Identity and access management
UKG Pro to Active Directory integration: domain accounts for the Dutch branch
With an integration between UKG Pro and Active Directory, new employees of the Dutch company in UKG Pro get a domain account in the right OU, with job title, department and manager, and the account gets the end date from UKG Pro as its expiry date. A small KoppelHet program in your domain carries out the changes through an outbound connection.
What the integration does
Dutch sites of groups that run HR worldwide in UKG Pro often have their own Active Directory for local systems. People who leave keep their domain account until local IT receives a list from head office.
- HR records a new employee at the Dutch company in UKG Pro.
- Every three hours KoppelHet fetches the changed employees and compares with the previous state.
- The program in the domain creates the account in the location's OU, with job title, department and manager.
- An end date in UKG Pro immediately becomes the account's expiry date.
- After the last working day KoppelHet disables the account and moves it to an OU for leavers.
What to watch for with UKG Pro and Active Directory
- UKG Pro returns changes at most every three hours. Because the end date immediately becomes the account's expiry date, the account stops on time, even if the last round of that day comes later.
- UKG Pro has a system key and an employee number per employee. KoppelHet puts the employee number on the account as the key and the system key in a second field, so both can be looked up.
- Only employees of the Dutch company get a domain account. Colleagues from other countries are in UKG Pro, but do not belong in the local domain.
- The work location in UKG Pro determines the OU, so group policy per location is right. If someone moves to another location, KoppelHet moves the account on the effective date.
- UKG Pro distinguishes full-time and part-time and employee types. Per type we agree who gets a domain account, so employees without a PC do not keep an unused account.
- UKG Pro says which employees changed, not what. KoppelHet compares with the previous state and only sends real changes to the domain, so the program in the domain does not update every account every three hours.
- The KoppelHet platform reads UKG Pro; the program in the domain only fetches instructions through an outbound connection. The domain needs no access to UKG Pro and nothing is opened in the firewall.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Does anything need to be opened in the firewall?
No. The program in the domain only makes an outbound connection to the KoppelHet platform.
What if someone is on long-term leave?
The employee then stays active in UKG Pro and so does the account. If IT wants to disable the account during leave, we agree that based on the status in UKG Pro.
Does this also work with Entra ID?
Yes, we also connect UKG Pro directly with Entra ID.
What about the GDPR?
You are the controller and KoppelHet is the processor, under a data processing agreement. Only job and organisation data go to the domain, and every action is in the audit logging.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- UKG Pro is read through the Personnel API with a service account, the US-Customer-Api-Key and basic authentication. employee-changes (at least three hours between calls; employeeId, employeeNumber, companyId, supervisorId, jobCode, workLocation, orgLevel1Code to orgLevel4Code, fullTimeOrPartTime, terminationDate) and employment-details.
- A KoppelHet agent on a Windows server in the domain writes employeeID (at most 16 characters), employeeNumber, sAMAccountName (at most 20 characters), userPrincipalName, givenName, sn, displayName, title, department, physicalDeliveryOfficeName, manager and accountExpires, and moves accounts between OUs.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in UKG Pro | Field in Active Directory | Notes |
|---|---|---|
employeeNumber | employeeID | Fixed key; at most 16 characters |
employeeId (systeemsleutel) | employeeNumber | |
Naamgevingsregel | sAMAccountName en userPrincipalName | sAMAccountName at most 20 characters |
firstName en lastName | givenName, sn en displayName | |
jobCode (omschrijving) | title | |
orgLevel-code die de afdeling is | department | |
workLocation | OU en physicalDeliveryOfficeName | Through a lookup table |
supervisorId | manager | |
terminationDate | accountExpires |
Related
Recruitee → UKG Pro
Recruitee to UKG Pro integration: European hires through the Global New Hire service in UKG Pro
Teamtailor → UKG Pro
Teamtailor to UKG Pro integration: European hires as global new hires
UKG Pro → ADP iHCM
UKG Pro to ADP iHCM integration: salary and terminations of the Dutch pay group to ADP
UKG Pro → AFAS Profit
UKG Pro to AFAS integration: Dutch employees of a US head office in AFAS Profit