Identity and access management
Unit4 HR to Okta integration: employees from Unit4 ERPx as the HR source for Okta
With an integration between Unit4 HR and Okta, every approved employee from Unit4 ERPx becomes an Okta user, with company, department, cost centre, job and manager of their main employment. A change takes effect in Okta on the date Unit4 records for it, and after departure Okta deactivates the user.
What the integration does
Organisations that record HR in Unit4 ERPx and have Okta as their access layer get new colleagues into Okta through a ticket or an export. A transfer HR enters weeks ahead reaches Okta too early or too late, and someone with two employments sometimes gets the rights of the wrong one.
- In Unit4 a machine client is created for KoppelHet, and in Okta the account team enables a custom HR source.
- KoppelHet fetches the employees changed since the previous run, with their employments and relations.
- KoppelHet skips employees still in an approval workflow until the workflow is done.
- KoppelHet delivers the data of the main employment to the HR source in Okta, with groups per company and department.
- After the end date KoppelHet removes the employee from the HR source, and Okta deactivates the user.
What to watch for with Unit4 HR and Okta
- An employee can have several employments at once in Unit4, and Okta only accepts single text values from a custom HR source, not lists. KoppelHet therefore fills job, department and cost centre from the main employment, and turns a second employment only into an extra group membership.
- Organisational unit, cost centre and manager hang off the employee in Unit4 as relations with a date from and to. KoppelHet delivers the new value to Okta on the day the relation takes effect, so the apps of the new department are not open weeks before the transfer.
- Okta decides on the external ID whether a user is new or already exists, and that ID must never change. A Unit4 tenant can hold several companies; KoppelHet builds the ID from company and person number, so a move to another company in the same tenant does not produce a second Okta user.
- A new employee can first sit in an approval workflow in Unit4. KoppelHet only delivers them to Okta once that workflow is complete, so a rejected entry produces no Okta user and no app licences.
- Unit4 recommends fetching changes from the start of the previous run, so an employee can come back twice. Okta processes one session at a time per source and accepts no new one within five minutes of triggering. KoppelHet merges duplicates and delivers each run in a single session.
- Unit4 only issues a machine client for integrations through a user with the SUPER or SYSTEM role, and a tenant has at most ten. Okta uses its own service app with its own key. KoppelHet keeps both separately, so you can revoke access to Unit4 independently of Okta.
- A session in Okta takes at most fifty requests of two hundred users. On the first load of a large Unit4 tenant KoppelHet spreads the employees over several sessions in a row, and after that only the changes go along.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Which employment counts with two jobs?
The main employment in Unit4. The second only gives an extra group in Okta.
Does payroll data go to Okta?
No. Only name, company, organisation, job, manager and the employment dates.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Unit4 ERPx through the ObjectAPI (GET /v1/objects/employees) with OAuth 2.0 client credentials through Unit4 Identity Services (scope u4erp, token 3600 seconds, M2M user with role SUPER or SYSTEM, at most 10 per tenant). Incremental with a filter on lastUpdated ge the start of the previous run; fields include companyId, personId, nameInformation, status, employments and relatedValues with date from and to; an entry in workflow returns 202.
- Okta through the Identity Sources API (Custom Identity Source) with a service app and OAuth 2.0; sessions (one at a time per source, five minutes wait after triggering), bulk-upsert with externalId and text attributes only (200 per request, 50 requests per session), groups and memberships separately, bulk-delete deactivates.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Unit4 HR | Field in Okta | Notes |
|---|---|---|
companyId + personId | externalId | Unique across all companies |
nameInformation (voornaam) | firstName | |
nameInformation (achternaam) | lastName en displayName | |
Naamgevingsregel of e-mail uit Unit4 | email en login | |
Bedrijf | organization en groep | |
Organisatie-eenheid (relatie) | department en groep | |
Kostenplaats (relatie) | costCenter | |
Functie van het hoofddienstverband | title | |
Leidinggevende (relatie) | managerId | Key of the manager |
Related
Greenhouse → Unit4 HR
Greenhouse to Unit4 HR integration: accepted offer as an employee in the right Unit4 company
Recruitee → Unit4 HR
Recruitee to Unit4 HR integration: hired candidate as employee in Unit4, validated before it is saved
SmartRecruiters → Unit4 HR
SmartRecruiters to Unit4 HR integration: hire on the position from SmartRecruiters, with onboarding status back
Teamtailor → Unit4 HR
Teamtailor to Unit4 HR integration: hired candidates as employees in Unit4 ERPx, with company and position