How does Joinly sync HoorayHR to Microsoft Entra ID?

Joinly reads each HR change in HoorayHR through its REST API and applies it to the matching Entra ID account automatically. HoorayHR holds the authoritative personnel record — the employee, their team, their contract dates — so it is the starting point for each identity action.

1. Joiner. HR completes the hire in HoorayHR. Joinly reads the new employee record and determines the role from attributes like team, department and job title. It then creates the account in Entra ID, assigns the right licences and maps the person into the correct groups — timed to the contract start date recorded in HoorayHR.

2. Mover. When someone changes team, department or job title in HoorayHR, Joinly updates their group membership, permissions and licences to match. Access that no longer fits the new position is revoked, so permissions stay aligned with the actual job rather than drifting over time.

3. Leaver. On the contract end date recorded in HoorayHR, Joinly disables the Entra ID account automatically. There are no orphaned accounts left active after someone has left, and the licence is freed up instead of quietly costing money.

Example: A growing tech company runs HoorayHR for its 180 employees and hires a backend engineer with a start date next Monday, in the Platform team. Joinly reads the record, waits until the start date, creates the Entra ID account, assigns a Microsoft 365 Business Premium licence and adds the engineer to the Platform-Engineering group. When that engineer later moves to the Data team, Joinly swaps the groups the same day — no ticket, no spreadsheet.

What manual user management costs

Without automation, every account starts as a message in HoorayHR — or a Slack ping to whoever runs IT — that someone works through by hand. HoorayHR has no native Entra connection, so the alternatives are a Zapier flow that copies a few fields or a manual create in Entra; neither decides which groups and licences a person should actually get, so the part that matters still falls to people.

• Onboarding delays. New joiners wait for accounts, licences and group access while whoever handles IT gets around to it, losing productive days in their first week.

• Permissions that don’t keep up (privilege creep). When movers change team or department, old access often stays attached, so people accumulate rights they no longer need — a real risk in a fast-growing SME.

• Forgotten offboarding. Accounts that aren’t disabled on time are both a security and audit risk, and unused Microsoft 365 licences keep costing money every month.

Joinly vs. a Zapier / DIY HoorayHR connection

HoorayHR ships a Zapier app and a REST API, so you can move a few fields into Microsoft on your own. But copying data is not the same as managing identities. Here’s how a Joinly connection compares with a home-built Zapier or API integration.

Watch-outs when connecting HoorayHR to Microsoft Entra ID

A few HoorayHR-specific details decide whether this connection stays reliable as the company grows.

• API authentication and MFA. The HoorayHR API authenticates with account credentials, and its own documentation notes that MFA has to be disabled on the API account. Joinly connects through a dedicated, least-privilege service account and keeps those credentials encrypted, so you don’t weaken the security of a real user just to run the integration.

• Contract start and end dates drive timing. HoorayHR records a start and end date well before they take effect. A naive copy provisions or disables at the wrong moment. Joinly reads those dates and times account creation to the start date and the disable to the end date, so access is ready on the right day and removed on the right day.

• Mapping teams and departments to Entra groups. HoorayHR’s teams, departments and branches don’t translate one-to-one to Entra ID groups. Joinly builds explicit mapping rules from those structures to the correct groups and licences, so role drives access rather than manual assignment.

• Thin or inconsistent SME data. In a smaller company a job title may be blank, a team name may be informal and two people may share a name. Joinly applies defensive UPN and group rules — a suffix, an employee-number tiebreaker, a sensible default — so a gap in HoorayHR never produces a collision or a broken sign-in.

• No native SCIM or Entra app. HoorayHR doesn’t publish a SCIM endpoint or an Entra gallery app, so there is no supported native path to fall back on. Joinly’s read-from-API, act-in-Entra model is purpose-built for exactly this, with the mapping and lifecycle logic HoorayHR doesn’t provide.

Joinly handles each of these by default with custom mapping and transformation.

Always audit-ready

Every account action Joinly performs is logged: who was affected, when it happened, which access changed and which HoorayHR change triggered it. For NIS2 that matters directly: access can be traced back to an authorised HR source rather than an ad-hoc request. Joinly is ISO 27001 certified, runs in an EU data centre in Amsterdam, applies least-privilege by default, and is built to meet NIS2 and ISO 27001.

Example case

Picture a tech scale-up with around 180 employees, running HoorayHR as its HR core while everything in Microsoft is still done by hand. There is no native HoorayHR-to-Entra connection, so onboarding lives in a checklist: whoever is closest to IT creates the account, guesses the groups, assigns a licence and hopes the new hire has access by day one. As the company adds ten people a month, transfers between teams pile up and old access is never cleaned out, and a couple of leavers keep an active Microsoft 365 licence for weeks after their last day.

Connect HoorayHR to Microsoft Entra ID with Joinly and that work disappears. Joinly reads each HR change in HoorayHR at the source and acts on it automatically: new hires have their account, Microsoft 365 licence and group access ready on their contract start date, moves between teams swap the right groups the same day, duplicate names get a stable, unique UPN, and leavers are disabled on their end date with a 30-day soft-delete grace window.

“We were onboarding people in a checklist and hoping we hadn’t missed a group. Now an account is simply ready on the start date, a team change just moves the access, and we can show exactly which HoorayHR change created every bit of it.” — Head of IT, tech scale-up

The outcome this setup is designed for: onboarding drops from days to zero touch, privilege creep from old team memberships stops, and the team can point to a complete, source-backed audit trail without building anything themselves.