Identity and access management
YouForce to Okta integration: Visma Raet as the HR source for Okta users and groups
With an integration between Visma Raet YouForce and Okta, every new employee from YouForce gets an Okta user with department, cost centre, manager and the groups that grant access to apps. A temporary assignment to another department adds groups for that period, and after the end date of the employment Okta deactivates the user.
What the integration does
Organisations that use YouForce for HR and payroll and Okta as the gateway to Microsoft 365 and SaaS apps often receive changes from HR through a weekly export. Anyone temporarily helping another team gets access by hand and often keeps it too long.
- The organisation grants KoppelHet read access to the basic data in YouForce through Visma.
- KoppelHet fetches the changed persons and employments and determines the main employment per person.
- KoppelHet delivers the employees to Okta as an HR source, with the departments as groups and the employees as members.
- A temporary assignment in YouForce adds the employee to the other department's group for that period, and removes them on the end date.
- After the end date of the last employment KoppelHet removes the employee from the HR source and Okta deactivates the user.
What to watch for with Visma Raet YouForce and Okta
- Okta has its own entry point for delivering an HR source, the Identity Sources API. That is where KoppelHet puts the YouForce data, so for Okta YouForce is a full HR source.
- Through that entry point KoppelHet also delivers groups and their members. A temporary assignment in YouForce, for example three months helping another team, thus becomes a temporary membership of that team's group, with the apps that go with it.
- YouForce does not record the manager on the employee, but as a role on the department. KoppelHet derives the manager for each employee from it, so approvals in apps behind Okta reach the right person.
- Persons disappear from the data YouForce supplies for IAM after a set period. KoppelHet therefore keeps its own record of which Okta users come from YouForce, so a leaver is still removed after that period.
- With a separate permission the Okta login can go back to the YouForce account. Employees then sign in to YouForce self-service with the same identity as in the rest of their apps.
- An employee can be split across several cost centres in YouForce. Okta holds one cost centre per user; KoppelHet picks the one with the largest share.
- Whether a person is still in YouForce does not say whether access should stop. KoppelHet uses the end date of the last employment, so an employee with two employments stays active until both have ended.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
What access does KoppelHet need in YouForce?
Read access to basic data. Private data such as BSN and home address falls under a separate scope we do not request.
What happens to Okta users who are not in YouForce?
The integration leaves them alone. Only users that come from the YouForce source are updated by KoppelHet.
What can be traced afterwards for an audit?
Every action of the integration is recorded in the audit logging of the KoppelHet platform. KoppelHet works with an ISO 27001 certified management system.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- YouForce is read through the Youforce IAM API (base URL api.youforce.com/IAM, OAuth 2.0) with the Youforce-IAM:Get_Basic scope for persons, employments, role assignments, assignments and cost allocation, on latestSync. Persons outside the historicaldays are not returned. The identity is written back with Youforce-IAM:Update_Identity (PATCH /v1.0/users(employeeId=…)/identity).
- Okta is fed through the Identity Sources API (custom identity source) with sessions, bulk-upsert for users, bulk-groups-upsert and bulk-group-memberships-upsert for departments and assignments, bulk-group-memberships-delete when an assignment ends and bulk-delete on leaving.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Visma Raet YouForce | Field in Okta | Notes |
|---|---|---|
Persoonsnummer | externalId en employeeNumber | |
Roepnaam | firstName | |
Achternaam volgens gebruik achternaam | lastName | |
Naamgevingsregel | login en email | |
Functie (job profile) | title | |
Organisatie-eenheid | department en groep | |
Rolverdeling op de organisatie-eenheid | managerId | |
Kostenplaats uit de loonverdeling | costCenter | Largest share |
Tijdelijke inzet (begin en einde) | Extra groepslidmaatschap | |
Soort arbeidsrelatie | userType |
Related
ADP Workforce Now → Visma Raet YouForce
ADP Workforce Now to YouForce integration: requests for new Dutch hires and contract changes
Bullhorn → Visma Raet YouForce
Bullhorn to YouForce integration: a placement becomes a hire request
Carerix → Visma Raet YouForce
Carerix to YouForce integration: a placed candidate starts the hire workflow in YouForce
Darwinbox → Visma Raet YouForce
Darwinbox to YouForce integration: hires and pay changes from Darwinbox as a request in YouForce