How does Joinly sync Nmbrs to Microsoft Entra ID?

Joinly reads each HR change in Nmbrs through the REST API and applies it to the matching Entra ID account automatically. Nmbrs holds the authoritative employment record — the service interval, department and function — so it is the starting point for each identity action.

1. Joiner. The salary administrator completes the hire in Nmbrs. Joinly reads the new employee and their service interval, determines the role from the company, department and function, and creates the account in Entra ID, assigns the right licences and maps the person into the correct groups — timed to the service-interval start date.

2. Mover. When someone changes department, function or company in Nmbrs, Joinly updates their group membership, permissions and licences to match. Because Nmbrs data is period-based, Joinly acts on the change in the period it becomes effective, and access that no longer fits the new role is revoked.

3. Leaver. When the service interval is closed with an end date in Nmbrs, Joinly disables the Entra ID account automatically. There are no orphaned accounts left active after someone has left, and where a person holds more than one service interval, access is only removed when the last active interval ends.

Example: An accountancy firm runs Nmbrs for its own staff and hires a new assistant accountant with a service-interval start date next Monday, in the Audit department. Joinly reads the record, waits until the start date, creates the Entra ID account, assigns an Office E3 licence and adds the assistant to the Audit group. When that person later moves to the Tax function, Joinly swaps the group the same day and leaves a logged trail of exactly which Nmbrs change drove it.

What manual user management costs

Without automation, every account starts as a message from the payroll administrator or a line in a spreadsheet that IT works through by hand. A hand-built Nmbrs API integration or a generic iPaaS connector can copy attributes across, but it maps departments and functions to groups through manual rules and has no sense of the service-interval start date — so the part that actually decides access still falls to people.

• Onboarding delays. New joiners wait for accounts, licences and group access while a request sits in a queue, losing productive days in their first week.

• Permissions that don’t keep up (privilege creep). When movers change department or function, old access often stays attached, so people accumulate rights they no longer need.

• Forgotten offboarding. Accounts that aren’t disabled on time are both a security and audit risk, and unused licences keep costing money — and a closed service interval in payroll is easy to miss without a direct link to IT.

Joinly vs. a hand-built Nmbrs API integration

Because Nmbrs isn’t published as a native Entra ID provisioning app, the usual alternative is a custom integration against the Nmbrs REST API or a generic iPaaS connector. Both can move data, but they stop short of the part that actually decides access. Here’s how the two compare for a Nmbrs-driven setup.

Watch-outs when connecting Nmbrs to Microsoft Entra ID

A few Nmbrs-specific details decide whether this connection stays reliable at scale.

• Service-interval (dienstverband) start date. In Nmbrs the service-interval start date is what payroll uses, and it isn’t always the same as the calendar date the record was entered. Provisioning too early or too late both cause problems. Joinly reads the service-interval start date and times account creation to it, so access is ready on the right day and not before.

• Period-based department and function changes. Departments and functions in Nmbrs are defined at debtor level and stored per period, so a mover’s new department only becomes authoritative in the period it takes effect. Joinly reads the effective period rather than the latest edit, so a group change lands when the move is actually live.

• No work email in a payroll-first system. Nmbrs is built around payroll and often doesn’t hold a work email or UPN. Joinly generates the userPrincipalName from the name fields with custom transformation rules — a suffix or controlled tiebreaker — so every UPN is unique and predictable from day one.

• Mapping departments and functions to Entra groups. A debtor’s departments and functions don’t translate one-to-one to Entra ID groups. Joinly builds explicit mapping rules from those structures to the correct groups and licences, so role drives access rather than manual assignment.

• Multiple service intervals and rehires. An employee can have more than one service interval over time, including a rehire. Joinly resolves the active interval that should drive the account, so a rehire re-enables the right identity instead of creating a duplicate.

Joinly handles each of these by default with custom mapping and transformation.

Always audit-ready

Every account action Joinly performs is logged: who was affected, when it happened, which access changed and which Nmbrs change triggered it. For NIS2 that matters directly: access can be traced back to an authorised HR source rather than an ad-hoc request. Joinly is ISO 27001 certified, runs in an EU data centre in Amsterdam, applies least-privilege by default, and is built to meet NIS2 and ISO 27001.

Example case

Picture an accountancy and bookkeeping firm with around 180 staff across four offices, running Nmbrs as its HR and payroll core while account creation never quite keeps up. New joiners, interns during busy season and a steady flow of internal moves between the audit, tax and bookkeeping teams all start as a message from the payroll administrator that IT works through by hand — and because Nmbrs holds no work email, someone has to invent a username each time. New hires regularly wait until day two for their account, and a closed service interval sometimes slips past offboarding entirely.

Connect Nmbrs to Microsoft Entra ID with Joinly and that work disappears. Joinly reads each HR change in Nmbrs at the source and acts on it automatically: new hires have their account, Office licence and group access ready on their service-interval start date, moves between departments swap the right groups in the period they take effect, the UPN is generated cleanly from the name fields, and leavers are disabled when their service interval closes with a 30-day soft-delete grace window.

“Half of onboarding used to be inventing a username and chasing the payroll office for a start date. Now the account is simply ready on the first day, and we can show the auditor exactly which change in Nmbrs created every bit of access.” — Head of IT, accountancy firm

The outcome this setup is designed for: onboarding drops from days to zero touch, forgotten offboarding stops entirely, and the team can walk into its next NIS2 assessment with a complete, source-backed audit trail.