How does Joinly sync SAP HCM to Microsoft Entra ID?

Joinly reads each HR change in SAP HCM through the standard BAPI/RFC and IDoc interfaces and applies it to the matching Entra ID account automatically. The PA infotypes hold the authoritative employment record and OM holds the org structure, so those are the starting point for each identity action.

1. Joiner. HR runs the hire action (Massnahme) in SAP HCM, which writes IT0000 (Actions), IT0001 (Organizational Assignment) and IT0002 (Personal Data) against the new PERNR. Joinly reads those infotypes, determines the role from the position, org unit and cost center in OM, then creates the account in Entra ID, assigns the right licences and maps the person into the correct groups — timed to the effective start date (BEGDA).

2. Mover. When someone changes position, org unit, cost center or personnel area in SAP HCM, Joinly updates their group membership, permissions and licences to match. Access that no longer fits the new position is revoked, so permissions stay aligned with the actual job in OM.

3. Leaver. On the leaving action recorded in IT0000 (with its effective end date), Joinly disables the Entra ID account automatically. No orphaned accounts stay active after someone has left, and concurrent employments are taken into account so access is only removed when the last active PERNR ends.

Example: An industrial manufacturer runs SAP ERP HCM on-premise and hires a production engineer with a hire action effective next Monday, assigned to a position in its German personnel area. Joinly reads the effective-dated IT0000/IT0001 records, waits until Monday, creates the Entra ID account, assigns an Office E3 licence and adds the engineer to the DE-Operations group based on the OM position. When that engineer later picks up a second assignment under a new PERNR, Joinly keeps the primary employment as the driver of the UPN and adds the extra group without breaking sign-in.

What manual user management costs

Without automation, every account starts as an SAP HCM ticket or a line in a spreadsheet that IT works through by hand. Microsoft’s own guidance for on-premise SAP HCM is to build and run an Azure Logic Apps workflow that calls BAPIs or receives IDocs, converts them to SCIM and posts to Entra API-driven provisioning — a real integration project to write, secure and maintain before a single account is created, and one that still leaves role-to-group mapping to you.

• Onboarding delays. New joiners wait for accounts, licences and group access while a ticket sits in a queue, losing productive days in their first week.

• Permissions that don’t keep up (privilege creep). When movers change position or cost center in OM, old access often stays attached, so people accumulate rights they no longer need.

• Forgotten offboarding. Accounts that aren’t disabled on time are both a security and audit risk, and unused licences keep costing money — and with a second PERNR it is easy to disable an account while another employment is still active.

Joinly vs. a self-built Logic Apps + Entra provisioning pipeline

For on-premise SAP HCM there is no ready-made Entra provisioning app, so the realistic alternative is the pipeline Microsoft documents: an Azure Logic Apps workflow calling BAPIs or receiving HRMD_A IDocs, feeding API-driven inbound provisioning. Here’s how that compares to Joinly.

Watch-outs when connecting SAP HCM to Microsoft Entra ID

A few SAP-HCM-specific details decide whether this connection stays reliable at scale.

• PERNR is not the person. A rehire, a second assignment or concurrent employment can give one individual more than one personnel number. A naive rule creates duplicate Entra ID accounts or drives the UPN from the wrong PERNR. Joinly applies explicit rules to tie the PERNRs to a single identity and pick the primary employment as the driver of the UPN.

• Infotype time constraints and effective dating. PA records carry a validity period (BEGDA/ENDDA), and a hire or transfer action is written well before it is effective. Reading the raw latest row instead of the currently-valid record provisions too early or too late. Joinly reads the effective-dated infotype and times account creation to the real start date.

• Mapping the OM position to Entra groups. Access is decided by the position and org unit in OM (IT0001 / HRP*), plus cost center, personnel area and employee group — none of which translate one-to-one to Entra ID groups. Joinly builds explicit mapping rules from those structures to the correct groups and licences, so role drives access rather than manual assignment.

• RFC/BAPI authorizations. The integration account needs authorization objects for the right BAPIs, RFCs and infotypes. Joinly works with a service user scoped to exactly the infotypes it reads, rather than a wide-open account, keeping the connection least-privilege.

• UPN format with duplicate names. When two employees share a name, a naive UPN rule produces collisions. Joinly applies custom transformation rules — a suffix, personnel-area code or controlled tiebreaker — so every UPN is unique and predictable from day one.

Joinly handles each of these by default with custom mapping and transformation.

Always audit-ready

Every account action Joinly performs is logged: who was affected, when it happened, which access changed and which SAP HCM change — the infotype and PERNR — triggered it. For NIS2 that matters directly: access can be traced back to an authorised HR source rather than an ad-hoc request. Joinly is ISO 27001 certified, runs in an EU data centre in Amsterdam, applies least-privilege by default, and is built to meet NIS2 and ISO 27001.

Example case

Picture an automotive and industrial group with around 8,000 employees across four plants, running SAP ERP HCM on-premise as its HR core while identity provisioning never quite keeps up. There is no native Entra app for on-prem HCM, so a half-finished Logic Apps workflow limps along: it calls a BAPI on a nightly schedule, but future-dated hires get created the moment HR saves the action rather than on the start date, engineers who pick up a second PERNR end up with a duplicate account, and role-to-group mapping is a spreadsheet nobody trusts.

Connect SAP HCM to Microsoft Entra ID with Joinly and that work disappears. Joinly reads each HR change in the PA infotypes at the source and acts on it automatically: new hires have their account, Office licence and group access ready on their effective start date, transfers between positions swap the right groups the same day, a second PERNR just adds access under one stable UPN, and leavers are disabled on the recorded leaving date with a 30-day soft-delete grace window.

“We had a Logic App nobody wanted to own. Now an account is simply ready on the start date, a second personnel number just adds access instead of a duplicate, and we can show the auditor exactly which SAP HCM action created every bit of access.” — Head of IT, automotive and industrial group

The outcome this setup is designed for: onboarding drops from days to zero touch, duplicate-PERNR errors stop entirely, and the team can walk into its next NIS2 assessment with a complete, source-backed audit trail.