How does Joinly sync BambooHR to Microsoft Entra ID?

Joinly reads each HR change in BambooHR through the REST API and applies it to the matching Entra ID account automatically. BambooHR holds the authoritative employee record, so it is the starting point for each identity action — no spreadsheet or PowerShell script in between.

1. Joiner. HR adds the new hire in BambooHR. Joinly reads the employee record — work email, department, division, location, job title and supervisor — and determines the role from those fields. It then creates the account in Entra ID, assigns the right licences and maps the person into the correct groups — timed to the hireDate.

2. Mover. When someone changes department, location or job title in BambooHR, Joinly updates their group membership, permissions and licences to match. Access that no longer fits the new position is revoked, so permissions stay aligned with the actual job — even though BambooHR itself has no group concept to drive that.

3. Leaver. On the terminationDate recorded in BambooHR, Joinly disables the Entra ID account automatically. There are no orphaned accounts left active after someone has left, and an employment-status change to a non-active status is treated as a leaver event so access is removed at the right moment.

Example: A SaaS startup hires a customer-success rep in BambooHR with a hire date next Monday, in its Amsterdam location, Customer department. Joinly reads the record, waits until the hire date, creates the Entra ID account, assigns a Microsoft 365 Business Premium licence and adds the rep to the CS-Team and Amsterdam-Office groups. When that rep later moves to the Sales department, Joinly swaps the group the same day and updates the job title, without anyone opening a ticket.

What manual user management costs

Without automation, every account starts as a BambooHR notification or a line in a spreadsheet that IT works through by hand. BambooHR's Entra gallery app only does SSO — it can't provision — and the native API-driven alternative means writing and maintaining PowerShell that calls the BambooHR API and builds SCIM payloads yourself, so the part that actually decides access still falls to people.

• Onboarding delays. New joiners wait for accounts, licences and group access while a request sits in someone's inbox, losing productive days in their first week.

• Permissions that don't keep up (privilege creep). When movers change department or location, old access often stays attached, so people accumulate rights they no longer need.

• Forgotten offboarding. Accounts that aren't disabled on time are both a security and audit risk, and unused licences keep costing money — easy to miss when there's no automated trigger from BambooHR.

Joinly vs. the native BambooHR provisioning options

The BambooHR gallery app in Entra is SSO only, and the native API-driven inbound provisioning is a build-it-yourself path. Here's how Joinly compares for a BambooHR-driven setup.

Watch-outs when connecting BambooHR to Microsoft Entra ID

A few BambooHR-specific details decide whether this connection stays reliable as you grow.

• No group concept in BambooHR. BambooHR's org model is flat — department, division and location — with nothing that maps to an Entra group. Joinly builds explicit rules from those fields to the correct groups and licences, so role drives access rather than manual assignment.

• Reliance on custom fields. Much of the data that decides access often lives in custom fields, which BambooHR exposes only by numeric field ID and not by default. Joinly discovers them via /meta/fields and maps the ones you need with Liquid templates, so a local cost centre or contract type lands in the right place.

• Employment-status changes. A move from active to on-leave, or contractor to full-time, is a status change rather than a hire or termination. Joinly reads employmentHistoryStatus and applies your rules, so access reflects the real status instead of only reacting to a hire or leave date.

• Directory vs. full record. The directory endpoint returns a limited field set, and the API key only sees fields its user can see. Joinly fetches the full per-employee record with the right field aliases, so no attribute is silently missing because of a permissions gap.

• Hire date that isn't today. BambooHR stores the hireDate well before the first working day. Joinly times account creation to that date, so access is ready on the right day and not the moment HR saved the record.

Joinly handles each of these by default with custom mapping and transformation.

Always audit-ready

Every account action Joinly performs is logged: who was affected, when it happened, which access changed and which BambooHR change triggered it. For NIS2 that matters directly: access can be traced back to an authorised HR source rather than an ad-hoc message in a chat. Joinly is ISO 27001 certified, runs in an EU data centre in Amsterdam, applies least-privilege by default, and is built to meet NIS2 and ISO 27001.

Example case

Picture a fast-growing SaaS startup with around 220 employees across two offices, running BambooHR as its HR core but provisioning Entra ID accounts by hand. There's no middleware and no IAM team. When someone is hired, an ops person reads the BambooHR profile and clicks the account together in Entra, picks licences from memory and adds groups by guesswork. The BambooHR gallery app gives them SSO but nothing more, and as headcount climbs the manual work and the mistakes climb with it.

Connect BambooHR to Microsoft Entra ID with Joinly and that work disappears. Joinly reads each HR change in BambooHR at the source and acts on it automatically: new hires have their account, Microsoft 365 licence and group access ready on their hire date, a move from Support to Sales swaps the right groups the same day, a switch from contractor to full-time updates access through the employment-status field, and leavers are disabled on their termination date with a 30-day soft-delete grace window.

"We went from clicking every account together out of a BambooHR profile to nothing — an account is simply ready on the start date, and we can show exactly which BambooHR change created every bit of access."

The outcome this setup is designed for: onboarding drops from days to zero touch, the guesswork in licences and groups disappears, and a small ops team can walk into a NIS2 assessment with a complete, source-backed audit trail.