How does Joinly sync Silae to Microsoft Entra ID?

Joinly reads each HR change in the Silae dossier through the Silae Paie REST API and applies it to the matching Entra ID account automatically. Silae holds the authoritative employment record — the emploi — so it is the starting point for each identity action.

1. Joiner. The payroll team enters the new salarie in Silae. Joinly reads the fiche salarie and its emploi through the API and determines the role from attributes like etablissement, job title and department. It then creates the account in Entra ID, assigns the right licences and maps the person into the correct groups — timed to the start date on the record.

2. Mover. When someone changes job, department or etablissement in Silae, a new emploi record is generated. Joinly reads it and updates group membership, permissions and licences to match. Access that no longer fits the new position is revoked, so permissions stay aligned with the actual job.

3. Leaver. Silae is payroll-first and does not push a leaver event, so Joinly derives the exit from the employment record — the date de sortie — and disables the Entra ID account on that date automatically. There are no orphaned accounts left active after someone has left.

Example: An accountancy firm running Silae hires a payroll assistant with a start date next Monday, attached to its Lyon etablissement. Joinly reads the new emploi, waits until the start date, creates the Entra ID account, assigns a Microsoft 365 licence and adds the assistant to the Lyon-Payroll group. When that assistant later moves to the audit team, Joinly reads the new emploi, swaps the groups and updates the job title the same day — no ticket, no manual edit.

What manual user management costs

Without automation, every account starts as a message from the payroll team or a line in a spreadsheet that IT works through by hand. Silae exposes a clean REST API, but on its own that API just returns data: it has no role-to-group logic, no lifecycle timing and no leaver event — so the part that actually decides access still falls to people.

• Onboarding delays. New joiners wait for accounts, licences and group access while a request sits in a queue, losing productive days in their first week.

• Permissions that don’t keep up (privilege creep). When movers change job or etablissement, old access often stays attached, so people accumulate rights they no longer need.

• Forgotten offboarding. Because Silae never sends a leaver event, an exit can slip past IT entirely — the account stays active, which is both a security and audit risk, and unused licences keep costing money.

Joinly vs. a custom Silae API integration

Silae has no Microsoft-native inbound provisioning app, so the realistic alternative is building on the Silae Paie REST API yourself or wiring it through a generic middleware. That gets you the data; it does not get you the decisions. Here’s how the two compare.

Watch-outs when connecting Silae to Microsoft Entra ID

A few Silae-specific details decide whether this connection stays reliable at scale.

• Partner-administered, per-dossier API access. API access on a Silae dossier is opened by your expert-comptable or Silae partner, not by you directly, and it is scoped per dossier with a subscription key. Joinly is built to work with that model: you request access from your firm once, and Joinly reads only the dossiers you authorise.

• No native leaver event. Silae is a payroll platform and does not emit an offboarding trigger. Joinly reads the employment record and derives the exit (date de sortie), then disables the Entra ID account on that date, so leavers are handled reliably even though the source never announces them.

• The emploi record and the matricule. Each payroll-impacting change generates a new emploi record, and the matricule is not a stable identifier on its own. Joinly matches on the durable person identity rather than the matricule, so a job change or a re-keyed matricule never creates a duplicate account.

• Mapping etablissement and job to Entra groups. Etablissement, societe and job title don’t translate one-to-one to Entra ID groups. Joinly builds explicit mapping rules from those structures to the correct groups and licences, so role drives access rather than manual assignment.

• UPN format with duplicate names. When two salaries share a name, a naive UPN rule produces collisions. Joinly applies custom transformation rules — a suffix, etablissement code or controlled tiebreaker — so every UPN is unique and predictable from day one.

Joinly handles each of these by default with custom mapping and transformation.

Always audit-ready

Every account action Joinly performs is logged: who was affected, when it happened, which access changed and which Silae change triggered it. For NIS2 that matters directly: access can be traced back to an authorised HR source rather than an ad-hoc request. Joinly is ISO 27001 certified, runs in an EU data centre in Amsterdam, applies least-privilege by default, and is built to meet NIS2 and ISO 27001.

Example case

Picture an accountancy and advisory firm with around 900 staff across eight offices, running Silae as its payroll core while its identity provisioning never quite keeps up. Because Silae is administered through the firm’s own payroll team and access is opened per dossier, IT only hears about a new joiner when someone forwards a message — and it never hears about a leaver at all, because payroll simply closes the emploi. New consultants wait until day two or three for an account, and closed contracts linger in Entra ID for weeks.

Connect Silae to Microsoft Entra ID with Joinly and that work disappears. Joinly reads each change in the Silae dossier at the source and acts on it automatically: new hires have their account, Microsoft 365 licence and group access ready on their start date, a move to another office or team swaps the right groups the same day, and leavers are disabled on the derived date de sortie with a 30-day soft-delete grace window.

“The thing that used to catch us was leavers — payroll just closed the contract and nobody told IT. Now the account disables itself on the exit date, and we can show exactly which Silae change created every bit of access.” — Head of IT, accountancy firm

The outcome this setup is designed for: onboarding drops from days to zero touch, dormant accounts after an exit stop entirely, and the team can walk into its next NIS2 assessment with a complete, source-backed audit trail.