OIIdentity and access management
UKG Pro to One Identity integration: the Starling connector for UKG Pro, with its own mapping in One Identity Manager
With an integration between UKG Pro and One Identity Manager, every employee from UKG Pro becomes a Person in One Identity Manager, with department, job, supervisor and dates, so roles and attestations run on HR data. One Identity has a Starling Connect connector that can read UKG Pro, but no ready-made template as for Workday, SuccessFactors and Dayforce; KoppelHet builds that mapping and the synchronisation project.
What the integration does
Organisations with UKG Pro as HR system and One Identity Manager for identity governance often still read UKG through a nightly file. When moving to Starling Connect, the Cloud HR Systems template turns out to cover only Workday, SuccessFactors and Dayforce.
- In UKG Pro the administrator creates a service account with read-only rights for the web services the connector uses.
- In Starling Connect we enable the UKG Pro connector with that account's details.
- In the Synchronization Editor KoppelHet builds a project on the SCIM connector with mappings for Person and Department.
- Together with you we record which organisation level is the department and how rehire and leave count.
- After a trial synchronisation in a test database the schedule is switched on.
What to watch for with UKG Pro and One Identity
- Starling Connect has had a UKG Pro connector since October 2023, according to One Identity meant to read employees. It creates nothing in UKG and writes nothing back. A departure therefore always starts in UKG Pro; One Identity Manager follows.
- The Cloud HR Systems module of One Identity Manager provides templates for SuccessFactors, Workday and Dayforce, with ready-made mappings and workflows. There is no template for UKG Pro. KoppelHet builds the mapping to Person and Department itself on the SCIM connector and records it in the handover.
- In January 2024 the UKG Pro connector gained the EmpJobs and EmpEmployments endpoints, and the format of the id attribute changed. A synchronisation project from before then may run on an old key. At the start KoppelHet checks which format your environment uses, so no duplicate Persons arise.
- UKG Pro has four organisation levels that each organisation fills in itself. One Identity Manager builds departments as a tree. KoppelHet chooses with you which levels form the tree and sorts the departments so that a parent department always exists first.
- On a rehire UKG keeps a dateOfLastHire next to the original hire date. KoppelHet uses it as EntryDate, so One Identity Manager makes the existing Person active again with the new date instead of creating a second Person.
- UKG gives the supervisor as supervisorId, the ID of another employee. One Identity Manager needs the manager as a reference to another Person. KoppelHet resolves that reference after reading in all Persons, so attestations do not get stuck on an empty manager.
- According to One Identity the UKG Pro connector supports disabling attributes. KoppelHet switches off fields One Identity Manager does not need, such as home address and private phone, so that personal data does not come through Starling Connect.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Do we need Starling Connect?
For this route, yes. We check with One Identity beforehand whether it is in your One Identity licence.
Does One Identity Manager write anything back to UKG Pro?
No, the UKG Pro connector only reads. Writing the work email back can follow later as an extension.
What happens to a returning colleague?
They return on their existing Person, with the date of the last hire as the new entry date.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Starling Connect UKG Pro connector (since 04-10-2023, reading employee resources): endpoints Employees, EmpJobs and EmpEmployments (January 2024), disabling of attributes, changed format of the id attribute. One Identity Manager Cloud HR Systems module (9.3 or later) with the SCIM connector; templates only for SuccessFactors HR, Workday HR and Dayforce, so a custom synchronisation project in the Synchronization Editor.
- UKG Pro Personnel API (under the connector): Basic sign-in with US-CUSTOMER-API-KEY per tenant; fields include employeeId, employeeNumber, companyId, orgLevel1Code to orgLevel4Code, jobCode, supervisorId, isActive, employeeStatus, hireDate, dateOfLastHire and terminationDate.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in UKG Pro | Field in One Identity | Notes |
|---|---|---|
id (Employees-endpoint) | Person (sleutel) | |
employeeNumber | PersonnelNumber | |
firstName, lastName | FirstName, LastName | |
orgLevel1Code tot orgLevel4Code | Department (hiërarchie) | |
jobCode (EmpJobs) | Functie op de Person | |
supervisorId | Leidinggevende (UID_PersonHead) | |
hireDate, dateOfLastHire, terminationDate (EmpEmployments) | EntryDate, ExitDate |
Related
Recruitee → UKG Pro
Recruitee to UKG Pro integration: European hires through the Global New Hire service in UKG Pro
Teamtailor → UKG Pro
Teamtailor to UKG Pro integration: European hires as global new hires
UKG Pro → Active Directory
UKG Pro to Active Directory integration: domain accounts for the Dutch branch
UKG Pro → ADP iHCM
UKG Pro to ADP iHCM integration: salary and terminations of the Dutch pay group to ADP