# UltiPro + Okta integration > Keep your HR data and identity management in sync, from day one to final offboarding. **Canonical page:** https://tray.ai/connectors/ultipro-okta-integrations/ **UltiPro connector:** https://tray.ai/connectors/ultipro-integrations/ **UltiPro documentation:** https://tray.ai/documentation/connectors/service/ultipro **Okta connector:** https://tray.ai/connectors/okta-integrations/ **Okta documentation:** https://tray.ai/documentation/connectors/service/okta ## Overview UltiPro (now UKG Pro) is a major HR, payroll, and talent management platform. Okta is the dominant name in identity and access management. When employee records change in UltiPro — a new hire, a role change, a termination — those changes need to show up in Okta fast, so the right people have access to the right systems. Integrating UltiPro with Okta cuts out the manual handoffs between HR and IT, reducing security risk and administrative overhead across the full employee lifecycle. HR and IT teams have long operated in silos, but employee identity is fundamentally built on HR data. When a new employee appears in UltiPro, IT needs to provision their Okta account and assign the right application access based on department, role, and location. When someone gets promoted or transfers teams, their access permissions should update to match. And when someone leaves, their Okta account needs to go dark immediately. Manually keeping these systems in sync is slow, error-prone, and creates real compliance and security exposure. Connecting UltiPro and Okta through tray.ai automates the full joiner-mover-leaver process, keeps you audit-ready, and gets IT out of the business of repetitive provisioning tickets. ## Use cases ### Automated New Hire Provisioning When a new employee record is created in UltiPro, tray.ai automatically creates an Okta user account populated with the correct profile attributes — name, email, department, job title, and manager. The new hire is enrolled in the right Okta groups and assigned the applications they need on day one, without any manual IT intervention. - Zero-touch provisioning from HR record creation to application access - Consistent attribute mapping cuts down on onboarding errors - New hires have the tools they need before they even log in for the first time ### Role Change and Transfer Access Updates When an employee's role, department, or location changes in UltiPro, tray.ai detects the update and adjusts the corresponding Okta profile attributes and group memberships. Access tied to their previous role gets revoked while new role-appropriate access is provisioned at the same time. Least-privilege stays intact without IT having to process a ticket for every org change. - Group memberships update automatically when roles change - Least-privilege access maintained across all role transitions - Clears the IT ticket backlog caused by manual transfer requests ### Instant Offboarding and Account Deactivation When a termination is recorded in UltiPro, tray.ai immediately deactivates the corresponding Okta account, kills all active sessions, and removes the user from all application assignments. No access lingers after an employee's status changes. Deactivation events are logged for audit and compliance purposes. - Account deactivation happens at the moment of termination, not hours later - All active SSO sessions revoked in real time - Audit-ready logs of every offboarding action taken ### Department-Based Application Access Governance tray.ai continuously syncs department and cost center data from UltiPro into Okta group structures, so application access policies stay current with your org chart. As departments grow or restructure, Okta groups update automatically. IT gets a reliable, HR-driven source of truth for access governance. - Okta groups always reflect the current UltiPro org structure - Reduces orphaned accounts and unauthorized application access - Makes access reviews and compliance audits much easier to run ### Manager Hierarchy Sync for Approval Workflows Manager relationships defined in UltiPro are automatically synced to Okta user profiles, so approval routing works correctly in downstream applications that depend on manager hierarchy. When reporting lines change, tray.ai propagates those changes to Okta without delay. This matters most for organizations using Okta Workflows or ITSM tools that route requests based on manager attributes. - Manager attributes in Okta always match UltiPro records - Accurate approval routing in downstream SaaS applications - Handles dynamic org changes without manual profile editing ### Contractor and Contingent Worker Lifecycle Management Non-employee workers tracked in UltiPro — contractors, consultants, temporary staff — can be automatically provisioned with time-limited or scoped Okta accounts based on worker type and contract end date. tray.ai monitors contract expiration dates in UltiPro and triggers automatic account deactivation when engagements end. It closes a security blind spot that catches a lot of organizations off guard. - Temporary worker accounts automatically expire at contract end - Scoped access limits contractor permissions to only what they need - Replaces manually tracked contractor offboarding spreadsheets ### HR-Driven Multi-Factor Authentication Policy Assignment Job level, risk classification, or geographic location stored in UltiPro can be used to dynamically assign Okta MFA policies and authentication requirements. Employees in finance or executive roles, for example, automatically receive stronger authentication requirements based on their UltiPro job profile. tray.ai bridges HR-defined risk profiles and Okta's policy enforcement engine. - MFA policies tied