How does Joinly sync Sage HR to Microsoft Entra ID?

Joinly reads each HR change in Sage HR through the REST API and applies it to the matching Entra ID account automatically. Sage HR holds the authoritative employee record, so it is the starting point for each identity action.

1. Joiner. HR completes the hire in Sage HR. Joinly reads the new employee record and determines the role from attributes like team, position and job category. It then creates the account in Entra ID, assigns the right licences and maps the person into the correct groups — timed to the recorded start date.

2. Mover. When someone changes team, position or manager in Sage HR, Joinly updates their group membership, permissions and licences to match. Access that no longer fits the new position is revoked, so permissions stay aligned with the actual job, and the Entra manager attribute follows the Sage HR org chart.

3. Leaver. On the end date recorded in Sage HR, Joinly disables the Entra ID account automatically. There are no orphaned accounts left active after someone has left, and unused licences are freed up.

Example: A marketing agency hires a content strategist in Sage HR with a start date next Monday, in the Creative team. Joinly reads the record, waits until the start date, creates the Entra ID account, assigns an Office E3 licence and adds the strategist to the Creative and All-Staff groups. When that person later moves from the Creative team to Client Services, Joinly swaps the groups the same day and updates the manager attribute to their new lead.

What manual user management costs

Without automation, every account starts as a Sage HR notification or a line in a spreadsheet that IT works through by hand. A CSV export from Sage HR or a third-party SCIM gateway can move attributes across, but neither maps teams and positions to groups on its own — so the part that actually decides access still falls to people.

• Onboarding delays. New joiners wait for accounts, licences and group access while a request sits in a queue, losing productive days in their first week.

• Permissions that don’t keep up (privilege creep). When movers change team or position, old access often stays attached, so people accumulate rights they no longer need.

• Forgotten offboarding. Accounts that aren’t disabled on time are both a security and audit risk, and unused licences keep costing money.

Joinly vs. a third-party SCIM gateway or CSV import

There is no Microsoft-published Sage HR provisioning app in the Entra gallery, so the realistic alternatives are a third-party HR-driven connector or a manual CSV import. Both are a fine baseline, but they stop short of the part that actually decides access. Here’s how they compare for a Sage HR-driven setup.

Watch-outs when connecting Sage HR to Microsoft Entra ID

A few Sage HR-specific details decide whether this connection stays reliable at scale.

• Mapping teams and positions to Entra groups. Sage HR’s structure is deliberately flat — teams, positions and job categories rather than a deep hierarchy. Those don’t translate one-to-one to Entra ID groups. Joinly builds explicit mapping rules from team, position and job category to the correct groups and licences, so role drives access rather than manual assignment.

• Modular subscription and available fields. Sage HR is a Core HR base with paid add-on modules, so which attributes the API returns depends on what you’ve subscribed to. Joinly maps only the fields that exist on your tenant and applies fallbacks, so a missing module field never breaks the sync.

• UPN format with duplicate names. In a smaller organisation it’s still easy for two employees to share a name, and a naive UPN rule produces collisions. Joinly applies custom transformation rules — a suffix, team code or controlled tiebreaker — so every UPN is unique and predictable from day one.

• API access and the admin-bound key. Sage HR’s API key is generated by an admin and is invalidated if that admin loses admin rights. Joinly connects with a dedicated, monitored credential and surfaces a connection warning immediately if the key is revoked, so provisioning never silently stops.

Joinly handles each of these by default with custom mapping and transformation.

Always audit-ready

Every account action Joinly performs is logged: who was affected, when it happened, which access changed and which Sage HR change triggered it. For NIS2 that matters directly: access can be traced back to an authorised HR source rather than an ad-hoc request. Joinly is ISO 27001 certified, runs in an EU data centre in Amsterdam, applies least-privilege by default, and is built to meet NIS2 and ISO 27001.

Example case

Picture a marketing agency with around 180 people across three offices, running Sage HR as its people system while IT provisions Microsoft 365 accounts by hand. Every new designer, account manager or strategist starts as a message from HR that someone in IT works through — creating the account, picking licences, adding groups. With freelance-to-permanent conversions and frequent moves between the Creative and Client Services teams, the little jobs never stop, and new joiners often wait until day two for their tools.

Connect Sage HR to Microsoft Entra ID with Joinly and that work disappears. Joinly reads each HR change in Sage HR at the source and acts on it automatically: new hires have their account, Office licence and group access ready on their start date, a move between teams swaps the right groups the same day, the manager attribute follows the org chart, and leavers are disabled on their end date with a 30-day soft-delete grace window.

“We’re not a big company, but the account admin still ate a chunk of every week. Now a new starter is simply ready on day one, a team move just updates their access, and I can show exactly which Sage HR change created every account.” — Head of IT, marketing agency

The outcome this setup is designed for: onboarding drops from days to zero touch, group access stays aligned with the current team, and the team can point to a complete, source-backed audit trail without keeping a spreadsheet.