How does Joinly sync HiBob to Microsoft Entra ID?

Joinly reads each HR change in Bob through the Public API and applies it to the matching Entra ID account automatically. Bob holds the authoritative employment record, so it is the starting point for each identity action.

1. Joiner. HR completes the hire in Bob. Joinly reads the new profile — including the upcoming lifecycle status and effective start date — and determines the role from attributes like site, department and team. It then creates the account in Entra ID, assigns the right licences and maps the person into the correct groups — timed to the start date, even though Bob hides ‘upcoming’ people from default list queries.

2. Mover. When someone changes team, department or site in Bob, Joinly updates their group membership, permissions and licences to match. Access that no longer fits the new position is revoked, so permissions stay aligned with the actual job — and it keeps up even when a scale-up renames teams or spins up a new site.

3. Leaver. When Bob moves a person to a leaving / terminated lifecycle status on the recorded end date, Joinly disables the Entra ID account automatically. There are no orphaned accounts left active after someone has left, and the change is tied back to the exact Bob status transition that triggered it.

Example: A fintech scale-up hires a backend engineer in Bob with a start date next Monday, attached to the Amsterdam site and the Payments team. The person sits as ‘upcoming’ and is invisible to a default API list. Joinly reads the record by lifecycle status and start date, waits until Monday, creates the Entra ID account, assigns an Office E3 licence and adds the engineer to the Payments-Eng group. When the team is later renamed in a reorg, Joinly re-evaluates the mapping rule and swaps the group without anyone editing Entra by hand.

What manual user management costs

Without automation, every account starts as a HiBob ticket or a line in a spreadsheet that IT works through by hand. Bob’s SCIM provisioning to Entra can move core attributes across, but it maps groups only to departments, doesn’t expose custom fields and has no role-to-group logic — so the part that actually decides access still falls to people.

• Onboarding delays. New joiners wait for accounts, licences and group access while a ticket sits in a queue, losing productive days in their first week — and an ‘upcoming’ hire missed by a default query simply never gets created.

• Permissions that don’t keep up (privilege creep). When movers change team or site, old access often stays attached, so people accumulate rights they no longer need — especially in a fast-moving scale-up that reorgs often.

• Forgotten offboarding. Accounts that aren’t disabled on time are both a security and audit risk, and unused licences keep costing money — and a leaving status that nobody actions leaves an account live for weeks.

Joinly vs. HiBob’s native SCIM provisioning

Bob’s SCIM provisioning app for Entra ID is a fine baseline, but it stops short of the part that actually decides access. Here’s how the two compare for a Bob-driven setup.

Watch-outs when connecting HiBob to Microsoft Entra ID

A few HiBob-specific details decide whether this connection stays reliable at scale.

• Lifecycle status drives access. Bob models a person as upcoming, active or leaving, and access should follow those transitions — not the moment a record is saved. A future-dated hire sits as ‘upcoming’ and is hidden from default list queries, so a naive read misses it entirely. Joinly reads by lifecycle status and effective start date, so access is ready on the right day.

• Sites and teams, not classic departments. Bob structures people by site, department and team, which don’t translate one-to-one to Entra ID groups. Joinly builds explicit mapping rules from that structure to the correct groups and licences, so role drives access rather than manual assignment.

• Rapid org changes in a scale-up. Fast-growing companies rename teams, open new sites and reshuffle reporting lines constantly. Hard-coded group assignments rot quickly. Joinly re-evaluates rule-based mappings on every sync, so the org chart and Entra access stay in step.

• UPN format with duplicate names. When two employees share a name, a naive UPN rule produces collisions. Joinly applies custom transformation rules — a suffix, site code or controlled tiebreaker — so every UPN is unique and predictable from day one.

• Custom Bob fields and termination reasons. Custom HiBob fields aren’t exposed by SCIM, and Bob expects termination reasons from its configured list. Joinly maps the custom fields you need via Liquid templates and reads the exact status and reason that triggered each action.

Joinly handles each of these by default with custom mapping and transformation.

Always audit-ready

Every account action Joinly performs is logged: who was affected, when it happened, which access changed and which HiBob change triggered it. For NIS2 that matters directly: access can be traced back to an authorised HR source rather than an ad-hoc request. Joinly is ISO 27001 certified, runs in an EU data centre in Amsterdam, applies least-privilege by default, and is built to meet NIS2 and ISO 27001.

Example case

Picture a fintech scale-up with around 900 employees across four sites, running Bob as its HR core while its identity provisioning never quite keeps up. Bob’s SCIM app handles the simple cases, yet rapid hiring, a constant stream of team renames and new sites keep breaking it — future-dated engineers sit as ‘upcoming’ and never get an account until someone notices, and a department-only group map leaves new Payments and Risk teams with no access rule at all.

Connect HiBob to Microsoft Entra ID with Joinly and that work disappears. Joinly reads each HR change in Bob at the source and acts on it automatically: new hires have their account, Office licence and group access ready on their start date even while they’re still ‘upcoming’, team and site moves swap the right groups the same day, reorgs are absorbed by rule-based mapping, and leavers are disabled the moment Bob flips them to a leaving status, with a 30-day soft-delete grace window.

“Upcoming hires used to fall through the cracks and every reorg meant re-doing group maps by hand. Now an account is simply ready on the start date, a renamed team just re-maps itself, and we can show the auditor exactly which Bob change created every bit of access.”

The outcome this setup is designed for: onboarding drops from days to zero touch, no ‘upcoming’ hire is ever missed, and the team can walk into its next NIS2 assessment with a complete, source-backed audit trail.