How does Joinly sync ADP iHCM to Microsoft Entra ID?

Joinly reads each HR change in iHCM through the ADP Worker Management and Organization Management APIs and applies it to the matching Entra ID account automatically. iHCM holds the authoritative worker record, so it is the starting point for each identity action.

1. Joiner. HR completes the hire in iHCM. Joinly reads the new worker — the associateOID and the primary work assignment — and determines the role from attributes like department, cost center, job title and country. It then creates the account in Entra ID, assigns the right licences and maps the person into the correct groups — timed to the effective hire date.

2. Mover. When a worker changes work assignment, department or cost center in iHCM — including a move between country org charts — Joinly updates their group membership, permissions and licences to match. Access that no longer fits the new assignment is revoked, so permissions stay aligned with the actual job.

3. Leaver. On the termination date recorded in iHCM, Joinly disables the Entra ID account automatically. There are no orphaned accounts left active after someone has left, and where a worker holds more than one work assignment, access is only removed when the last active assignment ends.

Example: A European manufacturer runs iHCM 2 across its German, Italian and Dutch entities on one tenant. It hires a process engineer with a hire date next Monday in the German org chart. Joinly reads the worker record, waits until the hire date, creates the Entra ID account, assigns an Office E3 licence and adds the engineer to the DE-Engineering group with a de-suffixed UPN. When that engineer later takes on a second work assignment in the Italian plant, Joinly keeps the primary assignment as the driver of the UPN and adds the IT-Operations group without creating a duplicate account.

What manual user management costs

Without automation, every account starts as an ADP report or a line in a spreadsheet that IT works through by hand. The Entra gallery ‘ADP’ app only delivers single sign-on, not provisioning, so unless you buy a separate sync bridge there is no native path from iHCM to Entra ID — and even then role-to-group mapping, hire-date timing and multi-country, multi-assignment handling fall to people.

• Onboarding delays. New joiners wait for accounts, licences and group access while a ticket sits in a queue, losing productive days in their first week.

• Permissions that don’t keep up (privilege creep). When workers change assignment, department or country, old access often stays attached, so people accumulate rights they no longer need.

• Forgotten offboarding. Accounts that aren’t disabled on time are both a security and audit risk, and unused licences keep costing money — and with multiple work assignments it is easy to disable an account while another assignment is still active.

Joinly vs. the native ADP provisioning options

The Entra gallery ‘ADP’ app covers single sign-on only; for actual provisioning ADP points you at third-party Marketplace connectors and sync bridges. Here’s how that baseline compares to Joinly for an iHCM-driven setup.

Watch-outs when connecting ADP iHCM to Microsoft Entra ID

A few iHCM-specific details decide whether this connection stays reliable at scale.

• One European cloud, several country structures. iHCM 2 runs a single European cloud spanning countries such as Germany, Italy, the Netherlands and the UK, so one tenant can carry several org charts, department codes and naming conventions. Joinly applies country-aware rules — the UPN suffix, group prefix and licence bundle follow the worker’s country and org chart — so a Dutch and a German hire land in the right place from the same feed.

• Multiple work assignments. A worker can hold more than one active work assignment. A naive rule treats every assignment as a new person and provisions duplicate Entra ID accounts. Joinly keys on the associateOID and picks the primary work assignment as the driver of the UPN, while still reflecting the extra access.

• Mapping department and cost center to Entra groups. iHCM’s departments (each with its own itemID payroll code) and cost centers don’t translate one-to-one to Entra ID groups. Joinly builds explicit mapping rules from those structures to the correct groups and licences, so role drives access rather than manual assignment.

• Certificate-based API onboarding. The link to ADP runs over mutual TLS with an X.509 certificate issued from the ADP partner self-service portal, and that certificate expires. Joinly manages the mTLS connection and flags certificate rotation in advance, so the feed from iHCM never silently goes dark.

• SSO is not provisioning. The Entra gallery ‘ADP’ app only handles sign-on; it never creates, updates or disables an account. Joinly is the provisioning layer that the gallery app deliberately leaves out, reading worker changes and acting on them in Entra ID.

Joinly handles each of these by default with custom mapping and transformation.

Always audit-ready

Every account action Joinly performs is logged: who was affected, when it happened, which access changed and which iHCM change triggered it. For NIS2 that matters directly: access can be traced back to an authorised HR source rather than an ad-hoc request. Joinly is ISO 27001 certified, runs in an EU data centre in Amsterdam, applies least-privilege by default, and is built to meet NIS2 and ISO 27001.

Example case

Picture a European manufacturer with around 5,500 employees, running iHCM 2 on a single tenant that spans its German, Italian and Dutch plants while its identity provisioning never quite keeps up. The Entra gallery ‘ADP’ app gives people single sign-on but provisions nothing, so a spreadsheet exported per country still drives every account by hand — Dutch and German hires get inconsistent usernames, workers who pick up a second work assignment at another plant end up with a duplicate Entra ID account, and future hires are provisioned the moment HR saves the record rather than on their actual start date.

Connect ADP iHCM to Microsoft Entra ID with Joinly and that work disappears. Joinly reads each HR change in iHCM at the source and acts on it automatically: new hires have their account, Office licence and country-correct group access ready on their effective hire date, moves between plants and country org charts swap the right groups the same day, a second work assignment just adds access on a single stable UPN, and leavers are disabled on their termination date with a 30-day soft-delete grace window.

“One iHCM tenant, three countries, and provisioning used to mean three different spreadsheets and the odd duplicate account. Now an account is simply ready on the hire date with the right country naming, a second assignment just adds access, and we can show the auditor exactly which iHCM change created every bit of access.” — Head of IT, European manufacturer

The outcome this setup is designed for: onboarding drops from days to zero touch, cross-country naming and duplicate-account errors stop entirely, and the team can walk into its next NIS2 assessment with a complete, source-backed audit trail.