Identity and access management
UKG Pro to Ping Identity integration: PingOne users and populations from UKG Pro
With an integration between UKG Pro and Ping Identity, every employee from UKG Pro becomes a user in PingOne, in their country's population and with job title and supervisor, and is disabled on the end date from UKG. PingOne's only inbound HR source is Workday; KoppelHet reads UKG Pro within UKG's schedule and writes through the SCIM API that Ping advises for imports.
What the integration does
Organisations with UKG Pro as HR system and PingOne for sign-in and MFA often load employees into PingOne through a CSV import. Dutch colleagues then end up in the American default population, with the wrong password policy, and a departure is only processed at the next import.
- In UKG Pro the administrator creates a service account with View on the Employee Export web service.
- PingOne gets a Worker app with the Identity Data Admin role and a custom attribute for the supervisor.
- Together with you we record which countries go to which population.
- At go-live we link existing PingOne users to their employeeId.
- After that KoppelHet reads the changes every three hours and disables leavers on their end date.
What to watch for with UKG Pro and Ping Identity
- As inbound sources PingOne knows an LDAP gateway, SCIM and Workday. For importing users Ping advises the SCIM Users API, not the SCIM provisioning connection. KoppelHet uses that API for UKG Pro, for which no dedicated entry exists.
- UKG advises using the changes service at most eight times a day, with at least three hours in between. KoppelHet therefore reads every three hours, but disables a leaver who was already entered ahead in UKG itself on the end date, not at the next round.
- UKG supplies a countryCode per employee. KoppelHet puts every user in their country's PingOne population, so password and MFA policy can differ per country. If the country is missing, KoppelHet holds the employee back instead of letting them land in the default population.
- On a rehire UKG keeps a dateOfLastHire next to the original date. KoppelHet first searches PingOne on externalId and re-enables an existing user, so the returning colleague keeps their MFA registration.
- Besides the legal first name UKG gives a preferredName. PingOne has nickName for that, which Ping does not want used as a username. KoppelHet puts the preferred name there and builds the username separately from the naming rule.
- PingOne accepts only one email address per user, while UKG has an emailAddress and an alternateEmailAddress. KoppelHet only puts the business emailAddress in PingOne, so recovery emails do not go to a private address.
- PingOne returns at most two hundred users through SCIM, without a next page. KoppelHet therefore compares per employee on externalId and not with a full list, so a large group does not silently fall outside the comparison.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Why not every fifteen minutes?
UKG asks for at least three hours between calls to the changes service. KoppelHet still processes a departure on a date entered ahead on the day itself.
Is a leaver deleted from PingOne?
No, the user is disabled. Deleting remains IT's choice.
Can Dutch employees get a different MFA policy?
Yes, through their own population in PingOne, which KoppelHet derives from the country in UKG.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- UKG Pro Personnel API: GET {hostname}/personnel/v1/employee-changes with Basic sign-in and US-CUSTOMER-API-KEY, page and per_page (maximum 200), at least three hours between calls; fields employeeId, firstName, lastName, preferredName, emailAddress, alternateEmailAddress, jobCode, supervisorId, countryCode, isActive, hireDate, dateOfLastHire and terminationDate.
- PingOne through a Worker app with the Identity Data Admin role: SCIM /v2/Users with externalId, userName, one email value, nickName, title, active and population.id in the PingOneUser extension; lists up to 200 without pagination; changing population through PUT /users/{id}/population; supervisor as a custom attribute of type string.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in UKG Pro | Field in Ping Identity | Notes |
|---|---|---|
employeeId | externalId | |
firstName, lastName | name.givenName, name.familyName | |
preferredName | nickName | |
Naamgevingsregel | userName | |
emailAddress | emails (één waarde) | |
jobCode (omschrijving) | title | |
countryCode | population.id | |
supervisorId | Supervisor (eigen attribuut) | |
isActive, hireDate, dateOfLastHire, terminationDate | active (enabled) |
Related
Recruitee → UKG Pro
Recruitee to UKG Pro integration: European hires through the Global New Hire service in UKG Pro
Teamtailor → UKG Pro
Teamtailor to UKG Pro integration: European hires as global new hires
UKG Pro → Active Directory
UKG Pro to Active Directory integration: domain accounts for the Dutch branch
UKG Pro → ADP iHCM
UKG Pro to ADP iHCM integration: salary and terminations of the Dutch pay group to ADP