to HR-defined risk classifications - Policies update automatically when employees change roles or seniority - Reduces manual policy management in the Okta admin console ## Templates ### New Hire Auto-Provisioning: UltiPro to Okta Automatically creates a new Okta user account and assigns group memberships and application access whenever a new active employee record appears in UltiPro, using HR data to populate all required identity attributes. Connectors used: UltiPro, Okta ### Employee Profile Change Sync: UltiPro to Okta Detects updates to employee records in UltiPro — title, department, manager, or location changes — and syncs those changes to the corresponding Okta user profile and group assignments in real time. Connectors used: UltiPro, Okta ### Automated Offboarding: UltiPro Termination to Okta Deactivation Triggers immediate Okta account suspension and session revocation the moment an employee termination is recorded in UltiPro, ensuring no access persists after an employee's last day. Connectors used: UltiPro, Okta ### Contractor Lifecycle Management: UltiPro to Okta Provisions time-scoped Okta accounts for non-employee workers in UltiPro and automatically deactivates those accounts when contract end dates are reached, with optional manager notification before expiration. Connectors used: UltiPro, Okta ### Department Org Structure Sync: UltiPro to Okta Groups Continuously reconciles Okta group membership with the current department and cost center hierarchy in UltiPro, adding or removing users from groups as organizational structures change. Connectors used: UltiPro, Okta ### MFA Policy Assignment Based on UltiPro Job Profile Reads job level and department attributes from UltiPro and automatically assigns the appropriate Okta MFA enrollment policy to each user, so authentication requirements match HR-defined risk profiles. Connectors used: UltiPro, Okta ## Challenges Tray.ai solves ### Latency Between HR Events and IT Provisioning In many organizations, new hire provisioning or account deactivation depends on IT manually checking HR systems or waiting for emailed reports. The delays cut both ways: a new employee waits days for access, and a terminated employee's account stays live far longer than it should. **How Tray.ai helps:** tray.ai can poll UltiPro on a frequent schedule or respond to near-real-time events, triggering Okta actions within minutes of any HR record change. That closes the window between HR event and IT action — both the productivity hit for new hires and the security exposure from accounts that should already be gone. ### Complex Field Mapping Between HR and Identity Schemas UltiPro stores employee data in a detailed HR schema — job codes, cost centers, pay grades, org hierarchies — that doesn't map cleanly to Okta's user profile attributes. Translating between them by hand is slow and error-prone, and incomplete or wrong Okta profiles cause real problems downstream. **How Tray.ai helps:** tray.ai's data transformation tools let teams build precise mapping logic between UltiPro's HR data model and Okta's profile schema. Conditional logic, lookup tables, and custom field transformations can be configured without writing code, so every Okta attribute is accurately derived from the authoritative UltiPro source. ### Managing Access for a Mixed Workforce of Employees and Contractors Organizations with a significant contingent workforce often struggle to track non-employee records in UltiPro and make sure those workers get correctly scoped, time-limited Okta identities. Without automation, contractor accounts frequently outlive their engagements and become orphaned access that's hard to find and harder to audit. **How Tray.ai helps:** tray.ai differentiates between worker types in UltiPro and applies distinct provisioning logic for each. Contractor records trigger time-bound Okta account creation with restricted group assignments, while scheduled checks against contract end dates handle automatic deactivation — no manual IT intervention needed. ### Keeping Okta Groups Accurate During Rapid Org Changes During restructuring, mergers, or fast hiring periods, UltiPro data can change faster than IT can manually update Okta group memberships. Stale memberships leave employees with access they shouldn't have, or without access they still need — a problem for both security and day-to-day productivity. **How Tray.ai helps:** tray.ai runs continuous reconciliation workflows that compare live UltiPro org data against current Okta group memberships and resolves any discrepancies automatically. Okta stays current with UltiPro regardless of how fast the org changes, without IT administrators having to touch anything. ### Audit Readiness and Compliance Reporting Across Both Systems Frameworks like SOC 2, ISO 27001, and HIPAA require organizations to show that access was granted and revoked in a timely, documented way. When HR and identity systems are managed separately, producing a unified audit trail that ties provisioning events to specific HR changes usually means manually reconciling logs from both systems — and hoping nothing got missed. **How Tray.ai helps:** tray.ai logs every integration event — the UltiPro record change that triggered it, the Okta action taken, and the exact timestamp — creating a complete, cross-system audit trail. Those logs can be forwarded to a SIEM or data warehouse, giving compliance teams what they need to satisfy auditors without building manual reports. ## Learn more - Intelligent Integration: https://tray.ai/platform/intelligent-ipaas/ - Merlin Agent Builder: https://tray.ai/platform/merlin-agent-builder/ - Agent Gateway for MCP: https://tray.ai/platform/agent-gateway/ - Book a demo: https://tray.ai/contact/