Identity and access management
UKG Pro to Entra ID integration: Microsoft accounts for European employees from UKG Pro
With an integration between UKG Pro and Microsoft Entra ID, new employees of the Dutch and other European companies in UKG Pro get a Microsoft account with department, job title, location and manager, and sign-in is blocked on the end date from UKG Pro. Because UKG Pro returns changes at most every three hours, KoppelHet records the end date as soon as HR enters it.
What the integration does
Organisations that manage all employees in UKG Pro while their European sites have their own Microsoft 365 environment hear about new colleagues from the manager. Leavers only show up at the licence check.
- HR records a new employee at a European company in UKG Pro.
- Every three hours KoppelHet requests the changed employees and compares with the previous state.
- A new employee gets a Microsoft account according to your naming rules, with department, job title, location, country and manager. The account becomes active on the start date.
- When job, department or manager change, the details and groups in Entra ID follow.
- On the end date KoppelHet blocks sign-in and removes the employee from the groups.
What to watch for with UKG Pro and Microsoft Entra ID
- UKG Pro returns changed employees at most every three hours. A new colleague therefore has their account the same day, and because an end date is usually entered in advance, KoppelHet blocks on that date itself and not three hours later.
- UKG Pro reports which employees changed, not which field. KoppelHet compares with the previous state and only updates in Entra ID what is actually different, so groups do not change unnecessarily.
- UKG Pro has four organisation levels that each organisation fills in itself. At the start we record which level is the department and which the business unit, so groups in Entra ID hang at the right level.
- Employees belong to a company with a country code in UKG Pro. Only companies belonging to this Microsoft environment produce accounts, and the country code becomes the country a Microsoft 365 licence requires.
- For a rehire UKG Pro keeps a last hire date next to the original date. KoppelHet re-enables a blocked account of the same employee instead of creating a second account.
- The manager is stored in UKG Pro as a reference to another employee, who may work in the United States. If that person has no account in this Microsoft environment, KoppelHet leaves the field empty and notifies IT.
- Workday customers know Microsoft's ready-made HR integrations, but UKG Pro is not among them. KoppelHet supplies the data the way Microsoft describes for other HR systems, without scripts of your own in IT.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
How quickly does a new colleague have an account?
Within a few hours after HR records them in UKG Pro. The account becomes active on the start date.
Do US colleagues also get an account in our European environment?
No, only employees of the companies we designate at the start. The rest of UKG Pro stays outside this integration.
Does this also work with Active Directory in our own network?
Yes, through a small program in your network.
What can be traced afterwards for an audit?
Every action of the integration is recorded in the audit logging of the KoppelHet platform. KoppelHet works with an ISO 27001 certified management system.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- UKG Pro is read through the Personnel API with a service account, the US-Customer-Api-Key and basic authentication. employee-changes (at least three hours between calls; fields include employeeNumber, companyId, supervisorId, jobCode, workLocation, orgLevel1Code to orgLevel4Code, fullTimeOrPartTime, hireDate, terminationDate, isActive) and employment-details for lastHireDate. 429 with too many calls.
- Entra ID is written through Microsoft Graph (user) or through API-driven inbound provisioning (/bulkUpload with SCIM, requires Entra ID P1 or higher). Fields employeeId (at most 16 characters), employeeType, employeeHireDate, officeLocation, usageLocation, manager and accountEnabled = false on departure.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in UKG Pro | Field in Microsoft Entra ID | Notes |
|---|---|---|
employeeNumber | employeeId | Fixed key; at most 16 characters |
firstName en lastName | givenName en surname | |
Naamgevingsregel | userPrincipalName en mail | |
jobCode (omschrijving) | jobTitle | |
orgLevel1Code t/m orgLevel4Code | department | The level that is your department |
workLocation | officeLocation | |
Landcode van de company | usageLocation en country | |
supervisorId | manager | Looked up as an existing account |
fullTimeOrPartTime en employeeType | employeeType | |
lastHireDate en terminationDate | employeeHireDate en accountEnabled |
Related
Recruitee → UKG Pro
Recruitee to UKG Pro integration: European hires through the Global New Hire service in UKG Pro
Teamtailor → UKG Pro
Teamtailor to UKG Pro integration: European hires as global new hires
UKG Pro → Active Directory
UKG Pro to Active Directory integration: domain accounts for the Dutch branch
UKG Pro → ADP iHCM
UKG Pro to ADP iHCM integration: salary and terminations of the Dutch pay group to ADP