Identity and access management
Visma YouServe to Okta integration: employees from the payroll service as Okta users, per employer
With an integration between Visma YouServe and Okta, every new employee from YouServe becomes an Okta user with department, job, employer and manager, and the user is deactivated after the leaving date. Because Okta has no HR connector of its own for YouServe, KoppelHet delivers the employees as a custom HR source in Okta and writes the work email back to YouServe.
What the integration does
Groups with several employers that run payroll through Visma YouServe and use Okta as the sign-in for Microsoft 365 and business applications create Okta users based on an email from HR. Anyone moving to a sister company keeps the old email address and the groups of the previous employer.
- HR enters a new employee in YouServe, with employer, department and job.
- KoppelHet fetches the changes, compares them with the previous state and picks one employment per person as the basis.
- KoppelHet delivers the employee to Okta, with a username and email address on the employer's domain, and with the groups of employer and department.
- The work email goes back to YouServe, so it is correct in the HR records.
- After the leaving date of the last employment Okta deactivates the user.
Back: Work email
What to watch for with Visma YouServe and Okta
- The Okta catalogue has no HR connector for YouServe. KoppelHet sets up a custom HR source for YouServe in Okta. Okta then treats those employees as source-managed users, which IT cannot change by hand.
- YouServe often manages several employers in one environment. Okta holds one user per person. When someone moves to a sister company it stays the same Okta user, but email domain and employer group change on the effective date.
- When someone has two employments in YouServe, those are two records with the same person code. KoppelHet picks per person the record that decides department and job in Okta, and only deactivates once the last employment has ended.
- In YouServe the manager is attached to the organisational unit. For each employee KoppelHet looks up the manager of their unit and sets that as the manager in Okta. If someone is the manager of that unit themselves, they get the manager of the unit above.
- YouServe does not report changes itself. Each round KoppelHet compares with the previous state and sends only the differences to Okta. Okta processes one delivery at a time per HR source, so a small delivery is processed faster.
- Okta creates the username and email address, but YouServe also needs to know the address, for example for the payslip in self-service. KoppelHet writes the work email back to YouServe; the other data stays leading in YouServe.
- According to Visma, YouServe continues as Youforce. Because the person code is the fixed key in Okta, the same Okta user remains after that switch as long as the person code stays the same.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
What happens to Okta users who are not in YouServe, such as contractors?
The integration leaves them alone. KoppelHet only updates users that come from the YouServe source.
What happens to existing Okta users at the start?
We match them once to the employees in YouServe, on employee number or email address. Whatever cannot be matched is reviewed by IT before the integration goes live.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- YouServe is read with a client ID and secret through the YouServe IAM API (employees, organisational units with manager, job profiles and companies), compared with the previous state. The work email is written back to the employee.
- Okta is fed through the Identity Sources API (Anything-as-a-Source): per round a session with importType INCREMENTAL, bulk-upsert of users (at most 200 profiles per call, at most 50 calls per session), groups and memberships, and bulk-delete on leaving. Bulk-delete deactivates the user; Okta does not delete the profile. A session unused for 24 hours expires.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Visma YouServe | Field in Okta | Notes |
|---|---|---|
Persoonscode | externalId en employeeNumber | Fixed key; does not change with a new employment |
Roepnaam | firstName | |
Achternaam met voorvoegsels | lastName | |
Naamgevingsregel en werkgever | login en email | Domain per employer |
Functieprofiel | title | |
Organisatie-eenheid | department en groep | |
Werkgever (bedrijf) | organization en groep | |
Manager van de organisatie-eenheid | managerId | |
Datum uit dienst laatste dienstverband | Deactiveren via de HR-bron | |
email (Okta) | Zakelijk e-mailadres (YouServe) |
Related
BambooHR → Visma YouServe
BambooHR to Visma YouServe integration: the Dutch entity automatically to the payroll service
Deel → Visma YouServe
Deel to Visma YouServe integration: only own Dutch employees to the payroll service
HiBob → Visma YouServe
HiBob to Visma YouServe integration: Bob changes with the right effective date at the payroll service
Nedap ONS → Visma YouServe
Nedap ONS to Visma YouServe integration: approved hours and irregular-hours pay to the payroll service, employees back into scheduling