How does Joinly sync Sage People to Microsoft Entra ID?

Joinly reads each HR change in your Sage People org through the Salesforce Platform API and applies it to the matching Entra ID account automatically. The Sage People Team Member and its Employment Record hold the authoritative employment details, so they are the starting point for each identity action.

1. Joiner. HR completes the hire in Sage People. Joinly reads the new Team Member and Employment Record, determines the role from attributes like HR Department, Team and job title, then creates the account in Entra ID, assigns the right licences and maps the person into the correct groups — timed to the start date on the employment record.

2. Mover. When someone changes Team, HR Department or manager in Sage People, Joinly updates their group membership, permissions and licences to match. Access that no longer fits the new position is revoked, so permissions stay aligned with the actual job.

3. Leaver. On the leaving date recorded in Sage People, Joinly disables the Entra ID account automatically. There are no orphaned accounts left active after someone has left, and the account is retired on a schedule you control.

Example: A mid-market services firm hires a consultant in Sage People with a start date next Monday, in its UK HR Department. Joinly reads the Team Member record, waits until the start date, creates the Entra ID account, assigns an Office E3 licence and adds the consultant to the UK-Consulting group. When that consultant later moves to a delivery team under a new manager, Joinly swaps the groups the same day and keeps the UPN stable.

What manual user management costs

Without automation, every account starts as a Sage People ticket or a line in a spreadsheet that IT works through by hand. Microsoft’s native Salesforce provisioning can move a user across, but it targets the Salesforce User object rather than the Sage People HR record and maps nothing from HR structure to groups — so the part that actually decides access still falls to people.

• Onboarding delays. New joiners wait for accounts, licences and group access while a ticket sits in a queue, losing productive days in their first week.

• Permissions that don’t keep up (privilege creep). When movers change Team or HR Department, old access often stays attached, so people accumulate rights they no longer need.

• Forgotten offboarding. Accounts that aren’t disabled on time are both a security and audit risk, and unused licences keep costing money.

Joinly vs. the native Salesforce provisioning app

Because Sage People runs on Salesforce, the native comparison is Microsoft’s Entra provisioning for Salesforce. It’s a fine baseline for the Salesforce login, but it stops short of the part that actually decides access for a Sage People-driven setup.

Watch-outs when connecting Sage People to Microsoft Entra ID

A few Sage People-specific details decide whether this connection stays reliable at scale.

• It’s a Salesforce org, not a plain HR feed. Sage People data lives in Salesforce, so access is via a Connected App with OAuth and is subject to Salesforce sharing rules, permission sets and API limits. Joinly authenticates as a scoped, API-only integration user with just the read access it needs, so provisioning is reliable without over-permissioning the connection.

• Team Member vs Salesforce User. The Sage People Team Member (the HR person record) is not the same as the Salesforce User (a licensed login). A naive sync that follows the Salesforce User misses HR movers and leavers. Joinly drives everything from the Team Member and Employment Record, so the HR record decides access.

• Mapping HR structure to Entra groups. HR Department, Team and Business Unit don’t translate one-to-one to Entra ID groups. Joinly builds explicit mapping rules from those structures to the correct groups and licences, so role drives access rather than manual assignment.

• Resolving the manager link. The manager is a lookup between Team Member records, not a plain text field. Joinly resolves that link so the correct manager lands on the Entra ID account and org-based rules evaluate correctly.

• UPN format with duplicate names. When two employees share a name, a naive UPN rule produces collisions. Joinly applies custom transformation rules — a suffix, department code or controlled tiebreaker — so every UPN is unique and predictable from day one.

Joinly handles each of these by default with custom mapping and transformation.

Always audit-ready

Every account action Joinly performs is logged: who was affected, when it happened, which access changed and which Sage People change triggered it. For NIS2 that matters directly: access can be traced back to an authorised HR source rather than an ad-hoc request. Joinly is ISO 27001 certified, runs in an EU data centre in Amsterdam, applies least-privilege by default, and is built to meet NIS2 and ISO 27001.

Example case

Picture a mid-market pharmaceutical company with around 3,200 employees across research, manufacturing and commercial teams, running Sage People on Salesforce as its HR core while identity provisioning never quite keeps up. The native Salesforce provisioning handles the licensed Salesforce logins, yet the people who never touch Salesforce — lab technicians, plant operators, field reps — still get their Entra ID accounts created by hand, and internal transfers between HR Departments leave old group access behind.

Connect Sage People to Microsoft Entra ID with Joinly and that work disappears. Joinly reads each Team Member change at the source through the Salesforce API and acts on it automatically: new hires have their account, Office licence and group access ready on their start date, transfers between teams swap the right groups the same day, and leavers are disabled on their leaving date with a 30-day soft-delete grace window.

“Half our workforce never logs into Salesforce, so the native provisioning simply didn’t see them. Now every account is ready on the start date from the HR record, and we can show the auditor exactly which Sage People change created every bit of access.” — Head of IT, pharmaceutical company

The outcome this setup is designed for: onboarding drops from days to zero touch, privilege creep from old teams stops, and the team can walk into its next NIS2 assessment with a complete, source-backed audit trail.