Connect AFAS to Microsoft Entra ID

How does Joinly sync AFAS to Microsoft Entra ID?

Joinly reads each HR change in AFAS Profit through the REST API and applies it to the matching Entra ID account automatically. The medewerker record in AFAS holds the authoritative employment data, so it is the starting point for each identity action.

1. Joiner. HR completes the hire in AFAS Profit HRM. Joinly reads the new medewerker, dienstverband and aanstelling records through a GetConnector and determines the role from attributes like organisatorische eenheid, functie and kostenplaats. It then creates the account in Entra ID, assigns the right licences and maps the person into the correct groups — timed to the in-diensttreding date.

2. Mover. When someone changes functie, moves to another organisatorische eenheid or picks up a new aanstelling in AFAS, Joinly updates their group membership, permissions and licences to match. Access that no longer fits the new position is revoked, so permissions stay aligned with the actual job.

3. Leaver. On the uitdiensttreding date recorded in AFAS, Joinly disables the Entra ID account automatically. There are no orphaned accounts left active after someone has left, and a medewerker with a second, still-active dienstverband keeps access until the last one ends.

Example: A municipality hires a policy officer in AFAS with a start date next Monday, in the Ruimtelijke Ordening organisatorische eenheid. Joinly reads the future-dated dienstverband, waits until the start date, creates the Entra ID account, assigns an Office E3 licence and adds the officer to the RO-Beleid group. When that officer later moves to the Vergunningen OE, Joinly swaps the groups the same day without anyone opening a ticket.

What manual user management costs

Without automation, every account starts as an AFAS ticket or a line in a spreadsheet that IT works through by hand. AFAS’s own native Entra ID integration in Profit 8 can push AFAS user groups to Entra and generate a UPN, but it links people by matching the UPN and stays tied to AFAS’s authorization-tool groups — so the part that actually decides access still falls to people.

• Onboarding delays. New joiners wait for accounts, licences and group access while a ticket sits in a queue, losing productive days in their first week.

• Permissions that don’t keep up (privilege creep). When movers change functie or transfer to another OE, old access often stays attached, so people accumulate rights they no longer need.

• Forgotten offboarding. Accounts that aren’t disabled on time are both a security and audit risk, and unused licences keep costing money — and a medewerker with a second active dienstverband makes it easy to disable an account too early or too late.

Joinly vs. the native AFAS Entra ID integration

The AFAS Entra ID integration in Profit 8 is a fine baseline, but it stops short of the part that actually decides access. Here’s how the two compare for an AFAS-driven setup.

Watch-outs when connecting AFAS to Microsoft Entra ID

A few AFAS-specific details decide whether this connection stays reliable at scale.

• App connector token scope. The AFAS REST API only exposes the GetConnectors and UpdateConnectors linked to your App connector, authenticated with a Base64 AfasToken. Joinly works with a GetConnector scoped to exactly the medewerker, dienstverband, aanstelling and OE fields it needs — nothing more — so the integration stays least-privilege and auditable.

• Future-dated dienstverbanden. AFAS stores a hire as a dienstverband with an in-diensttreding date that can be well in the future, and provisioning too early or too late both cause problems. Joinly reads that date and times account creation to it, so access is ready on the right day and not before.

• Multiple aanstellingen and OE transfers. A medewerker can hold more than one aanstelling and move between organisatorische eenheden. A naive rule can pick the wrong one or leave stale access behind. Joinly applies explicit rules to choose the leading aanstelling for the UPN and swap groups on an OE transfer.

• Mapping OE and functie to Entra groups. Organisatorische eenheid, functie, aanstelling and kostenplaats don’t translate one-to-one to Entra ID groups. Joinly builds explicit mapping rules from those structures to the correct groups and licences, so role drives access rather than manual assignment.

• UPN format with duplicate names. When two medewerkers share a name, a naive UPN rule produces collisions — and the native AFAS integration needs the UPN to match exactly. Joinly applies custom transformation rules — a suffix, OE code or controlled tiebreaker — so every UPN is unique and predictable from day one.

Joinly handles each of these by default with custom mapping and transformation.

Always audit-ready

Every account action Joinly performs is logged: who was affected, when it happened, which access changed and which AFAS change triggered it. For NIS2 that matters directly: access can be traced back to an authorised HR source rather than an ad-hoc request. Joinly is ISO 27001 certified, runs in an EU data centre in Amsterdam, applies least-privilege by default, and is built to meet NIS2 and ISO 27001.

Example case

Picture a Dutch municipality with around 1,800 employees across a dozen departments, running AFAS Profit as its HR core while its identity provisioning never quite keeps up. The native AFAS-to-Entra integration handles the simple cases, yet seasonal contracts, internal transfers between organisatorische eenheden and medewerkers with a second aanstelling keep breaking it — a UPN that no longer matches drops the link, and future-dated dienstverbanden are provisioned the moment HR saves the record rather than on the actual start date.

Connect AFAS to Microsoft Entra ID with Joinly and that work disappears. Joinly reads each HR change in AFAS at the source and acts on it automatically: new hires have their account, Office licence and group access ready on their in-diensttreding date, transfers between OEs swap the right groups the same day, a second aanstelling just adds access on one stable UPN, and leavers are disabled on their uitdiensttreding date with a 30-day soft-delete grace window.

“The UPN match used to be the thing that broke every sync. Now an account is simply ready on the start date, a transfer to another organisatorische eenheid just swaps the groups, and we can show the auditor exactly which AFAS change created every bit of access.” — Head of IT, municipality

The outcome this setup is designed for: onboarding drops from days to zero touch, broken UPN links stop entirely, and the team can walk into its next NIS2 assessment with a complete, source-backed audit trail.