Connect SAP SuccessFactors to Microsoft Entra ID and Active Directory

What Joinly does with SAP SuccessFactors

Joinly reads each HR change through the Employee Central OData API and turns it into the actions your rules prescribe. The events it handles: joiner, mover, leaver (incl. rehire, worker conversion, concurrent employment). SAP SuccessFactors is a ready-made import plugin in Joinly: enable it, enter the endpoint of your SAP SuccessFactors environment, done.

The rules are the part no connector decides for you: which department, job or location maps to which groups, licences and organisational unit. That mapping lives in Joinly, is configurable per field with Liquid templates, and can be previewed on real employees before anything is applied.

Two directories, one source

To Microsoft Entra ID, Joinly talks through Microsoft Graph with its own app registration: it creates, updates, enables and disables accounts, assigns and revokes licences, sets group memberships and the manager, issues a Temporary Access Pass for the first day and, at the end, revokes sessions and soft-deletes the account.

To on-premise Active Directory, the Joinly AD Agent runs inside your network and polls Joinly for work over outbound HTTPS — no inbound firewall rule, no VPN. It creates the user in the right OU, builds the sAMAccountName and UPN from your rules, manages security groups and can create an Exchange remote mailbox in a hybrid setup. Hybrid organisations run both connections from the same SAP SuccessFactors source.

Beyond the directory

Most leavers are not finished when the account is disabled. Joinly's workflows also convert the mailbox to a shared mailbox, set an out-of-office, clear the calendar, remove SharePoint permissions and Teams memberships, raise an incident in TOPdesk or a request in Freshservice, and call any application that accepts a webhook. Each step waits for the previous one to succeed.

Safe to switch on

Every import can run as a dry run with an Excel export of what would happen. Thresholds cap how many creations, activations and deactivations one run may produce before it is blocked for approval, and an access evaluation that would revoke more than 20% of assignments in one go stops itself. Until you trust it, the connection can run in read-only mode: everything is calculated, nothing is written.