Skip to main content
Connect UKG Ready to Oleria to use your HR system as the source of truth for who works for you. Oleria reads employees, people, departments (cost centers), manager relationships, and each employee’s UKG Ready login. It then compares identity provider (IdP) and SaaS access against that worker record, so a leaver who still holds access somewhere else becomes visible. To set it up, you create an OAuth application in UKG Ready and give its security profile access to the REST API. You then enter your tenant host, company, and the application’s client ID and secret in Oleria. One Oleria connection maps one UKG Ready company.
This integration is for UKG Ready (formerly Kronos Workforce Ready). For UKG Pro, see UKG Pro.

​
What Oleria discovers

Once connected, Oleria continuously discovers and maps the following from UKG Ready:
  • Employees - every employee in the company, including employee number, name, work email, company name, default cost center, hire date, and termination date. If an employee was rehired after a termination, Oleria treats them as current.
  • People - the person record for each employee.
  • Accounts - each employee’s own UKG Ready login, with username and status. A login is shown as disabled when it’s locked, or when the employee is terminated or inactive.
  • Departments - the cost centers of one cost-center tree, and how they nest.
  • Manager relationships - each employee’s primary manager, used to build your reporting hierarchy.
  • Department assignments - each employee’s default cost center in that tree.
Oleria refreshes this data on its regular sync schedule. Oleria reads each employee’s record on every sync, so syncs of a large company take a while. For example, a company with 5,000 employees takes about 20 minutes.
Oleria never requests or stores sensitive personal data from the employee record. That includes Social Security and other national ID numbers, birth date, home address, and personal phone numbers.

​
Prerequisites

  • Administrator permission on the Oleria workspace.
  • A UKG Ready administrator who can create OAuth applications and edit security profiles.
  • Your tenant host: the host in the address you sign in on, for example secure3.saashr.com. Hosts under .saashr.com and .workforceready.com.au are supported.
  • Your company: the numeric company ID (preferred), or the company short name you use to sign in. Use the same form every time: Oleria can’t tell that an ID and a short name are the same company.

​
Create an OAuth application in UKG Ready

1

Create the application

In UKG Ready, create a machine-to-machine OAuth application (client credentials) for Oleria. Save its Client ID and Client Secret. You’ll need both when connecting in Oleria.
2

Grant REST API access

In the security profile the application uses, allow REST API access to the following. The exact item names in UKG Ready can differ by release:Make sure the profile can see employee hire and termination dates and status. Oleria needs them to tell current employees from leavers, and it refuses to connect without them.
3

Keep the application for Oleria only

Don’t use this application for anything else. If you rotate its secret, update the connection in Oleria.

​
Connect UKG Ready to Oleria

1

Open the integration

Go to your Oleria workspace, select Integrations -> select UKG Ready.
2

Complete the connection form

Select Continue and provide the following:
3

Confirm the connection

Select Authenticate. Oleria gets a token for the application, lists employees, reads one employee record, and lists the cost centers of the tree you chose. Find the newly connected company on the Connected tab of your Oleria Integrations page.
You can connect each UKG Ready company to Oleria once, and you can’t move a connection to a different host or company. If you change the client ID when you edit the integration, enter its secret again. To keep the stored secret when you edit only other fields, leave the field empty.

​
Verify the integration

Confirm the UKG Ready company appears on the Connected tab of your Oleria Integrations page with a status of Healthy. To see more detail about its health, select View Details on the UKG Ready instance to open the side pane. After the first sync completes, go to Posture -> Access Inventory -> Employees to review the UKG Ready employees. Oleria shows HR employee records there when UKG Ready is your employee source of truth. To select it, go to Settings -> Employee Information.

​
Remediation actions

Oleria can take these actions in UKG Ready. Each needs the matching optional REST API access listed in Create an OAuth application.
  • Lock a login locks the employee’s UKG Ready account so they can’t sign in. In Oleria this action is labeled Disable account. The employee record, dates, and status don’t change. Reverting the action unlocks the login.
  • Unlock a login unlocks the account and keeps the employee’s password and authenticator. Reverting the action locks it again.
  • Hire an employee creates an employee with the username, first and last name, and email you give. Oleria checks first that no employee has that username. If UKG Ready requires more fields, the action fails and names them. This action can’t be reverted from Oleria, because Oleria never deletes an employee.
Oleria follows these rules:
  • Changes are confirmed. Oleria confirms a lock or unlock by reading the employee again.
  • Unchanged logins are left alone. If the login is already in the requested state, the action makes no change, and reverting it does nothing.
  • Its own login is protected. Oleria won’t lock the account its OAuth application acts as.
  • Unconfirmed changes are reported. If Oleria can’t confirm whether a change was applied, the action reports that it may have been applied and says what to check in UKG Ready. Check the employee before running it again.
  • There’s no termination action. Terminate employees in UKG Ready as part of your HR and payroll process.

​
Troubleshooting

If Authenticate fails, Oleria shows the reason:
  • Wrong credentials - check the client ID and secret, and that the OAuth application is active.
  • Missing access - add the REST API resource the message names to the application’s security profile.
  • Company not recognized - check the tenant host and the company ID or short name.
  • No hire dates - let the application’s security profile see employee hire and termination dates.
  • No cost centers in the chosen tree - check the Department Cost-Center Tree value. Tree 0 may be empty if your company doesn’t use cost centers; Oleria then shows no departments.
After you fix access in UKG Ready, the next sync picks up the missing data.

​
Known limitations

  • Groups, roles, and system accounts - Oleria doesn’t import UKG Ready security profiles, account groups, or system (non-employee) accounts. Administrators aren’t flagged.
  • Job title - job titles aren’t available through the API, so titles are empty.
  • Last login and MFA - UKG Ready doesn’t expose last login time or multi-factor authentication (MFA) settings through the API. Oleria can’t flag dormant logins from UKG Ready alone.
  • One cost-center tree - departments come from one cost-center tree. To use a different tree, edit the integration.
  • Activity - UKG Ready doesn’t provide an activity or audit log through this integration.

​
Contact us

For questions about this integration, contact us at support@oleria.com.