How to Sync UKG Pro and AD (or Entra ID) with Connect to AD
Connect to AD uses the UKG Pro API to read employee records and determine what needs to be sent over to Active Directory. Here’s how to set up the UKG Pro service account and connection.
Connect to AD uses the UKG Pro API to read employee records and determine what needs to be sent over to Active Directory.
You will need to set up a UKG Pro service account to access the UKG Pro API.
Create the Service Account
Service accounts can be added directly in UKG Pro by navigating to:
Menu > System Configuration > Security > Service Account Administration > Add
Enter a user name. We recommend using ConnecttoAD as the user name so that its purpose is recognizable to others.
Enter an email. We recommend using noreply@ukg.com. The email address is no longer used by UKG but is still required.
The password will be auto-generated upon clicking the Save button. You need to record the generated password as you will need to enter it into Connect to AD when configuring the UKG Pro connection.
Assign Permissions
Next, we will assign the service account permissions. Select the View (and Edit) permissions for the following services:
Employee Person Details (required for Person-related fields).
Personnel Integrations (required for the Employment, Alternate Phone and Platform Configuration-related fields).
Company Configuration Integration (required for Org Level, Job, Location and Project-related fields).
Employee Person (only required if you intend to send the Active Directory Email Address back to UKG Pro for USA and Canada employees).
Employee Global New Hire (only required if you intend to send the Active Directory Email Address back to UKG Pro for Global employees).
Employee Phone Information (only required if you intend to send the Active Directory Phone Number back to UKG Pro).
After the service account has been saved, you should see it under:
Menu > System Configuration > Security > Service Account Administration
Collect the Connection Details
We will need the following data:
Service Account User Name
Service Account Password (the generated password from saving the service account)
Customer API Key
User API Key
UKG API Host
You can get this information by navigating to:
Menu > System Configuration > Security > Web Services
We don’t need the full URL, we only need to record the host section.
If you are using a PRODUCTION instance of UKG Pro it would most likely be one of the following:
https://service2.ultipro.com
https://service3.ultipro.com
https://service5.ultipro.com
https://useast1-gateway.ukg.net
If you are using a TEST instance of UKG Pro it would most likely be one of the following:
https://rental2.ultipro.com
https://rental3.ultipro.com
https://rental4.ultipro.com
Connect in Connect to AD
Open Connect to AD and navigate to the UKG Pro Connection section. Here you will be able to enter and check the connection to the UKG Pro API.
After entering the connection details, you can check if the connection is valid by clicking on the green check button.
By default, Connect to AD does not read the custom datasets, User-Defined and Platform Configuration fields. This is by design to make the sync process complete faster if custom fields are not required.
If you intend to create rules or mappings that reference user-defined or platform configuration fields, please switch on the settings to include user-defined or platform configuration fields.
Click here to book a demo with our team.
