How does Joinly sync Paycor to Microsoft Entra ID?

Joinly reads each HR change in Paycor through the Public API and applies it to the matching Entra ID account automatically. The Paycor employee record holds the authoritative employment data, so it is the starting point for each identity action.

1. Joiner. HR completes the hire in Paycor. Joinly reads the new employee record and determines the role from attributes like department, job, position and location. It then creates the account in Entra ID, assigns the right licences and maps the person into the correct groups — timed to the effective start date on the Paycor record.

2. Mover. When someone changes position, department or legal entity in Paycor, Joinly updates their group membership, permissions and licences to match. Access that no longer fits the new position is revoked, so permissions stay aligned with the actual job.

3. Leaver. On the termination date recorded in Paycor, Joinly disables the Entra ID account automatically. There are no orphaned accounts left active after someone has left, and a transfer between legal entities is treated as a move rather than a leave so access is never wrongly removed.

Example: A multi-location restaurant group hires a shift supervisor in Paycor with a start date next Monday, under its Midwest legal entity at the downtown location. Joinly reads the effective-dated record, waits until the start date, creates the Entra ID account, assigns an Office E1 licence and adds the supervisor to the Midwest-Operations group. When that supervisor later transfers to a sister restaurant under a different legal entity, Joinly reads the change from both entities, keeps a single stable UPN and swaps the location and department groups the same day.

What manual user management costs

Without automation, every account starts as a Paycor ticket or a line in a spreadsheet that IT works through by hand. Paycor exposes the data through its Public API, but it ships no native Entra provisioning connector — so unless you build the integration yourself, the part that actually decides access still falls to people.

• Onboarding delays. New joiners wait for accounts, licences and group access while a ticket sits in a queue, losing productive days in their first week.

• Permissions that don’t keep up (privilege creep). When movers change position or legal entity, old access often stays attached, so people accumulate rights they no longer need.

• Forgotten offboarding. Accounts that aren’t disabled on time are both a security and audit risk, and unused licences keep costing money — and a transfer between legal entities can look like a leave and trigger the wrong action.

Joinly vs. building on the Paycor API yourself

Paycor has no native Entra provisioning connector, so the realistic alternative is wiring the Paycor Public API into Microsoft’s Entra inbound provisioning or custom code. Here’s how that compares with Joinly for a Paycor-driven setup.

Watch-outs when connecting Paycor to Microsoft Entra ID

A few Paycor-specific details decide whether this connection stays reliable at scale.

• Multiple legal entities. Paycor partitions all data by legal entity, and the API user must be granted access to each one during the Handshake — miss one and those employees never appear in the feed. Joinly reads every entity it is permitted to see and treats them as one combined population, so no one silently goes missing.

• Effective-dated hires and changes. A Paycor hire or position change carries an effective date, and provisioning too early or too late both cause problems. Joinly reads the effective date and times account creation to it, so access is ready on the right day and not before.

• Mapping Paycor structure to Entra groups. Legal entity, location, department, job and position don’t translate one-to-one to Entra ID groups. Joinly builds explicit mapping rules from those structures to the correct groups and licences, so role drives access rather than manual assignment.

• UPN format with duplicate names. When two employees share a name, a naive UPN rule produces collisions. Joinly applies custom transformation rules — a suffix, location code or controlled tiebreaker — so every UPN is unique and predictable from day one.

• Rate limits and pagination. The Paycor API caps at 1,000 calls per minute and pages with a continuationToken cursor. Joinly backs off on a 429 and walks the cursor cleanly, so a large legal entity syncs completely without dropping records.

Joinly handles each of these by default with custom mapping and transformation.

Always audit-ready

Every account action Joinly performs is logged: who was affected, when it happened, which access changed and which Paycor change triggered it. For NIS2 that matters directly: access can be traced back to an authorised HR source rather than an ad-hoc request. Joinly is ISO 27001 certified, runs in an EU data centre in Amsterdam, applies least-privilege by default, and is built to meet NIS2 and ISO 27001.

Example case

Picture a multi-location restaurant group with around 1,800 employees across four legal entities and dozens of sites, running Paycor as its HR core while its identity provisioning never quite keeps up. There is no native Paycor-to-Entra connector, so a half-finished script handles the simple cases, yet seasonal hiring spikes, transfers between restaurants and a fourth legal entity that was never added to the API Handshake keep breaking it — a whole site’s worth of new hires turns out to be missing from the feed, and future-dated hires are provisioned the moment HR saves the record rather than on their actual start date.

Connect Paycor to Microsoft Entra ID with Joinly and that work disappears. Joinly reads each HR change in Paycor at the source and acts on it automatically: new hires have their account, Office licence and group access ready on their effective start date, transfers between legal entities swap the right groups the same day, every permitted entity is read into one combined feed so no site goes missing, and leavers are disabled on their termination date with a 30-day soft-delete grace window.

“A missing legal entity used to mean a whole restaurant’s new hires had no accounts on day one. Now everyone is simply ready on their start date, transfers just swap groups, and we can show the auditor exactly which Paycor change created every bit of access.” — Head of IT, multi-location restaurant group

The outcome this setup is designed for: onboarding drops from days to zero touch, no legal entity ever goes missing from the feed again, and the team can walk into its next NIS2 assessment with a complete, source-backed audit trail.