> ## Documentation Index
> Fetch the complete documentation index at: https://docs.oleria.com/llms.txt
> Use this file to discover all available pages before exploring further.

# UKG Ready

> Connect UKG Ready to Oleria to bring employees, people, departments, manager relationships, and UKG Ready logins into your identity and access graph as the authoritative worker record.

Connect UKG Ready to Oleria to use your HR system as the source of truth for who works for you. Oleria reads employees, people, departments (cost centers), manager relationships, and each employee's UKG Ready login. It then compares identity provider (IdP) and SaaS access against that worker record, so a leaver who still holds access somewhere else becomes visible.

To set it up, you create an OAuth application in UKG Ready and give its security profile access to the REST API. You then enter your tenant host, company, and the application's client ID and secret in Oleria.

One Oleria connection maps one UKG Ready company.

<Note>
  This integration is for **UKG Ready** (formerly Kronos Workforce Ready). For UKG Pro, see [UKG Pro](/integrations/ukg-pro).
</Note>

## What Oleria discovers

Once connected, Oleria continuously discovers and maps the following from UKG Ready:

* **Employees** - every employee in the company, including employee number, name, work email, company name, default cost center, hire date, and termination date. If an employee was rehired after a termination, Oleria treats them as current.
* **People** - the person record for each employee.
* **Accounts** - each employee's own UKG Ready login, with username and status. A login is shown as disabled when it's locked, or when the employee is terminated or inactive.
* **Departments** - the cost centers of one cost-center tree, and how they nest.
* **Manager relationships** - each employee's primary manager, used to build your reporting hierarchy.
* **Department assignments** - each employee's default cost center in that tree.

Oleria refreshes this data on its [regular sync schedule](/integrations/overview#sync-model). Oleria reads each employee's record on every sync, so syncs of a large company take a while. For example, a company with 5,000 employees takes about 20 minutes.

<Note>
  Oleria never requests or stores sensitive personal data from the employee record. That includes Social Security and other national ID numbers, birth date, home address, and personal phone numbers.
</Note>

## Prerequisites

* Administrator permission on the Oleria workspace.
* A UKG Ready administrator who can create OAuth applications and edit security profiles.
* Your **tenant host**: the host in the address you sign in on, for example `secure3.saashr.com`. Hosts under `.saashr.com` and `.workforceready.com.au` are supported.
* Your **company**: the numeric company ID (preferred), or the company short name you use to sign in. Use the same form every time: Oleria can't tell that an ID and a short name are the same company.

## Create an OAuth application in UKG Ready

<Steps>
  <Step title="Create the application">
    In UKG Ready, create a machine-to-machine OAuth application (client credentials) for Oleria. Save its **Client ID** and **Client Secret**. You'll need both when connecting in Oleria.
  </Step>

  <Step title="Grant REST API access">
    In the security profile the application uses, allow REST API access to the following. The exact item names in UKG Ready can differ by release:

    | Access | Used for |
    | :- | :- |
    | Employee profiles (view) | Employees, people, accounts, managers, and department assignments |
    | Cost centers (view) | Departments |
    | Account lock (edit) | Optional. Only needed to lock and unlock logins from Oleria. |
    | Employee create (add) | Optional. Only needed to hire employees from Oleria. |

    Make sure the profile can see employee hire and termination dates and status. Oleria needs them to tell current employees from leavers, and it refuses to connect without them.
  </Step>

  <Step title="Keep the application for Oleria only">
    Don't use this application for anything else. If you rotate its secret, update the connection in Oleria.
  </Step>
</Steps>

## Connect UKG Ready to Oleria

<Steps>
  <Step title="Open the integration">
    Go to your Oleria workspace, select **Integrations** -> select **UKG Ready**.
  </Step>

