How does Joinly sync Ramco HCM to Microsoft Entra ID?

Joinly reads each HR change in Ramco HCM through the API and applies it to the matching Entra ID account automatically. Ramco HCM holds the authoritative employment record, so it is the starting point for each identity action.

1. Joiner. HR completes the hire in Ramco HCM. Joinly reads the new employee record and determines the role from attributes like department, job title and employing country. It then creates the account in Entra ID, assigns the right licences and maps the person into the correct groups.

2. Mover. When someone changes position, department or employing country in Ramco HCM, Joinly updates their group membership, permissions and licences to match. Access that no longer fits the new position is revoked, so permissions stay aligned with the actual job.

3. Leaver. On the termination date recorded in Ramco HCM, Joinly disables the Entra ID account automatically. There are no orphaned accounts left active after someone has left, and a soft-delete grace window gives IT time to reassign mailboxes and files.

Example: A multinational running Ramco HCM hires an operations analyst in its Singapore entity. Joinly reads the new record, creates the Entra ID account, assigns an Office E3 licence and adds the analyst to the SG-Operations group. When that analyst later transfers to the Dubai entity, Joinly swaps the country groups the same day and keeps the same account rather than creating a duplicate — while the Gulf payroll identifier that Ramco holds for statutory reasons never touches the UPN.

What manual user management costs

Without automation, every account starts as a Ramco HCM ticket or a line in a spreadsheet that IT works through by hand. Entra’s generic API-driven inbound provisioning can move attributes across once someone builds and feeds the SCIM endpoint, but it maps roles to groups through manual rules and has no Ramco-aware logic — so the part that actually decides access still falls to people.

• Onboarding delays. New joiners wait for accounts, licences and group access while a ticket sits in a queue, losing productive days in their first week.

• Permissions that don’t keep up (privilege creep). When movers change position or transfer between countries, old access often stays attached, so people accumulate rights they no longer need.

• Forgotten offboarding. Accounts that aren’t disabled on time are both a security and audit risk, and unused licences keep costing money long after the person has left.

Joinly vs. Entra API-driven inbound provisioning

There is no pre-built Entra provisioning app for Ramco HCM the way there is for SuccessFactors or Workday, so the native path is Entra’s generic API-driven inbound provisioning that a partner has to build and map by hand. Here’s how the two compare for a Ramco-driven setup.

Watch-outs when connecting Ramco HCM to Microsoft Entra ID

A few Ramco-specific details decide whether this connection stays reliable at scale.

• Multi-country payroll in one tenant. Ramco’s strength is Global Payroll across APAC, ANZ, India and the Middle East, so a single tenant commonly holds employees engaged under many countries with different statutory contexts. A naive rule can map the wrong country context to a group. Joinly builds explicit rules from the employing country and entity, so each person lands in the right groups regardless of where their payroll runs.

• Country-specific statutory identifiers. Employees in the Gulf and across APAC carry country-specific payroll and statutory identifiers that Ramco holds for compliance. These must never leak into the UPN, display name or other public directory attributes. Joinly maps only the attributes you choose and keeps statutory identifiers out of anything user-facing.

• Cross-country transfers and global assignments. A transfer between countries can change the employing entity while the person stays the same individual. A naive sync can create a second account. Joinly keeps a single, stable account and swaps the groups and licences that the new country requires.

• UPN format with duplicate names. Across a large multinational workforce, two employees regularly share a name. A naive UPN rule produces collisions. Joinly applies custom transformation rules — a suffix, country code or controlled tiebreaker — so every UPN is unique and predictable from day one.

• Mapping Ramco org structure to Entra groups. Country, employing entity, department and role don’t translate one-to-one to Entra ID groups. Joinly builds explicit mapping rules from those structures to the correct groups and licences, so role drives access rather than manual assignment.

Joinly handles each of these by default with custom mapping and transformation.

Always audit-ready

Every account action Joinly performs is logged: who was affected, when it happened, which access changed and which Ramco HCM change triggered it. For NIS2 that matters directly: access can be traced back to an authorised HR source rather than an ad-hoc request. Joinly is ISO 27001 certified, runs in an EU data centre in Amsterdam, applies least-privilege by default, and is built to meet NIS2 and ISO 27001.

Example case

Picture an international airline group with around 7,000 employees — flight crew, ground operations, engineering and head-office staff — running Ramco HCM with Global Payroll across hubs in India, Singapore and the Gulf. Identity never quite keeps up: every hire starts as a Ramco ticket that IT works through by hand in Entra ID, and with rostered crew, seasonal contracts and constant transfers between hubs the queue never empties. Worse, engineers who move from the Singapore entity to the Dubai one sometimes end up with a second account, and Gulf payroll identifiers occasionally surface where they shouldn’t.

Connect Ramco HCM to Microsoft Entra ID with Joinly and that work disappears. Joinly reads each HR change in Ramco at the source and acts on it automatically: new crew and ground staff have their account, Office licence and group access ready without a ticket, transfers between hubs swap the right country groups the same day and keep one stable account, and leavers are disabled on their termination date with a 30-day soft-delete grace window — all while statutory identifiers stay out of the directory.

“Cross-hub transfers used to spawn duplicate accounts and the Gulf payroll IDs kept leaking into places they had no business being. Now a transfer just swaps the groups, the account stays the same, and we can show the auditor exactly which Ramco change created every bit of access.” — Head of IT, international airline group

The outcome this setup is designed for: onboarding drops from days to zero touch, duplicate accounts from cross-country transfers stop entirely, and the team can walk into its next NIS2 assessment with a complete, source-backed audit trail.