Identity and access management
Visma Peple to Okta integration: employees and substitutes from Peple as the HR source for Okta
With an integration between Visma Peple and Okta, every employee from Peple becomes an Okta user, with organisational unit, job and manager, and a substitute only gets access while their replacement runs. After the end date of the contract or replacement Okta deactivates the user, without any personal data from Peple reaching Okta.
What the integration does
Organisations that use Visma Peple for HR and Okta for access often enter new colleagues and substitutes twice. Okta therefore lags behind Peple, and a substitute keeps access long after their replacement has ended.
- In Visma Connect KoppelHet gets a client with only the export scopes for employees, contracts, organisational units and replacements; in Okta the account team enables a custom HR source.
- KoppelHet starts the exports in Peple and waits until the files are ready.
- KoppelHet compares the rows with the previous state and delivers only real changes to Okta in one session.
- Okta creates or changes the user and assigns apps through the groups per organisational unit.
- After the last contract or the last replacement KoppelHet delivers the removal and Okta deactivates the user.
What to watch for with Visma Peple and Okta
- Peple delivers data as an export that is started first and is ready as a file later. An Okta session for a custom HR source expires after 24 hours without activity. KoppelHet only opens the Okta session once all Peple files are in, so a half-filled session is never left hanging.
- According to Visma, an incremental Peple export sometimes contains employees who did not change. An empty upload leaves an Okta session in created status, and triggering it then gives an error. KoppelHet filters out the false changes and does not open a session when nothing has changed.
- Peple has a separate export for replacements, with start and end date. KoppelHet adds a substitute to the HR source when the replacement starts and removes them when it ends; Okta then deactivates the user, even if the contract in Peple continues.
- Okta only accepts fields from a custom HR source as single text values, without lists. If someone works under contracts at two schools, KoppelHet puts the school of the main contract in the department field and the other schools as group membership, so the apps of both schools still follow.
- In Peple the manager is a user ID on the contract. Okta has the managerId field, which expects the key of another user. KoppelHet looks up the employee number for that user ID, so the manager in Okta points to the right colleague.
- Okta wants an email address for every user. Peple returns the business address without an extra scope, while private contact details and BSN require their own scope. KoppelHet does not request those scopes, so Okta never gets a private address as a login.
- Peple allows a full export twice a day per resource. With a custom HR source Okta only processes what is delivered and does not see a missing employee as a departure. KoppelHet uses the nightly full export to detect leavers itself and delivers them as removals.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Do BSN or private address reach Okta?
No. The integration does not request the scopes for contact and tax data.
What happens on Saturday evening, when Peple has maintenance?
KoppelHet then waits the time Peple specifies and delivers afterwards. Okta keeps the previous state meanwhile.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Peple through the Visma.net HRM & Payroll Reporting API (Visma Connect client credentials) with scopes for the exports of employees, contracts, organizationunits and employeereplacement: POST /v1/command/nl/hrm/..., result through GET /v1/query/nl/hrm/.../{jobId}; incremental with changeTimestampAfter; two full refreshes per endpoint per tenant per 24 hours; 503 with Retry-After during maintenance.
- Okta through the Identity Sources API (Custom Identity Source): one session at a time, bulk-upsert for users (externalId, text attributes only, at most 200 per request and 50 requests per session), groups and memberships separately, bulk-delete deactivates; a session expires after 24 hours without activity; importType INCREMENTAL only.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Visma Peple | Field in Okta | Notes |
|---|---|---|
Personeelsnummer | externalId en employeeNumber | Fixed, never changes |
Voornaam | firstName | |
Achternaam en partnername volgens nameusage | lastName en displayName | |
businessemailaddress of naamgevingsregel | email en login | |
functionname (contract) | title | |
costcenter (contract) | costCenter | |
orgunit met orgunitparentid | Groep per eenheid en department | |
manageruserid | managerId | Converted to employee number |
replacement_startdate en replacement_enddate | Opnemen in of verwijderen uit de HR-bron |
Related
Visma Peple → Active Directory
Visma Peple to Active Directory integration: accounts from Peple HRM & Payroll
ASVisma Peple → Arbodienst (SIVI)
Visma Peple to occupational health service via SIVI: sick and recovery notifications from Peple to the health service
Visma Peple → Microsoft Entra ID
Visma Peple to Entra ID integration: Microsoft accounts from Peple HRM & Payroll
Visma Peple → Exact Online
Visma Peple to Exact Online integration: cost centres ready in Exact and employee changes on a worklist