Identity and access management
Zoho People to Okta integration: Okta users that follow what HR records in Zoho People
With an integration between Zoho People and Okta, a new employee from Zoho People gets an Okta user with department, designation, location and manager, and Okta deactivates that user on the Date of Exit from the offboarding process. Zoho can create Okta users itself through Zoho Directory, but then IT's assignment in Zoho Directory decides the account, not the hire or departure in Zoho People.
What the integration does
Organisations with Zoho People for HR and Okta for access often look at Zoho Directory's Okta provisioning first. There IT assigns users to the Okta app by hand, so a hire in Zoho People does not automatically produce an Okta user.
- In the Zoho API console we create a client with only the read scope on forms, in the data centre of your Zoho environment.
- We record which fields in the employee form hold department, designation, location and manager.
- Every fifteen minutes KoppelHet reads the changed records and stages new colleagues in Okta until their start date.
- Department and location decide the Okta groups, and with that the apps.
- On the Date of Exit KoppelHet deactivates the Okta user, in the night before Zoho People closes its own login.
What to watch for with Zoho People and Okta
- Zoho Directory can create, update, (de)activate and delete Okta users, but only for users IT assigns to the Okta app in Zoho Directory. A departure in Zoho People only reaches Okta once someone disables the user in Zoho Directory. KoppelHet reads the hire and the Date of Exit directly from Zoho People.
- If IT removes the Okta assignment in Zoho Directory, Zoho Directory deletes the user in Okta, along with their app assignments. KoppelHet only deactivates on departure, so the user and their history stay in Okta until you decide to delete.
- According to Zoho, Zoho Directory can only assign predefined Okta roles, not custom ones. KoppelHet does not deliver roles but groups per department and location, and your Okta rules decide which apps and rights go with them.
- A Zoho People administrator chooses whether the Date of Exit appears when the resignation is approved or only on the last working day. Zoho People closes a leaver's own login at 8:30 in the morning after the last working day by default. KoppelHet deactivates the Okta user in the night before, so both logins close together.
- Reporting To in Zoho People is a reference to another employee record. Okta only accepts string values in a custom HR source. KoppelHet converts the reference to the manager's Employee ID, so managerId points to an existing Okta user.
- The email field in Zoho People is also the login for Zoho People. KoppelHet therefore does not write the Okta address back automatically; that would change the employee's sign-in. If a new colleague uses a private address as Zoho login, KoppelHet builds the Okta login following the naming rule.
- Zoho People returns at most two hundred records per request and blocks the whole environment for five minutes above four hundred requests per minute. Every fifteen minutes KoppelHet only requests records changed since the previous run, so other Zoho integrations are not blocked.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Why not Zoho Directory's Okta provisioning?
It works on assignments in Zoho Directory, not on HR events in Zoho People. If that is enough for you, custom work is not needed.
Does KoppelHet write the Okta address back to Zoho People?
Not by default, because that field is also the Zoho login. A separate field for the work address can follow later as an extension.
Does the integration read salaries in Zoho People?
No. The client only has read rights on the forms we agree.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Zoho People API with OAuth 2.0 (Authorization: Zoho-oauthtoken) and scope ZOHOPEOPLE.forms.READ: GET /people/api/forms/employee/getRecords with sIndex, limit (at most 200) and modifiedtime in milliseconds; four hundred requests per minute, above that a five-minute block. Data centre (zoho.com or zoho.eu) per customer.
- Okta through a Custom Identity Source (Identity Sources API: one session at a time, bulk upsert of up to 200 profiles per request, string values only, bulk delete deactivates) or through the Users API with an OAuth 2.0 service app (status STAGED, ACTIVE, DEPROVISIONED).
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Zoho People | Field in Okta | Notes |
|---|---|---|
EmployeeID | employeeNumber en externalId | |
FirstName en LastName | firstName en lastName | |
EmailID of naamgevingsregel | login en email | |
Department | department en groep | |
Designation | title | |
Location | city en groep per locatie | |
Reporting To | managerId | Converted to the manager's Employee ID |
Date of Exit | Deactiveren |
Related
Recruitee → Zoho People
Recruitee to Zoho People integration: hired candidates in the Zoho People employee form
Teamtailor → Zoho People
Teamtailor to Zoho People integration: hired candidates as a record in the Zoho People employee form
Zoho People → Active Directory
Zoho People to Active Directory integration: HR drives the domain account, not the other way round
Zoho People → AFAS Profit
Zoho People to AFAS integration: new hires and changes to Dutch payroll