How does Joinly sync Lessor to Microsoft Entra ID?

Joinly reads each HR change from your Lessor employee master data — held in Emply People, the Lessor / Paychex Europe HR core — and applies it to the matching Entra ID account automatically. Lessor holds the authoritative employment record, so it is the starting point for each identity action.

1. Joiner. HR registers the new medarbejder in Lessor. Joinly reads the new employee record and determines the role from attributes like afdeling (department) and stilling (position). It then creates the account in Entra ID, assigns the right licences and maps the person into the correct groups — timed to the registered start date.

2. Mover. When someone changes stilling or afdeling in Lessor, Joinly updates their group membership, permissions and licences to match. Access that no longer fits the new position is revoked, so permissions stay aligned with the actual job rather than drifting over time.

3. Leaver. On the end date recorded in Lessor, Joinly disables the Entra ID account automatically. No orphaned accounts are left active after someone has left, and access is removed on the date HR recorded rather than whenever a ticket is finally processed.

Example: A Danish wholesaler registers a new purchaser in Lessor with a start date next Monday, in its Copenhagen afdeling. Joinly reads the record, waits until the start date, creates the Entra ID account, assigns an Office E3 licence and adds the purchaser to the DK-Purchasing group. The CPR-nummer stays in Lessor and never touches the UPN; the login is built from the person’s name with a transliteration rule so the Danish characters resolve cleanly.

What manual user management costs

Without automation, every account starts as a message from payroll or a line in a spreadsheet that IT works through by hand. Because there is no native Entra provisioning app for Lessor, teams either key each account in manually or wire up a generic middleware export that pushes attributes but can’t decide access — so the part that actually grants the right groups and licences still falls to people.

• Onboarding delays. New joiners wait for accounts, licences and group access while a request sits in a queue, losing productive days in their first week.

• Permissions that don’t keep up (privilege creep). When movers change stilling or afdeling, old access often stays attached, so people accumulate rights they no longer need.

• Forgotten offboarding. Accounts that aren’t disabled on time are both a security and audit risk, and unused licences keep costing money long after someone has left.

Joinly vs. a generic middleware bridge

Lessor has no first-party Entra ID provisioning app, so the usual alternatives are a manual process or a generic middleware / IGA export. Those move attributes across, but they stop short of the part that actually decides access. Here’s how the two compare for a Lessor-driven setup.

Watch-outs when connecting Lessor to Microsoft Entra ID

A few Lessor-specific details decide whether this connection stays reliable and compliant.

• Where the identity data actually lives. LessorLøn and Lessor5 are Danish payroll-first systems built around CPR and pay rules, not directory identity. The name, afdeling, stilling and dates you need for provisioning usually sit in Emply People, the HR core. Joinly reads from the right source so identity follows the HR record, not the payroll run.

• CPR-nummer is sensitive data. The Danish CPR-nummer is regulated personal data and must never leak into a UPN, username or group name. Joinly keeps CPR inside Lessor as a matching key only and builds the UPN from name and organisation attributes instead.

• Danish characters and duplicate names. Names with æ, ø or å and common Danish surnames produce collisions and invalid logins if handled naively. Joinly applies transliteration and a uniqueness fallback, so every UPN is valid, readable and unique from day one.

• Mapping afdeling and stilling to Entra groups. Danish department and position structures don’t translate one-to-one to Entra ID groups. Joinly builds explicit mapping rules from afdeling and stilling to the correct groups and licences, so role drives access rather than manual assignment.

Joinly handles each of these by default with custom mapping and transformation.

Always audit-ready

Every account action Joinly performs is logged: who was affected, when it happened, which access changed and which Lessor change triggered it. For NIS2 that matters directly: access can be traced back to an authorised HR source rather than an ad-hoc request. Joinly is ISO 27001 certified, runs in an EU data centre in Amsterdam, applies least-privilege by default, and is built to meet NIS2 and ISO 27001.

Example case

Picture a Danish wholesale distributor with around 900 employees across a head office and four regional depots, running Lessor for payroll and Emply People as its HR core while identity never quite keeps up. New buyers, warehouse staff and sales reps are registered in Lessor, but Entra ID accounts are keyed in by hand from an emailed list — so people start on day two, seasonal contracts pile up, and CPR numbers occasionally end up copied into fields where they don’t belong.

Connect Lessor to Microsoft Entra ID with Joinly and that work disappears. Joinly reads each HR change at the source and acts on it automatically: new hires have their account, Office licence and group access ready on their registered start date, a move to another afdeling swaps the right groups the same day, Danish names resolve to clean logins, and leavers are disabled on their end date with a 30-day soft-delete grace window.

“Accounts used to lag a day or two behind the start date, and we were nervous about CPR numbers ending up in the wrong place. Now an account is simply ready on the start date, the login is always clean, and we can show exactly which Lessor change created every bit of access.” — Head of IT, wholesale distributor

The outcome this setup is designed for: onboarding drops from days to zero touch, CPR never leaves the HR source, and the team can walk into its next NIS2 assessment with a complete, source-backed audit trail.