How does Joinly sync Kenjo to Microsoft Entra ID?

Joinly reads each HR change in Kenjo through the API and applies it to the matching Entra ID account automatically. Kenjo holds the authoritative employee record, so it is the starting point for each identity action.

1. Joiner. HR completes the hire in Kenjo. Joinly reads the new employee record and determines the role from attributes like office, department, team and area. It then creates the account in Entra ID, assigns the right licences and maps the person into the correct groups — generating a unique UPN even when the new starter has no existing email address.

2. Mover. When someone changes department, team, office or area in Kenjo, Joinly updates their group membership, permissions and licences to match. Access that no longer fits the new position is revoked, so permissions stay aligned with the actual job.

3. Leaver. When Kenjo records that someone has left, Joinly disables the Entra ID account automatically. There are no orphaned accounts left active after a leaver, and no licence quietly keeps costing money.

Example: A hospitality group hires a front-desk supervisor in Kenjo, assigned to its Barcelona office and its Reception team. Joinly reads the record, creates the Entra ID account, assigns a Business Basic licence and adds the supervisor to the ES-Reception group. Because the new starter has no prior email, Joinly builds the UPN from a name rule with a collision fallback, so the login is unique from day one. When that supervisor later moves to the Events team, Joinly swaps the groups the same day.

What manual user management costs

Without automation, every account starts as a Kenjo notification or a line in a spreadsheet that IT works through by hand. Kenjo has no native Entra provisioning app, so even a scripted API import moves attributes but leaves the part that actually decides access — which groups, which licence, which UPN — to people.

• Onboarding delays. New joiners wait for accounts, licences and group access while a request sits in a queue, losing productive time in their first shift or first week.

• Permissions that don’t keep up (privilege creep). When movers change team, office or area, old access often stays attached, so people accumulate rights they no longer need.

• Forgotten offboarding. Accounts that aren’t disabled on time are both a security and audit risk, and unused licences keep costing money — a real problem in high-turnover, shift-based teams.

Joinly vs. a custom Kenjo API import

Kenjo has no dedicated Entra provisioning app, so the alternative is a custom API-driven import (or Microsoft’s API-driven inbound provisioning). It can move attributes, but it stops short of the part that actually decides access. Here’s how the two compare for a Kenjo-driven setup.

Watch-outs when connecting Kenjo to Microsoft Entra ID

A few Kenjo-specific details decide whether this connection stays reliable at scale.

• Mapping Kenjo structures to Entra groups. Office, department, team and area don’t translate one-to-one to Entra ID groups, and in an SME the data is often lighter than in enterprise HCM. Joinly builds explicit mapping rules from those structures to the correct groups and licences, so role drives access rather than manual assignment.

• Staff without a company email. Kenjo is built for deskless and shift-based teams, so many new starters have no existing email to copy a UPN from. Joinly generates a unique UPN and display name from your naming rules, with a controlled tiebreaker for duplicate names.

• API key scope on the Connect plan. The Kenjo API is enabled per account and each key is scoped. The key must be granted the office, department, team, area and employee endpoints. Joinly tells you exactly which scopes to enable, so the sync has the data it needs without over-granting access.

• High turnover and rehires. Shift-based workforces churn, and the same person may return. Joinly matches returning people to their existing account instead of creating duplicates, and disables leavers promptly so licences aren’t wasted.

Joinly handles each of these by default with custom mapping and transformation.

Always audit-ready

Every account action Joinly performs is logged: who was affected, when it happened, which access changed and which Kenjo change triggered it. For NIS2 that matters directly: access can be traced back to an authorised HR source rather than an ad-hoc request. Joinly is ISO 27001 certified, runs in an EU data centre in Amsterdam, applies least-privilege by default, and is built to meet NIS2 and ISO 27001.

Example case

Picture a hospitality group with around 1,800 employees across a dozen hotels and restaurants, running Kenjo for its shift-based teams while identity is still handled by hand. Most front-of-house and kitchen staff have no company email when they start, so IT builds each Entra ID account manually from the Kenjo record — inventing a login, picking the licence, adding groups. With seasonal peaks and high turnover the queue never empties, and a new waiter or receptionist often waits until their second or third shift before they can clock in on the systems they need.

Connect Kenjo to Microsoft Entra ID with Joinly and that work disappears. Joinly reads each change in Kenjo at the source and acts on it automatically: new hires have their account, licence and group access ready in time for their first shift, a move from Reception to Events swaps the right groups the same day, returning seasonal staff are matched back to their old account instead of getting a duplicate, and leavers are disabled promptly so no licence keeps billing.

“Half our people start without an email, so every account used to be a manual build. Now a login is simply ready before the shift starts, a team change just swaps the groups, and we can show exactly which Kenjo change created every bit of access.” — Head of IT, hospitality group

The outcome this setup is designed for: onboarding drops from days to zero touch for shift staff, privilege creep from old teams is eliminated, and the team can walk into its next NIS2 assessment with a complete, source-backed audit trail.