How does Joinly sync Rippling to Microsoft Entra ID?

Joinly reads each HR change in Rippling through the REST API and applies it to the matching Entra ID account automatically. Rippling holds the authoritative employment record, so it is the starting point for each identity action — but the account itself lives and is governed in your Entra tenant.

1. Joiner. HR completes the hire in Rippling. Joinly reads the new employee, their department, role, team and work location, and determines the access profile from those attributes. It then creates the account in Entra ID, assigns the right licences and maps the person into your existing Entra groups — timed to the start date recorded in Rippling.

2. Mover. When someone changes role, department, team or work location in Rippling, Joinly updates their Entra group membership, permissions and licences to match. Access that no longer fits the new role is revoked, so permissions stay aligned with the actual job rather than accumulating.

3. Leaver. On the termination date recorded in Rippling, Joinly disables the Entra ID account automatically. No orphaned accounts are left active after someone has left, and licences are freed instead of quietly billing month after month.

Example: A software company runs Rippling for HR and payroll but treats Microsoft Entra ID as its directory of record. It hires a backend engineer in Rippling with a start date next Monday, in the Platform team. Joinly reads the record, waits until the start date, creates the Entra ID account, assigns a Microsoft 365 E3 licence and adds the engineer to the existing ENG-Platform and All-Engineering groups the tenant already governs. When that engineer later moves to the Security team, Joinly swaps the group membership the same day rather than letting the old Platform access linger.

What manual user management costs

Without automation, every account starts as a Rippling notification or a line in a spreadsheet that IT works through by hand. Rippling’s own app provisioning and the Microsoft Entra API-driven path can move attributes across, but Rippling is built to be your identity provider — so when Entra ID is your directory of record, the role-to-group mapping into the groups you already govern still falls to people.

• Onboarding delays. New joiners wait for accounts, licences and group access while a request sits in a queue, losing productive days in their first week.

• Permissions that don’t keep up (privilege creep). When movers change role or department in Rippling, old Entra access often stays attached, so people accumulate rights they no longer need.

• Forgotten offboarding. Accounts that aren’t disabled on time are both a security and audit risk, and unused Microsoft 365 licences keep costing money long after someone has left.

Joinly vs. Rippling’s own provisioning

Rippling can provision apps itself, and there’s a Rippling-built path into Entra ID. But Rippling is designed to be the identity provider, and that’s exactly the question: if your directory of record is Entra ID, do you want Rippling driving identity, or HR data flowing into the directory you already govern? Here’s how the two compare.

Watch-outs when connecting Rippling to Microsoft Entra ID

A few Rippling-specific details decide whether this connection stays reliable and stays under your governance.

• Rippling wants to be the IdP. Rippling is built to be the identity provider and to provision apps itself. If your directory of record is Entra ID, you don’t want a second identity tower — Joinly keeps Entra as the directory and uses Rippling purely as the HR source, so identity stays where you govern it.

• Mapping roles to your existing Entra groups. Rippling roles, departments, teams and work locations don’t translate one-to-one to Entra ID groups. Joinly builds explicit rules from those structures into the groups your tenant already owns, so HR data lands in your governed groups rather than new ones.

• No inbound SCIM endpoint. Rippling is an outbound IdP, not a downstream SCIM app, so you can’t treat it like a normal SCIM source. Joinly reads the Rippling REST API directly, which is how Rippling actually exposes employee, department and role data.

• UPN format with duplicate names. When two employees share a name, a naive UPN rule produces collisions. Joinly applies custom transformation rules — a suffix, location code or controlled tiebreaker — so every UPN is unique and predictable from day one.

• Custom Rippling fields. Custom Rippling attributes and a local employee number aren’t all surfaced the same way. Joinly maps the custom fields you need via Liquid templates, so the attributes you rely on land in the right place in Entra.

Joinly handles each of these by default with custom mapping and transformation.

Always audit-ready

Every account action Joinly performs is logged: who was affected, when it happened, which access changed and which Rippling change triggered it. For NIS2 that matters directly: access can be traced back to an authorised HR source rather than an ad-hoc request — and the trail lives in the directory you govern, not inside Rippling. Joinly is ISO 27001 certified, runs in an EU data centre in Amsterdam, applies least-privilege by default, and is built to meet NIS2 and ISO 27001.

Example case

Picture a software company with around 900 employees that runs Rippling for HR and payroll but standardised long ago on Microsoft Entra ID as its directory of record. Rippling keeps trying to be the identity hub, and the native path provisions some apps from Rippling’s side — yet the Entra groups that actually gate the codebase, the cloud accounts and the SaaS tools are governed in the tenant, so every new engineer still needs someone to map their role into the right groups by hand.

Connect Rippling to Microsoft Entra ID with Joinly and that work disappears. Joinly reads each HR change in Rippling at the source and acts on it in your tenant: new hires have their account, Microsoft 365 licence and existing-group access ready on their start date, team moves swap the right Entra groups the same day, and leavers are disabled on their termination date with a soft-delete grace window — all while Entra stays the directory of record.

“We didn’t want Rippling to become a second identity system. Now Rippling stays our HR source, Entra stays our directory, and every engineer lands in exactly the groups we already govern — on their start date, with a trail we can show the auditor.” — Head of IT, software company

The outcome this setup is designed for: onboarding drops from days to zero touch, Entra stays the single directory of record, and the team can walk into its next NIS2 assessment with a complete, source-backed audit trail.