Identity and access management
Workday to Okta integration: identities from HR, with your own rules for the Netherlands
With an integration between Workday and Okta, every new Dutch colleague from Workday appears in Okta automatically, ready to sign in on the first working day, with job title, department, employee number and manager. Okta then grants access to the right apps, and on departure that access closes on the last working day, following the Dutch rules rather than those of headquarters.
What the integration does
Anyone using Workday as HR system and Okta as identity platform for several countries often has the standard Workday app in Okta set up for headquarters. Different naming rules and exceptions for the Netherlands are then corrected by hand in Okta.
- HR completes a hire in Workday.
- KoppelHet derives login and email address from the agreed naming rules and stages the user in Okta, not yet able to sign in.
- On the first working day the user becomes active. The groups for company, location and job decide which apps Okta assigns.
- A job change updates details and groups on the effective date. During long leave the account can be suspended temporarily.
- After a departure the user is deactivated on the last working day, or immediately for a termination reason agreed for that.
What to watch for with Workday and Okta
- Okta has its own Workday integration. It only imports workers whose first working day and hire date are filled, and importing custom reports is deprecated in it. KoppelHet reads a Workday report itself, so filters and exceptions for the Netherlands stay manageable in Workday.
- A user who is staged but not yet active in Okta cannot sign in. KoppelHet therefore stages new colleagues as soon as the hire is completed, and only activates them on the first working day.
- Okta can take each piece of data from a different system. If Okta's Workday integration runs for other countries, we record per data item which integration is the source, so they do not overwrite each other.
- A departure can be completed in Workday weeks before the last working day. KoppelHet only deactivates on that day, except for termination reasons for which you agreed on immediate blocking, such as summary dismissal.
- Okta can also suspend an account instead of deactivating it. Long-term sick leave in Workday can result in such a suspension, so groups and apps are kept for the return.
- Dutch surnames with a prefix, such as van der Berg, are often held in one field in Workday. For the login we follow your Dutch convention, for example without spaces, while the surname in Okta stays as Workday shows it.
- Okta passes access on to apps such as Microsoft 365 or Slack. KoppelHet only writes to Okta, so Okta remains the single place where access is decided.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Why not just use Okta's Workday integration?
If it fits, we recommend it. KoppelHet comes in when the Netherlands has its own rules for naming, exceptions or extra sources that you do not want to maintain in Okta.
Can the email address go back to Workday?
Yes. KoppelHet can set the work address from Okta as the work email in Workday.
What about contractors who are not in Workday?
IT manages them itself in Okta. The integration only touches users it created or linked to an employee in Workday.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Workday is read through a RaaS report or Workday Web Services with an Integration System User, on completed business processes (Hire, Change Job, Terminate, Leave of Absence). Okta's own Workday app requires First Day of Work and Hire Date; import through custom reports is deprecated in it.
- Okta is written through the Okta Users API, with create without activation (status STAGED), activate, SUSPENDED or DEACTIVATED. Profile attributes include employeeNumber, firstName, lastName, login, email, title, department, managerId, manager, organization, costCenter and userType; profile sourcing per attribute.
- Access through an Okta service app with OAuth 2.0 and only the scopes for users and groups, no super admin. The work email goes back to the worker in Workday through the contact information business process.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Workday | Field in Okta | Notes |
|---|---|---|
Employee_ID of Contingent_Worker_ID | employeeNumber | |
Preferred name (voornaam) | firstName | |
Preferred name (achternaam) | lastName | |
Naamgevingsregel | login en email | |
Business title | title | |
Supervisory organization | department | Through a lookup table to a readable department name |
Manager (Employee_ID) | managerId en manager | |
Company | organization | |
Cost center | costCenter | |
Worker type | userType |
Related
Ashby → Workday
Ashby to Workday integration: hires to Workday, with a check on outcome and phone number
Bullhorn → Workday
Bullhorn to Workday integration: a consultant's first placement as a hire in Workday
Carerix → Workday
Carerix to Workday integration: a placed candidate becomes a pre-hire and starts the hire
Greenhouse → Workday
Greenhouse to Workday integration: hires as pre-hires, interim staff and contractors included