Talentech → ADP iHCM
Talentech to ADP iHCM integration: salaries and resignations from PeopleCore to Dutch ADP payroll
Talentech → AFAS Profit
Talentech to AFAS integration: employees, contracts and salaries from Talentech PeopleCore in AFAS