Connect CatalystOne to Microsoft Entra ID

How does Joinly sync CatalystOne to Microsoft Entra ID?

Joinly reads each HR change in CatalystOne through the REST API and its webhooks, then applies it to the matching Entra ID account automatically. HR Master Data holds the authoritative employment record, so it is the starting point for each identity action.

1. Joiner. HR completes the hire in CatalystOne. Joinly reads the new employee and organisation records and determines the role from attributes like organisational unit, department and job title. It then creates the account in Entra ID, assigns the right licences and maps the person into the correct groups — timed to the recorded start date.

2. Mover. When someone changes position, department or organisation in CatalystOne, Joinly updates their group membership, permissions and licences to match. Access that no longer fits the new position is revoked, so permissions stay aligned with the actual job.

3. Leaver. On the termination date recorded in CatalystOne, Joinly disables the Entra ID account automatically. There are no orphaned accounts left active after someone has left, and a soft-delete grace window keeps the account recoverable before it is retired for good.

Example: A Nordic energy company hires a grid engineer in CatalystOne with a start date next Monday, in its Norwegian organisation. Joinly reads the record, waits until the start date, creates the Entra ID account, assigns an Office E3 licence and adds the engineer to the NO-GridOps group. When that engineer later transfers to the Swedish organisation, Joinly rebuilds the UPN to the Swedish domain and swaps the groups the same day, without breaking sign-in.

What manual user management costs

Without automation, every account starts as a CatalystOne ticket or a line in a spreadsheet that IT works through by hand. A custom Entra API-driven connector wired to the CatalystOne REST API can move attributes across, but it maps organisations to groups through manual rules and has no built-in role logic — so the part that actually decides access still falls to people.

• Onboarding delays. New joiners wait for accounts, licences and group access while a ticket sits in a queue, losing productive days in their first week.

• Permissions that don’t keep up (privilege creep). When movers change position or organisation, old access often stays attached, so people accumulate rights they no longer need.

• Forgotten offboarding. Accounts that aren’t disabled on time are both a security and audit risk, and unused licences keep costing money.

Joinly vs. native Entra API-driven provisioning

CatalystOne isn’t a Microsoft-gallery app, so the native path is an Entra API-driven (SCIM) inbound connector built on the CatalystOne REST API. That’s a fine baseline, but it stops short of the part that actually decides access. Here’s how the two compare for a CatalystOne-driven setup.

Watch-outs when connecting CatalystOne to Microsoft Entra ID

A few CatalystOne-specific details decide whether this connection stays reliable at scale.

• Nordic multi-country localisation. A single CatalystOne tenant can hold Swedish, Danish and Norwegian employees with different national-ID (personnummer) formats and country-specific fields. A naive rule mixes them up. Joinly applies per-country transformation rules so each record drives the right domain, UPN and licence set.

• Mapping organisations to Entra groups. CatalystOne organisations and organisational units don’t translate one-to-one to Entra ID groups. Joinly builds explicit mapping rules from those structures to the correct groups and licences, so role drives access rather than manual assignment.

• Webhook events plus reconciliation. CatalystOne webhooks fire the moment something changes, which is fast — but a single missed event can leave an account stale. Joinly acts on the webhook and periodically reconciles against the REST API, so nothing is ever silently skipped.

• UPN format with duplicate names. When two employees share a name, a naive UPN rule produces collisions. Joinly applies custom transformation rules — a suffix, organisation code or controlled tiebreaker — so every UPN is unique and predictable from day one.

• API-key rotation and early-access endpoints. The CatalystOne developer platform is in early access and each integration uses its own API key. Joinly manages the key securely and adapts to endpoint changes centrally, so key rotation or an API update doesn’t break provisioning.

Joinly handles each of these by default with custom mapping and transformation.

Always audit-ready

Every account action Joinly performs is logged: who was affected, when it happened, which access changed and which CatalystOne change triggered it. For NIS2 that matters directly: access can be traced back to an authorised HR source rather than an ad-hoc request. Joinly is ISO 27001 certified, runs in an EU data centre in Amsterdam, applies least-privilege by default, and is built to meet NIS2 and ISO 27001.

Example case

Picture a Nordic energy and utilities group with around 4,500 employees split across Norwegian, Swedish and Danish organisations, running CatalystOne as its HR core while its identity provisioning never quite keeps up. A hand-built connector handles the simple cases, yet cross-country transfers, field technicians on seasonal contracts and country-specific national-ID formats keep breaking it — engineers who move between the Norwegian and Swedish organisations end up with the wrong domain on their UPN, and new hires are provisioned the moment HR saves the record rather than on their actual start date.

Connect CatalystOne to Microsoft Entra ID with Joinly and that work disappears. Joinly reads each HR change in CatalystOne at the source and acts on it automatically: new hires have their account, Office licence and group access ready on their start date, cross-country transfers rebuild the UPN and swap the right groups the same day, and leavers are disabled on their termination date with a 30-day soft-delete grace window.

“Cross-country transfers used to be the thing that broke every sync. Now an account is simply ready on the start date, a move to another country just rebuilds the UPN and groups, and we can show the auditor exactly which CatalystOne change created every bit of access.” — Head of IT, energy and utilities group

The outcome this setup is designed for: onboarding drops from days to zero touch, cross-country UPN errors stop entirely, and the team can walk into its next NIS2 assessment with a complete, source-backed audit trail.