Identity and access management
UKG Pro to Okta integration: the Dutch entity in Okta from UKG Pro
With an integration between UKG Pro and Okta, every new employee from UKG Pro gets an Okta user with job title, org level, company and manager, and access closes on the termination date. KoppelHet applies the own rules of a Dutch or European entity for naming, departures and rehires.
What the integration does
Organisations that use UKG Pro for all employees and Okta for access often have their setup aimed at the US head office. A Dutch site has its own naming rules and a different moment of blocking, and these are corrected by hand.
- HR records a new employee in UKG Pro at the Dutch company.
- KoppelHet picks up the change and stages the user in Okta with a login following the Dutch convention.
- On the start date the user becomes active; groups for company and org level grant the apps.
- On a rehire the existing Okta user is switched back on instead of a second one being created.
- On the termination date, in Dutch time, KoppelHet deactivates the user.
What to watch for with UKG Pro and Okta
- KoppelHet reads UKG Pro with a separate service account with read rights only on the employee data the integration needs.
- UKG Pro has four org levels that each organisation fills in itself. At the start we record which level is the department for the Netherlands, so groups in Okta do not stay at the American level.
- Groups per employee attribute quickly run to hundreds with four org levels and several companies. KoppelHet only delivers the groups that are in your access design.
- On a rehire UKG Pro keeps a last hire date next to the original date. KoppelHet recognises the return and switches the existing Okta user back on, with the old login.
- UKG Pro returns changed employees at most every three hours. Because a termination date is usually entered in advance, KoppelHet deactivates on that date itself at the end of the Dutch working day, not only at the next run.
- The manager of a Dutch employee often works in the United States. KoppelHet looks up that manager's Okta user across the whole Okta org, so approvals reach the right person.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
What about audit logging, GDPR and our integration platform?
Every action of the integration is in the audit logging of the KoppelHet platform, which runs in the EU. You are the controller and KoppelHet is the processor, under a data processing agreement; only the fields in the design are transferred. An existing integration platform is left alone.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- KoppelHet reads UKG Pro through the Personnel API with a service account and the US-Customer-Api-Key: employee-changes (at least three hours between calls; including employeeNumber, companyId, supervisorId, jobCode, orgLevel1Code to orgLevel4Code, fullTimeOrPartTime, hireDate, terminationDate) and employment-details for lastHireDate.
- Okta is written through the Users API with an OAuth 2.0 service app.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in UKG Pro | Field in Okta | Notes |
|---|---|---|
employeeNumber | employeeNumber | |
firstName of preferredName | firstName | |
lastName | lastName | |
Naamgevingsregel | login en email | |
jobCode (omschrijving) | title | |
orgLevel1Code t/m orgLevel4Code | department en division | Record per customer which level is the department |
companyId | organization | |
supervisorId | managerId en manager | |
fullTimeOrPartTime | userType | |
hireDate, lastHireDate en terminationDate | status (STAGED, ACTIVE, DEPROVISIONED) |
Related
Recruitee → UKG Pro
Recruitee to UKG Pro integration: European hires through the Global New Hire service in UKG Pro
Teamtailor → UKG Pro
Teamtailor to UKG Pro integration: European hires as global new hires
UKG Pro → Active Directory
UKG Pro to Active Directory integration: domain accounts for the Dutch branch
UKG Pro → ADP iHCM
UKG Pro to ADP iHCM integration: salary and terminations of the Dutch pay group to ADP