How does Joinly sync Acerta to Microsoft Entra ID?

Joinly reads each HR change from Acerta Connect and applies it to the matching Entra ID account automatically. Acerta holds the authoritative employment and payroll record, so it is the starting point for each identity action.

1. Joiner. HR completes the hire in Acerta Connect. Joinly reads the new werknemer and dienstverband data and determines the role from attributes like department, kostenplaats and paritair comité. It then creates the account in Entra ID, assigns the right licences and maps the person into the correct groups — timed to the recorded start date.

2. Mover. When someone changes department, kostenplaats or status in Acerta, Joinly updates their group membership, permissions and licences to match. Access that no longer fits the new position is revoked, so permissions stay aligned with the actual job.

3. Leaver. On the uitdiensttreding date recorded in Acerta, Joinly disables the Entra ID account automatically. No orphaned accounts are left active after someone has left, and offboarding runs on the HR date rather than a manual reminder.

Example: A professional-services firm runs Acerta Connect for its Belgian payroll. It hires a consultant with a start date next Monday, in cost centre 4200. Joinly reads the record, waits until the start date, creates the Entra ID account, assigns a Microsoft 365 E3 licence and adds the consultant to the Consulting-BE group. When that consultant later moves from arbeider to bediende status and changes cost centre, Joinly swaps the groups the same day without anyone opening a ticket.

What manual user management costs

Without automation, every account starts as an Acerta note or a line in a spreadsheet that IT works through by hand. Because there is no native Microsoft provisioning app for Acerta, teams usually fall back on a custom export or a generic HRIS connector — which can move some employee attributes across but leaves the part that actually decides access, from role-to-group mapping to timing, to people.

• Onboarding delays. New joiners wait for accounts, licences and group access while a ticket sits in a queue, losing productive days in their first week.

• Permissions that don’t keep up (privilege creep). When movers change department, cost centre or status, old access often stays attached, so people accumulate rights they no longer need.

• Forgotten offboarding. Accounts that aren’t disabled on time are both a security and audit risk, and unused licences keep costing money — easy to miss when offboarding depends on someone remembering.

Joinly vs. a custom Acerta export / iPaaS connector

There is no native Microsoft Entra provisioning app for Acerta, so the honest comparison is against what teams build themselves: a custom integration on Acerta’s REST API or file export, or a generic HRIS aggregator connector. Both can surface employee data; neither runs identity lifecycle. Here’s how they compare.

Watch-outs when connecting Acerta to Microsoft Entra ID

A few Acerta-specific details decide whether this connection stays reliable at scale.

• Payroll-first, not a directory. Acerta is a sociaal secretariaat: its data is authoritative for payroll and personnel, and the exchange channel can be file- or batch-flavoured rather than a rich real-time directory API. Joinly is built to run off periodic imports and still keep Entra ID accurate, so a batch cadence doesn’t leave gaps.

• Mapping the Belgian org model to Entra groups. Kostenplaats, paritair comité, statuut (arbeider vs bediende) and department don’t translate one-to-one to Entra ID groups, and Acerta’s underlying objects aren’t publicly documented. Joinly builds explicit, reviewed mapping rules from those structures to the correct groups and licences, so role drives access rather than manual assignment.

• Multi-language NL/FR data. In a Belgian organisation names, job titles and department labels arrive in Dutch or French, with diacritics. Joinly applies transformation rules that produce a clean, consistent display name and UPN whichever language a record is in.

• UPN format with duplicate names. When two werknemers share a name, a naive UPN rule produces collisions. Joinly applies custom transformation rules — a suffix, cost-centre code or controlled tiebreaker — so every UPN is unique and predictable from day one.

Joinly handles each of these by default with custom mapping and transformation.

Always audit-ready

Every account action Joinly performs is logged: who was affected, when it happened, which access changed and which Acerta change triggered it. For NIS2 that matters directly: access can be traced back to an authorised HR source rather than an ad-hoc request. Joinly is ISO 27001 certified, runs in an EU data centre in Amsterdam, applies least-privilege by default, and is built to meet NIS2 and ISO 27001.

Example case

Picture a professional-services SME with around 300 employees across two Belgian offices, running Acerta Connect for payroll while its identity provisioning never quite keeps up. Because there’s no native Acerta-to-Entra app, IT half-built a spreadsheet export years ago — it dumps a list of werknemers but decides nothing, so every new consultant, transfer between cost centres and status change from arbeider to bediende still lands as a manual ticket. New joiners wait until day two for their Microsoft 365 account, and leavers linger because offboarding depends on someone remembering.

Connect Acerta to Microsoft Entra ID with Joinly and that work disappears. Joinly reads each HR change in Acerta Connect at the source and acts on it automatically: new hires have their account, Office licence and group access ready on their start date, moves between cost centres swap the right groups the same day, NL and FR names produce a clean UPN either way, and leavers are disabled on their uitdiensttreding date with a soft-delete grace window.

“We used to treat the Acerta export as a to-do list. Now an account is simply ready on the start date, a move just swaps the groups, and we can show exactly which Acerta change created every bit of access.” — Head of IT, professional-services firm

The outcome this setup is designed for: onboarding drops from days to zero touch, privilege creep from old roles is eliminated, and the team can walk into its next NIS2 assessment with a complete, source-backed audit trail.