How does Joinly sync Securex to Microsoft Entra ID?

Joinly reads each HR change from your Securex HR platform (Exact Officient) through the Officient REST API and applies it to the matching Entra ID account automatically. Officient holds the authoritative people, team and contract records, so it is the starting point for each identity action — while the payroll data that flows to your Securex sociaal-secretariaat advisor stays where it belongs.

1. Joiner. HR completes the hire in the Securex/Officient platform. Joinly reads the new person, their team, function and contract, and determines the role from those attributes. It then creates the account in Entra ID, assigns the right licences and maps the person into the correct groups — timed to the contract start date.

2. Mover. When someone changes function, team or department in Officient, Joinly updates their group membership, permissions and licences to match. Access that no longer fits the new role is revoked, so permissions stay aligned with the actual job.

3. Leaver. On the contract end date recorded in Officient, Joinly disables the Entra ID account automatically. There are no orphaned accounts left active after someone has left, and a soft-delete grace window keeps the account recoverable for a set period before it is retired.

Example: A Belgian services company runs its HR in the Securex/Officient platform and hires a project coordinator in the Antwerp team with a start date next Monday. Joinly reads the new person and contract, waits until the start date, creates the Entra ID account, assigns a Microsoft 365 licence and adds the coordinator to the BE-Projects group. Because the record is in French, Joinly applies its diacritic-safe UPN rule so the login is clean and unique from day one.

What manual user management costs

Without automation, every account starts as an email from HR or a line in a spreadsheet that IT works through by hand. Securex’s HR platform holds the people and contract data, but there is no first-party connector that turns a new hire in Officient into a provisioned Entra ID account — so the part that actually decides access still falls to people.

• Onboarding delays. New joiners wait for accounts, licences and group access while a request sits in a queue, losing productive days in their first week.

• Permissions that don’t keep up (privilege creep). When movers change function or team, old access often stays attached, so people accumulate rights they no longer need.

• Forgotten offboarding. Accounts that aren’t disabled on time are both a security and audit risk, and unused Microsoft 365 licences keep costing money after someone’s contract has ended.

Joinly vs. a custom Officient API integration

Securex has no native Entra ID provisioning connector, so the realistic alternative is scripting against the Officient REST API yourself or wiring it through a generic iPaaS. Here’s how that compares with Joinly for a Securex/Officient-driven setup.

Watch-outs when connecting Securex to Microsoft Entra ID

A few Securex-specific details decide whether this connection stays reliable at scale.

• Read HR, not the payroll batch. Securex runs two data planes: the live HR platform (Officient) and the payroll files that periodically go to your sociaal-secretariaat klantenadviseur. Provisioning should be driven by the live HR data, so Joinly reads the Officient REST API rather than any monthly payroll export.

• Bilingual NL/FR records. Depending on the region and entity, names, functions and team labels arrive in Dutch or French, often with accented characters. A naive UPN or display-name rule produces inconsistent or invalid logins. Joinly applies diacritic-safe transformation so every account is clean and predictable.

• Mapping teams and functions to Entra groups. Officient models a person through their team and function rather than a deep legal-entity hierarchy. Joinly builds explicit rules from teams and functions to the correct Entra ID groups and licences, so role drives access rather than manual assignment.

• Employee number availability. The linked payroll employee number is only exposed on certain Securex/Officient integrations. Joinly doesn’t assume it is present — it derives a stable identifier from the fields your tenant actually returns, so matching never breaks when the number is absent.

• UPN format with duplicate names. When two employees share a name, a naive UPN rule produces collisions. Joinly applies custom transformation rules — a suffix, team code or controlled tiebreaker — so every UPN is unique and predictable from day one.

Joinly handles each of these by default with custom mapping and transformation.

Always audit-ready

Every account action Joinly performs is logged: who was affected, when it happened, which access changed and which Securex change triggered it. For NIS2 that matters directly: access can be traced back to an authorised HR source rather than an ad-hoc request. Joinly is ISO 27001 certified, runs in an EU data centre in Amsterdam, applies least-privilege by default, and is built to meet NIS2 and ISO 27001.

Example case

Picture a Belgian care organisation with around 1,800 employees across a dozen residential and home-care sites, running its HR in the Securex/Officient platform while its identity provisioning never quite keeps up. HR enters each new carer, nurse or support worker in Officient, but IT still creates the Entra ID account by hand from an email — and with fixed-term contracts, bank staff and frequent team changes, the queue never empties. New joiners wait until day two or three for their Microsoft 365 access, and leavers on an expired contract sometimes keep an active account for weeks.

Connect Securex to Microsoft Entra ID with Joinly and that work disappears. Joinly reads each HR change in the Officient platform at the source and acts on it automatically: new carers have their account, licence and group access ready on their contract start date, a move to another team swaps the right groups the same day, French and Dutch records both produce a clean UPN, and leavers are disabled on their contract end date with a 30-day soft-delete grace window.

“Our carers used to lose their first days chasing a login. Now the account is simply ready on the start date, a team change updates access by itself, and we can show the auditor exactly which Securex change created every bit of access.” — Head of IT, care organisation

The outcome this setup is designed for: onboarding drops from days to zero touch, expired-contract accounts stop lingering, and the team can walk into its next NIS2 assessment with a complete, source-backed audit trail.