How does Joinly sync Darwinbox to Microsoft Entra ID?

Joinly reads each HR change from the Darwinbox employee master API and applies it to the matching Entra ID account automatically. Darwinbox holds the authoritative employee record, so it is the starting point for each identity action.

1. Joiner. HR completes the hire in Darwinbox. Joinly reads the new employee record and determines the role from attributes like business unit, department and designation. It then creates the account in Entra ID, assigns the right licences and maps the person into the correct groups.

2. Mover. When someone changes designation, department or business unit in Darwinbox, Joinly updates their group membership, permissions and licences to match. Access that no longer fits the new position is revoked, so permissions stay aligned with the actual job.

3. Leaver. On the exit date recorded in Darwinbox, Joinly disables the Entra ID account automatically. There are no orphaned accounts left active after someone has left, and a soft-delete grace window keeps the account recoverable for a set period.

Example: A global services group runs Darwinbox across its India, Singapore and UK entities. It hires an analyst in the Singapore business unit. Joinly reads the new employee record from the master API, creates the Entra ID account, assigns an Office E3 licence and adds the analyst to the SG-Consulting group. When that analyst later transfers to the UK entity, Joinly swaps the business-unit groups the same day and keeps a single, stable UPN.

What manual user management costs

Without automation, every account starts as a Darwinbox ticket or a line in a spreadsheet that IT works through by hand. A custom-built Entra API-driven provisioning job can move attributes across from Darwinbox, but it maps roles to groups through hand-written rules and leaves the extract logic and matching to you — so the part that actually decides access still falls to people.

• Onboarding delays. New joiners wait for accounts, licences and group access while a ticket sits in a queue, losing productive days in their first week.

• Permissions that don’t keep up (privilege creep). When movers change designation or business unit, old access often stays attached, so people accumulate rights they no longer need.

• Forgotten offboarding. Accounts that aren’t disabled on time are both a security and audit risk, and unused licences keep costing money — and across multiple entities it is easy to miss a leaver in one business unit.

Joinly vs. Entra API-driven inbound provisioning

Microsoft’s API-driven inbound provisioning is a fine baseline — you build a job that reads Darwinbox and pushes a SCIM bulk payload into Entra — but it stops short of the part that actually decides access, and you own the Darwinbox side. Here’s how the two compare for a Darwinbox-driven setup.

Watch-outs when connecting Darwinbox to Microsoft Entra ID

A few Darwinbox-specific details decide whether this connection stays reliable at scale.

• Full-load vs delta extract. The Darwinbox employee master API can return a full load or only records changed since a last-modified date. If the window is wrong, changes are missed or reprocessed. Joinly manages the extract window and matches each record to the existing account, so nothing is skipped or duplicated.

• Multi-country, multi-entity deployments. In an APAC or global Darwinbox rollout the same person can sit under different business units, entities and locales. A naive rule can build the wrong UPN or place someone in the wrong tenant scope. Joinly applies explicit rules so the right business unit and locale drive the account.

• Mapping business unit and designation to Entra groups. Business unit, department, designation, grade and band don’t translate one-to-one to Entra ID groups. Joinly builds explicit mapping rules from those structures to the correct groups and licences, so role drives access rather than manual assignment.

• UPN format with duplicate names. When two employees share a name, a naive UPN rule produces collisions — and locale-specific characters make it worse. Joinly applies custom transformation rules — a suffix, business-unit code or controlled tiebreaker — so every UPN is unique and predictable from day one.

• Token authentication and secret rotation. Darwinbox signs each request with a SHA512 token built from a shared secret and the current timestamp, so clock skew and secret rotation can break a hand-built job. Joinly generates a valid token on every call and manages the credential for you.

Joinly handles each of these by default with custom mapping and transformation.

Always audit-ready

Every account action Joinly performs is logged: who was affected, when it happened, which access changed and which Darwinbox change triggered it. For NIS2 that matters directly: access can be traced back to an authorised HR source rather than an ad-hoc request. Joinly is ISO 27001 certified, runs in an EU data centre in Amsterdam, applies least-privilege by default, and is built to meet NIS2 and ISO 27001.

Example case

Picture a diversified conglomerate with around 9,000 employees across financial services, retail and business-process outsourcing arms, running Darwinbox as its group HR core while its identity provisioning never quite keeps up. A team-built script pulls the employee master into Entra, yet transfers between group companies, a steady stream of internal moves and locale-specific names across its India and Southeast Asia entities keep breaking it — people land in the wrong business-unit groups, duplicate UPNs appear, and leavers in one arm stay active in another.

Connect Darwinbox to Microsoft Entra ID with Joinly and that work disappears. Joinly reads each HR change from the Darwinbox master API at the source and acts on it automatically: new hires have their account, Office licence and group access ready, transfers between group companies swap the right groups the same day, multi-entity people keep a single, stable UPN, and leavers are disabled on their exit date with a 30-day soft-delete grace window.

“Transfers between our group companies used to be the thing that broke every sync. Now an account is simply ready, a move just swaps the access, and we can show the auditor exactly which Darwinbox change created every bit of access.” — Head of IT, diversified conglomerate

The outcome this setup is designed for: onboarding drops from days to zero touch, wrong-group and duplicate-UPN errors stop, and the team can walk into its next NIS2 assessment with a complete, source-backed audit trail.