Joinly vs Microsoft's API-driven inbound provisioning

What Microsoft's route is

API-driven inbound provisioning is a provisioning app in the Entra gallery with an asynchronous /bulkUpload endpoint. A client sends SCIM 2.0 bulk requests with complete user records; the Entra provisioning service compares them with the directory, decides create, update, enable or disable, applies the attribute mappings you configured, and writes to Entra ID or — through the provisioning agent — to on-premise Active Directory. Provisioning logs report the outcome per record.

Microsoft is explicit about the division of labour: "the API developer/partner/system integrator builds an API client to send authoritative identity data to Microsoft Entra ID". The suggested tools are PowerShell and Azure Logic Apps. For Workday and SAP SuccessFactors, Microsoft ships that client itself as a native connector; for every other HR system, you do.

What it leaves to you

• The client: authenticate against the HR API, read joiners, movers and leavers, handle effective dates, concurrent employments and rehires, package records as SCIM, respect the endpoint's throttling, read the provisioning logs and resubmit failures.
• The rules: attribute mappings move fields. Which groups, licences and organisational unit a person in a given department and job should have is a separate design, typically in Lifecycle Workflows or dynamic groups.
• Everything beyond the directory: the mailbox, SharePoint, Teams, the service desk ticket, the SMS with first-day credentials.
• A brake. The service provisions what it receives; a broken HR export becomes a broken directory at the next upload.

What Joinly does instead — or on top

Joinly is the client Microsoft leaves to you, plus the rules layer, plus the steps beyond the directory. It reads the HR system through a ready-made connector for each of the 78 systems on this site, decides access from department, job and location, and writes either directly through Microsoft Graph — accounts, groups, licences, manager, Temporary Access Pass, sessions, soft delete — or as SCIM bulk requests to Microsoft's endpoint if you prefer the Entra provisioning service to remain the only writer. On-premise Active Directory is reached through the Joinly AD Agent, which polls outbound and needs no inbound firewall rule.

Before anything is written there is a dry run with an Excel export, thresholds per run, a read-only mode and a hard stop when an evaluation would revoke more than 20% of assignments at once. Afterwards there is an audit log per mutation with its source and the workflow that caused it.

Side by side

When to pick which

Pick Microsoft's route alone when you have the engineering to build and run the client, Entra ID is your only target and Lifecycle Workflows covers your joiner and leaver tasks. Pick Joinly when there is an on-premise directory next to Entra ID, when access has to follow rules you can show an auditor, when offboarding must reach the mailbox and the service desk, or when nobody wants to own a Logic App at three in the morning. Pick both when your security policy says the Entra provisioning service must be the only thing that writes users: Joinly reads and decides, Entra writes.