Identity and access management
UKG Pro to SailPoint integration: UKG Pro Core HCM as the authoritative source in Identity Security Cloud
SailPoint has its own SaaS connector for UKG Pro Core HCM, which imports employees from UKG Pro as an authoritative source, including future hires and leavers if you configure it. With an integration between UKG Pro and SailPoint, statuses, organisation levels and manager from UKG therefore drive roles and the removal of access; KoppelHet sets up the service account and the filters and monitors the aggregations.
What the integration does
Organisations that use UKG Pro for HR and payroll and SailPoint Identity Security Cloud for access management often leave the connector's default setting in place. It only reads active employees, so a new colleague only appears in SailPoint after the start date and a leaver simply disappears instead of getting an end date.
- In UKG Pro the administrator creates a web service account with only the roles the connector needs.
- In SailPoint we set up the UKG Pro Core HCM source with the base URL, the service account and the Customer API Key.
- We configure which statuses, future hires and leavers the connector includes, and switch on delta aggregation.
- In SailPoint's identity profile we define the lifecycle states based on status, hire date and termination date.
- After each aggregation KoppelHet compares the number of employees with UKG Pro and reports deviations.
What to watch for with UKG Pro and SailPoint
- Without extra configuration SailPoint's UKG connector only fetches employees with the status Active. Leave of absence, on strike, released or laid off and suspended you add yourself. Terminated employees do not belong in that list but have a switch of their own. KoppelHet fixes these choices with your HR team, so a colleague on long-term leave does not suddenly drop out of SailPoint.
- The Active status must stay in the list of statuses. If you remove it, the aggregation fails with a validation error. When adjusting the filters KoppelHet therefore checks the source configuration first, before the aggregation schedule runs again.
- The connector only fetches future hires if you switch that on, with an optional number of days before the start date. KoppelHet picks that number so laptop and accounts are ready in time, while a candidate hired months ahead does not get an identity yet.
- For terminated employees you can set a number of days back, or leave the field empty for every leaver ever. Leaving it empty makes the first aggregation of an organisation with years of history needlessly large. KoppelHet sets a period that fits the retention of accounts in SailPoint.
- The service account in UKG Pro gets a role per web service. For reading employees View on the Employee Export Web Service is enough; for custom fields, employments and platform fields View on the Personnel Integration Web Service is added, and for writing back also Add. KoppelHet only grants the roles for what you actually use.
- Writing back to UKG runs through UKG's import API, which first places a change in a queue. If that takes longer than the default wait of ten seconds, SailPoint reports the update as failed while UKG still processes it later. KoppelHet raises that wait time in the source configuration and checks the outcome in UKG.
- The connector only works with the Core HCM module of UKG Pro and only with a username, password and Customer API Key. Data from other UKG products, such as schedules from UKG Pro Workforce Management, does not come through this source. If roles need it, KoppelHet delivers it separately.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
SailPoint already has a UKG Pro connector. What does KoppelHet do then?
Setting up the service account and roles in UKG, aligning the filters for statuses, hires and leavers with HR, configuring the lifecycle states and monitoring the aggregations.
Does a new colleague appear in SailPoint before the start date?
Yes, if the option for future employees is on. With the number of days in advance we decide how early.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- SailPoint UKG Pro Core HCM SaaS connector: full, single and delta aggregation, aggregation of future hires, terminations and extra statuses, custom (user defined) fields and platform fields, update account. Connection with base URL (https://….ultipro.com, HTTPS only), Basic Authentication with Service Account Username, Password and Customer API Key; Page Size 200 by default and at most; aggregation timeout in seconds.
- Rights of the web service account in UKG (System Configuration > Security > Service Account Administration): View on Company Configuration Integration (test and organisation details), View on Employee Export (aggregation), View on Personnel Integration (employment, custom fields, platform fields), View and Add on Personnel Integration for provisioning. Wait time for the import API through the source attribute conProvResultPollTimeout (10 seconds by default).
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in UKG Pro | Field in SailPoint | Notes |
|---|---|---|
employeeId | Account ID | Must not change according to SailPoint |
firstName, lastName, preferredName | Voornaam, achternaam en roepnaam van de identiteit | |
emailAddress | E-mail | |
employeeStatus, isActive | Lifecycle state | |
hireDate, terminationDate | Start- en einddatum (lifecycle state) | |
orgLevel1Code tot orgLevel4Code | Afdeling en organisatie voor rollen | |
jobCode, workLocationCode, countryCode | Functie, locatie en land | |
supervisorId | Manager | Refers to the supervisor's employeeId |
employeeType, fullTimeOrPartTime | Soort medewerker |
Related
Recruitee → UKG Pro
Recruitee to UKG Pro integration: European hires through the Global New Hire service in UKG Pro
Teamtailor → UKG Pro
Teamtailor to UKG Pro integration: European hires as global new hires
UKG Pro → Active Directory
UKG Pro to Active Directory integration: domain accounts for the Dutch branch
UKG Pro → ADP iHCM
UKG Pro to ADP iHCM integration: salary and terminations of the Dutch pay group to ADP