How does Joinly sync Oracle HCM Cloud to Microsoft Entra ID?

Joinly reads each HR change in Oracle Fusion Cloud HCM through the REST API and applies it to the matching Entra ID account automatically. Oracle HCM holds the authoritative worker and assignment record, so it is the starting point for each identity action.

1. Joiner. HR completes the hire in Oracle HCM. Joinly reads the new worker, work relationship and assignment and determines the role from attributes like department, job, position and grade. It then creates the account in Entra ID, assigns the right licences and maps the person into the correct groups — timed to the date-effective hire date.

2. Mover. When someone changes position, department or legal entity in Oracle HCM, Joinly updates their group membership, permissions and licences to match. Access that no longer fits the new assignment is revoked, so permissions stay aligned with the actual job.

3. Leaver. On the termination date recorded against the work relationship in Oracle HCM, Joinly disables the Entra ID account automatically. There are no orphaned accounts left active after someone has left, and concurrent assignments are taken into account so access is only removed when the last active assignment ends.

Example: An international bank hires a credit risk analyst in Oracle HCM with a hire date next Monday, in its Frankfurt legal entity. Joinly reads the date-effective record, waits until the hire date, creates the Entra ID account, assigns an Office E3 licence and adds the analyst to the DE-Risk group. When that analyst later picks up a second, concurrent assignment in the treasury business unit, Joinly keeps the primary assignment as the driver of the UPN and adds the extra group without breaking sign-in.

What manual user management costs

Without automation, every account starts as an Oracle HCM ticket or a line in a spreadsheet that IT works through by hand. There is no first-party Entra inbound app for Oracle HCM, so most teams build a custom pipeline — an Oracle Integration Cloud (OIC) adapter, or CSV / ATOM-feed-to-SCIM transformation scripts — that moves attributes across but maps roles to groups by hand and stumbles on date effectivity and multiple assignments, so the part that actually decides access still falls to people.

• Onboarding delays. New joiners wait for accounts, licences and group access while a ticket sits in a queue, losing productive days in their first week.

• Permissions that don’t keep up (privilege creep). When movers change position or legal entity, old access often stays attached, so people accumulate rights they no longer need.

• Forgotten offboarding. Accounts that aren’t disabled on time are both a security and audit risk, and unused licences keep costing money — and with concurrent assignments it is easy to disable an account while another assignment is still active.

Joinly vs. a custom OIC / SCIM build for Oracle HCM

There is no first-party Entra inbound provisioning app for Oracle HCM, so the alternative is a custom OIC adapter or a CSV/ATOM-to-SCIM transformation pipeline. That moves data, but it stops short of the part that actually decides access. Here’s how the two compare for an Oracle Fusion HCM-driven setup.

Watch-outs when connecting Oracle HCM Cloud to Microsoft Entra ID

A few Oracle HCM-specific details decide whether this connection stays reliable at scale.

• Date-effective future hires. Oracle HCM stores a hire as a date-effective record well before the first working day, and provisioning too early or too late both cause problems. Joinly reads the effective hire date and times account creation to it, so access is ready on the right day and not before.

• Multiple concurrent assignments. A person can hold more than one active assignment, under one or more work relationships. A naive rule can sync the wrong — or a terminated — assignment to Entra ID and break sign-in. Joinly applies explicit rules to pick the primary assignment as the driver of the UPN, while still reflecting the extra access.

• Position model vs job model. Oracle HCM can be deployed on a position model or a job model, and the two expose access-defining attributes differently. Joinly maps from whichever your tenant uses — position, job and grade — to the correct Entra groups and licences, so role drives access rather than manual assignment.

• UPN format with duplicate names. When two workers share a name, a naive UPN rule produces collisions. Joinly applies custom transformation rules — a suffix, legal-entity code or controlled tiebreaker — so every UPN is unique and predictable from day one.

• Custom flexfields. Oracle HCM descriptive and extensible flexfields aren’t all exposed by default. Joinly maps the custom fields you need via Liquid templates, so attributes like a local employee number or assignment DFF land in the right place.

Joinly handles each of these by default with custom mapping and transformation.

Always audit-ready

Every account action Joinly performs is logged: who was affected, when it happened, which access changed and which Oracle HCM change triggered it. For NIS2 that matters directly: access can be traced back to an authorised HR source rather than an ad-hoc request. Joinly is ISO 27001 certified, runs in an EU data centre in Amsterdam, applies least-privilege by default, and is built to meet NIS2 and ISO 27001.

Example case

Picture an international bank with around 8,000 employees across four legal entities, running Oracle Fusion Cloud HCM as its HR core while its identity provisioning never quite keeps up. A custom OIC-to-SCIM pipeline handles the simple cases, yet secondments, internal transfers between entities and a steady stream of concurrent assignments keep breaking it — analysts with a second assignment end up with the wrong one synced to Entra ID, and future-dated hires are provisioned the moment HR saves the record rather than on their actual hire date.

Connect Oracle HCM Cloud to Microsoft Entra ID with Joinly and that work disappears. Joinly reads each HR change in Oracle HCM at the source and acts on it automatically: new hires have their account, Office licence and group access ready on their date-effective hire date, transfers between legal entities swap the right groups the same day, concurrent assignments keep a single, stable UPN, and leavers are disabled on their termination date with a 30-day soft-delete grace window.

“Concurrent assignments used to be the thing that broke every sync. Now an account is simply ready on the hire date, a second assignment just adds access, and we can show the auditor exactly which Oracle HCM change created every bit of access.” — Head of IT, international bank

The outcome this setup is designed for: onboarding drops from days to zero touch, concurrent-assignment errors stop entirely, and the team can walk into its next NIS2 assessment with a complete, source-backed audit trail.