How does Joinly sync Cegid HR (Meta4) to Microsoft Entra ID?

Joinly reads each HR change in Cegid PeopleNet — through Cegid’s REST web service or a scheduled extract — and applies it to the matching Entra ID account automatically. PeopleNet holds the authoritative person and contract record, so it is the starting point for each identity action.

1. Joiner. HR completes the hire in Cegid PeopleNet. Joinly reads the new person record and its contract, job and assignment, and determines the role from attributes like work unit, position and country. It then creates the account in Entra ID, assigns the right licences and maps the person into the correct groups — timed to the effective start date on the contract.

2. Mover. When someone changes position, work unit or country in PeopleNet, Joinly updates their group membership, permissions and licences to match. Access that no longer fits the new assignment is revoked, so permissions stay aligned with the actual job — even when the move crosses a legal entity or payroll country.

3. Leaver. On the end date recorded on the PeopleNet contract, Joinly disables the Entra ID account automatically. There are no orphaned accounts left active after someone has left, and because matching is keyed on the person’s unique identifier, a later rehire reuses the same account rather than starting over.

Example: An international bank runs Cegid PeopleNet for its Spanish and French entities. It hires a risk analyst in the French entity with a start date next Monday. Joinly reads the dated contract, waits until the start date, creates the Entra ID account, assigns an Office E3 licence and adds the analyst to the FR-Risk group. When that analyst later transfers to the Spanish entity, Joinly swaps the country-specific groups the same day while keeping the single account tied to the person’s unique identifier.

What manual user management costs

Without automation, every account starts as a Cegid ticket or a line in a spreadsheet that IT works through by hand. Because Cegid Meta4 has no first-party Entra provisioning app, the usual baseline is a scheduled CSV or SFTP extract loaded into Entra — that moves attributes across but has no role-to-group logic and no real handling of dated records or multi-country context, so the part that actually decides access still falls to people.

• Onboarding delays. New joiners wait for accounts, licences and group access while a ticket sits in a queue, losing productive days in their first week.

• Permissions that don’t keep up (privilege creep). When movers change position or transfer to another country, old access often stays attached, so people accumulate rights they no longer need.

• Forgotten offboarding. Accounts that aren’t disabled on time are both a security and audit risk, and unused licences keep costing money — and with successive contracts under one person id it is easy to disable an account while a newer contract is still active.

Joinly vs. a native extract into Entra ID

Cegid Meta4 has no first-party Entra inbound-provisioning app, so the native baseline is a scheduled extract (CSV / SFTP) fed into Entra ID’s API-driven inbound provisioning, or a custom script. That’s a fine transport layer, but it stops short of the part that actually decides access. Here’s how the two compare for a PeopleNet-driven setup.

Watch-outs when connecting Cegid HR (Meta4) to Microsoft Entra ID

A few Cegid Meta4-specific details decide whether this connection stays reliable at scale.

• Multi-country payroll and legal context. One PeopleNet tenant runs several country payrolls under different local legislations. Department alone doesn’t decide access — the country / legal entity does. Joinly builds explicit rules that combine country with work unit and position, so a Spanish and a French employee in the same job land in the right country-specific groups and licences.

• Dated and historical records. PeopleNet stores contracts and assignments with effective dates, so a transfer, promotion or future-dated hire exists in the record before it takes effect. Joinly reads the effective date and applies the change on the right day — not the moment HR saved it.

• One person, successive contracts and rehires. Each individual has a single unique identifier that carries several contracts over time. A naive feed can create a fresh account for every new contract. Joinly keys matching on the person id, so a rehire or renewed contract reuses the existing account instead of producing a duplicate.

• Mapping the PeopleNet org model to Entra groups. Work units, work places, jobs and positions don’t translate one-to-one to Entra ID groups. Joinly builds explicit mapping rules from those structures — plus country — to the correct groups and licences, so role drives access rather than manual assignment.

• UPN format with duplicate names. Across countries, two employees can share a name. A naive UPN rule produces collisions. Joinly applies custom transformation rules — a suffix, country code or controlled tiebreaker — so every UPN is unique and predictable from day one.

Joinly handles each of these by default with custom mapping and transformation.

Always audit-ready

Every account action Joinly performs is logged: who was affected, when it happened, which access changed and which Cegid HR (Meta4) change triggered it. For NIS2 that matters directly: access can be traced back to an authorised HR source rather than an ad-hoc request. Joinly is ISO 27001 certified, runs in an EU data centre in Amsterdam, applies least-privilege by default, and is built to meet NIS2 and ISO 27001.

Example case

Picture an international bank with around 5,000 employees across its Spanish and French entities, running Cegid PeopleNet as its HR and payroll core while its identity provisioning never quite keeps up. There is no first-party Entra connector for Cegid Meta4, so IT lives off a nightly CSV extract loaded by a script — it moves names and departments across, but country context, role-to-group mapping and dated transfers all fall back to people. Cross-border moves between the two entities routinely produce the wrong groups, and future-dated hires appear in Entra the moment HR saves the contract rather than on the actual start date.

Connect Cegid HR (Meta4) to Microsoft Entra ID with Joinly and that work disappears. Joinly reads each HR change in PeopleNet at the source and acts on it automatically: new hires have their account, Office licence and group access ready on their effective start date, transfers between the Spanish and French entities swap the right country groups the same day, successive contracts stay on one account keyed to the person’s unique identifier, and leavers are disabled on their contract end date with a 30-day soft-delete grace window.

“Cross-border moves used to be the thing that broke every sync. Now an account is simply ready on the start date, a transfer to the other entity just swaps the country groups, and we can show the auditor exactly which Cegid change created every bit of access.” — Head of IT, international bank

The outcome this setup is designed for: onboarding drops from days to zero touch, cross-country access errors stop entirely, and the team can walk into its next NIS2 assessment with a complete, source-backed audit trail.