Connect Paycom to Microsoft Entra ID

How does Joinly sync Paycom to Microsoft Entra ID?

Joinly reads each HR change in Paycom through its REST API and applies it to the matching Entra ID account automatically. Paycom holds the authoritative employee and position record, so it is the starting point for each identity action — and because Paycom restricts API access, Joinly is configured once against the API user and credentials your Paycom representative provisions.

1. Joiner. HR completes the hire in Paycom. Joinly reads the new employee record and determines the role from the assigned position, department and location. It then creates the account in Entra ID, assigns the right licences and maps the person into the correct groups — timed to the start date on the Paycom record.

2. Mover. When someone changes position, department or location in Paycom, Joinly updates their group membership, permissions and licences to match. Because Paycom ties job details to the position rather than the person, a position change is a clean signal Joinly acts on, and access that no longer fits is revoked.

3. Leaver. On the termination date recorded in Paycom, Joinly disables the Entra ID account automatically. There are no orphaned accounts left active after someone has left, and where a person exists under more than one EIN, access is only removed when the last active employment ends.

Example: An insurance company hires a claims adjuster in Paycom with a start date next Monday, assigned to the Claims position at its Phoenix location under its operating EIN. Joinly reads the record, waits until the start date, creates the Entra ID account, assigns an Office E3 licence and adds the adjuster to the Claims-Operations group. When that adjuster later moves into a team-lead position, Joinly reads the position change and swaps the groups the same day — without anyone filing a ticket.

What manual user management costs

Without automation, every account starts as a Paycom report someone exports by hand and works through one row at a time — and because Paycom has no native SCIM and no first-party provisioning app, there is no out-of-the-box path to lean on at all. The export itself is the bottleneck: getting clean, current data out of Paycom’s restricted API is the hard part, and once it is out, mapping positions to access still falls to people.

• Onboarding delays. New joiners wait for accounts, licences and group access while someone runs a Paycom export and processes it by hand, losing productive days in their first week.

• Permissions that don’t keep up (privilege creep). When movers change position or location, old access often stays attached, so people accumulate rights they no longer need.

• Forgotten offboarding. Accounts that aren’t disabled on time are both a security and audit risk, and unused licences keep costing money — and with multi-EIN employment it is easy to disable an account while another employment is still active.

Joinly vs. a Paycom SCIM-gateway bridge

Paycom has no native SCIM provisioning and no Microsoft-published inbound provisioning app, so the real comparison is against third-party middleware — a SCIM gateway like Aquera or a bridge like RoboMQ Hire2Retire. Here’s how the two compare for a Paycom-driven setup.

Watch-outs when connecting Paycom to Microsoft Entra ID

A few Paycom-specific details decide whether this connection stays reliable at scale — and the first one is the connection itself.

• Restricted API access. Paycom has no public API. Access is provisioned per customer by a Paycom representative, who sets up an API user with the right permissions, issues an API SID and Token, and often whitelists the calling IP. Joinly handles this gated setup as part of onboarding, so the hard part — getting clean data out of Paycom at all — is solved once rather than on every change.

• Rate limits and proprietary schema. Paycom rate-limits the API (around 500 calls per minute on some plans) and its field set is proprietary and varies by implementation, so fields must match exactly. Joinly reads efficiently within the limits and maps your specific Paycom fields explicitly, so a heavy import never trips the limit or breaks on a renamed field.

• Position, not person. Paycom ties job details — title, pay class, labor allocation — to the position rather than the individual. Joinly drives Entra access from the assigned position, so a position change is a clean, reliable trigger instead of a free-text job title that nobody maintains.

• Multi-EIN employment. Larger organisations run multiple EINs, and the same person can appear under more than one. A naive rule creates duplicate Entra accounts. Joinly resolves the person across EINs to a single, stable account and only offboards when the last active employment ends.

• UPN format with duplicate names. When two employees share a name, a naive UPN rule produces collisions. Joinly applies custom transformation rules — a suffix, location code or controlled tiebreaker — so every UPN is unique and predictable from day one.

Joinly handles each of these by default with custom mapping and transformation.

Always audit-ready

Every account action Joinly performs is logged: who was affected, when it happened, which access changed and which Paycom change triggered it. For NIS2 that matters directly: access can be traced back to an authorised HR source rather than an ad-hoc request. Joinly is ISO 27001 certified, runs in an EU data centre in Amsterdam, applies least-privilege by default, and is built to meet NIS2 and ISO 27001.

Example case

Picture an insurance company with around 3,500 employees across several regional offices, running Paycom as its HCM core while its identity provisioning never quite keeps up. With no native SCIM and no first-party connector, IT lives off Paycom exports: someone pulls a report, works through new hires and position changes by hand, and the queue never empties. Getting the data out is the bottleneck — the restricted API was set up once, years ago, by whoever still remembers the API user and the whitelisted IP — and position changes regularly slip through, leaving adjusters with access from a role they left months ago.

Connect Paycom to Microsoft Entra ID with Joinly and that work disappears. Joinly reads each HR change in Paycom at the source and acts on it automatically: new hires have their account, Office licence and group access ready on their start date, a position change swaps the right groups the same day, people who exist under more than one EIN keep a single stable account, and leavers are disabled on their termination date with a 30-day soft-delete grace window.

“Getting clean data out of Paycom used to be a person’s whole morning. Now an account is simply ready on the start date, a position change just swaps the access, and we can show the auditor exactly which Paycom change created every bit of access.” — Head of IT, insurance company

The outcome this setup is designed for: onboarding drops from days to zero touch, access driven by old positions stops accumulating, and the team can walk into its next NIS2 assessment with a complete, source-backed audit trail.