  <Step title="Complete the connection form">
    Select **Continue** and provide the following:

    | Field | Notes |
    | :- | :- |
    | Tenant Host | Required. The host you sign in on, for example `secure3.saashr.com`. You can paste the address from your browser; Oleria keeps only the host. |
    | Company | Required. The numeric company ID, or the company short name. |
    | OAuth Client ID | Required. The client ID of the OAuth application you created. |
    | OAuth Client Secret | Required. That application's client secret. |
    | Department Cost-Center Tree | Optional. Which cost-center tree Oleria shows as departments, from `0` to `99`. The default is `0`, the first tree. |
  </Step>

  <Step title="Confirm the connection">
    Select **Authenticate**. Oleria gets a token for the application, lists employees, reads one employee record, and lists the cost centers of the tree you chose. Find the newly connected company on the **Connected** tab of your Oleria **Integrations** page.
  </Step>
</Steps>

<Note>
  You can connect each UKG Ready company to Oleria once, and you can't move a connection to a different host or company. If you change the client ID when you edit the integration, enter its secret again. To keep the stored secret when you edit only other fields, leave the field empty.
</Note>

## Verify the integration

Confirm the UKG Ready company appears on the **Connected** tab of your Oleria **Integrations** page with a status of **Healthy**. To see more detail about its health, select **View Details** on the UKG Ready instance to open the side pane.

After the first sync completes, go to **Posture** -> **Access Inventory** -> **Employees** to review the UKG Ready employees. Oleria shows HR employee records there when UKG Ready is your employee source of truth. To select it, go to **Settings** -> **Employee Information**.

## Remediation actions

Oleria can take these actions in UKG Ready. Each needs the matching optional REST API access listed in [Create an OAuth application](#create-an-oauth-application-in-ukg-ready).

* **Lock a login** locks the employee's UKG Ready account so they can't sign in. In Oleria this action is labeled **Disable account**. The employee record, dates, and status don't change. Reverting the action unlocks the login.
* **Unlock a login** unlocks the account and keeps the employee's password and authenticator. Reverting the action locks it again.
* **Hire an employee** creates an employee with the username, first and last name, and email you give. Oleria checks first that no employee has that username. If UKG Ready requires more fields, the action fails and names them. This action can't be reverted from Oleria, because Oleria never deletes an employee.

Oleria follows these rules:

* **Changes are confirmed.** Oleria confirms a lock or unlock by reading the employee again.
* **Unchanged logins are left alone.** If the login is already in the requested state, the action makes no change, and reverting it does nothing.
* **Its own login is protected.** Oleria won't lock the account its OAuth application acts as.
* **Unconfirmed changes are reported.** If Oleria can't confirm whether a change was applied, the action reports that it may have been applied and says what to check in UKG Ready. Check the employee before running it again.
* **There's no termination action.** Terminate employees in UKG Ready as part of your HR and payroll process.

## Troubleshooting

If **Authenticate** fails, Oleria shows the reason:

* **Wrong credentials** - check the client ID and secret, and that the OAuth application is active.
* **Missing access** - add the REST API resource the message names to the application's security profile.
* **Company not recognized** - check the tenant host and the company ID or short name.
* **No hire dates** - let the application's security profile see employee hire and termination dates.
* **No cost centers in the chosen tree** - check the **Department Cost-Center Tree** value. Tree `0` may be empty if your company doesn't use cost centers; Oleria then shows no departments.

After you fix access in UKG Ready, the next sync picks up the missing data.

## Known limitations

* **Groups, roles, and system accounts** - Oleria doesn't import UKG Ready security profiles, account groups, or system (non-employee) accounts. Administrators aren't flagged.
* **Job title** - job titles aren't available through the API, so titles are empty.
* **Last login and MFA** - UKG Ready doesn't expose last login time or multi-factor authentication (MFA) settings through the API. Oleria can't flag dormant logins from UKG Ready alone.
* **One cost-center tree** - departments come from one cost-center tree. To use a different tree, edit the integration.
* **Activity** - UKG Ready doesn't provide an activity or audit log through this integration.

## Contact us

For questions about this integration, contact us at [support@oleria.com](mailto:support@oleria.com).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.