How does Joinly sync ADP Workforce Now to Microsoft Entra ID?

Joinly reads each HR change in Workforce Now through the ADP Worker Management API and applies it to the matching Entra ID account automatically. Workforce Now holds the authoritative worker record, so it is the starting point for each identity action.

1. Joiner. HR completes the new hire in Workforce Now. Joinly reads the new worker — the associateOID, workerID and the primary Position ID — and determines the role from attributes like home department, business unit and job title. It then creates the account in Entra ID, assigns the right licences and maps the person into the correct groups — timed to the effective hire date.

2. Mover. When an associate changes position, home department or business unit in Workforce Now (an ADP job change), Joinly updates their group membership, permissions and licences to match. Access that no longer fits the new position is revoked, so permissions stay aligned with the actual job.

3. Leaver. On the termination date recorded in Workforce Now, Joinly disables the Entra ID account automatically. There are no orphaned accounts left active after someone has left, and where an associate holds more than one position, access is only removed when the last active position ends.

Example: A professional services firm hires a consultant in Workforce Now with a hire date next Monday in its Advisory business unit. Joinly reads the worker record, waits until the hire date, creates the Entra ID account, assigns an Office E3 licence and adds the consultant to the Advisory-Consultants group. When that consultant later picks up a second, part-time Position ID in the Training department, Joinly keeps the home position as the driver of the UPN and adds the extra group without creating a duplicate account.

What manual user management costs

Without automation, every account starts as an ADP report or a line in a spreadsheet that IT works through by hand. The Entra gallery 'ADP' app only delivers single sign-on, not provisioning, so unless you buy a separate sync bridge there is no native path from Workforce Now to Entra ID — and even then role-to-group mapping, hire-date timing and multi-position handling fall to people.

• Onboarding delays. New joiners wait for accounts, licences and group access while a ticket sits in a queue, losing productive days in their first week.

• Permissions that don't keep up (privilege creep). When associates change position or business unit, old access often stays attached, so people accumulate rights they no longer need.

• Forgotten offboarding. Accounts that aren't disabled on time are both a security and audit risk, and unused licences keep costing money — and with multiple positions it is easy to disable an account while another position is still active.

Joinly vs. the native ADP provisioning options

The Entra gallery 'ADP' app covers single sign-on only; for actual provisioning ADP points you at limited connectors or a third-party sync bridge. Here's how that baseline compares to Joinly for a Workforce Now-driven setup.

Watch-outs when connecting ADP Workforce Now to Microsoft Entra ID

A few ADP-specific details decide whether this connection stays reliable at scale.

• Certificate-based API onboarding. API Central access depends on an OAuth client paired with an X.509 certificate and connector approval, and that certificate expires. Joinly manages the mutual-TLS connection and flags certificate rotation in advance, so the link to Workforce Now never silently goes dark.

• Associate ID versus Position ID. An associate holds one identity but a separate Position ID for each job. A naive rule treats every position as a new person and provisions duplicate Entra ID accounts. Joinly keys on the associateOID and picks the home position as the driver of the UPN, while still reflecting the extra access.

• Mapping home department and business unit to Entra groups. ADP's home department and business unit don't translate one-to-one to Entra ID groups. Joinly builds explicit mapping rules from those structures to the correct groups and licences, so role drives access rather than manual assignment.

• UPN format with duplicate names. When two associates share a name, a naive UPN rule produces collisions. Joinly applies custom transformation rules — a suffix, a department code or the associate ID as a controlled tiebreaker — so every UPN is unique and predictable from day one.

• SSO is not provisioning. The Entra gallery 'ADP' app only handles sign-on; it never creates, updates or disables an account. Joinly is the provisioning layer that the gallery app deliberately leaves out, reading worker changes and acting on them in Entra ID.

Joinly handles each of these by default with custom mapping and transformation.

Always audit-ready

Every account action Joinly performs is logged: who was affected, when it happened, which access changed and which Workforce Now change triggered it. For NIS2 that matters directly: access can be traced back to an authorised HR source rather than an ad-hoc request. Joinly is ISO 27001 certified, runs in an EU data centre in Amsterdam, applies least-privilege by default, and is built to meet NIS2 and ISO 27001.

Example case

Picture a professional services firm with around 3,200 employees across several business units, running ADP Workforce Now as its HR core while its identity provisioning never quite keeps up. The Entra gallery 'ADP' app gives people single sign-on but provisions nothing, so a spreadsheet exported from Workforce Now still drives every account by hand — and consultants who pick up a second Position ID for a training role end up with a duplicate Entra ID account, while future hires are provisioned the moment HR saves the record rather than on their actual start date.

Connect ADP Workforce Now to Microsoft Entra ID with Joinly and that work disappears. Joinly reads each HR change in Workforce Now at the source and acts on it automatically: new hires have their account, Office licence and group access ready on their effective hire date, job changes between business units swap the right groups the same day, a second Position ID just adds access on a single stable UPN, and leavers are disabled on their termination date with a 30-day soft-delete grace window.

"Multiple positions used to be the thing that broke every sync — we'd get two accounts for one consultant. Now an account is simply ready on the hire date, a second position just adds access, and we can show the auditor exactly which Workforce Now change created every bit of access." (illustrative — Head of IT, professional services firm)

The outcome this setup is designed for: onboarding drops from days to zero touch, duplicate-account errors from multiple positions stop entirely, and the team can walk into its next NIS2 assessment with a complete, source-backed audit trail.