How does Joinly sync Talentech to Microsoft Entra ID?

Joinly reads each HR change from the Talentech REST API — using OAuth 2.0 client-credentials access scoped to the HR master-data records — and applies it to the matching Entra ID account automatically. Talentech holds the authoritative employee record, so it is the starting point for each identity action.

1. Joiner. HR confirms the hire in Talentech and the employee record lands in HR master data. Joinly reads that record, determines the role from attributes like department, job title and location, then creates the account in Entra ID, assigns the right licences and maps the person into the correct groups — timed to the confirmed start date, not the moment a preboarding journey begins.

2. Mover. When someone changes department, role or location in Talentech, Joinly updates their group membership, permissions and licences to match. Access that no longer fits the new position is revoked, so permissions stay aligned with the actual job.

3. Leaver. On the leaving date recorded in Talentech, Joinly disables the Entra ID account automatically. There are no orphaned accounts left active after someone has left, and licences are freed instead of quietly renewing.

Example: A digital media agency hires a content producer in Talentech with a start date next Monday. The candidate went through the Talent Recruiter ATS and a preboarding journey the week before, but Joinly waits for the confirmed HR master-data record and the real start date. On Monday morning it creates the Entra ID account, assigns a Microsoft 365 E3 licence and adds the producer to the Studio-Content group — while a candidate who never signed stays exactly that: a candidate, with no account created.

What manual user management costs

Without automation, every account starts as a Talentech notification or an onboarding hand-off that IT works through by hand. Because Talentech has no off-the-shelf Entra provisioning connector, teams often fall back to a generic API-driven or middleware build that can move attributes across but has no idea which module holds the real employee or how a department maps to a group — so the part that actually decides access still falls to people.

• Onboarding delays. New joiners wait for accounts, licences and group access while an onboarding hand-off sits in a queue, losing productive days in their first week.

• Permissions that don’t keep up (privilege creep). When movers change department or location, old access often stays attached, so people accumulate rights they no longer need.

• Forgotten offboarding. Accounts that aren’t disabled on time are both a security and audit risk, and unused licences keep costing money long after someone has left.

Joinly vs. generic API-driven provisioning

Talentech has no native Entra ID inbound-provisioning app, so the native path is Entra’s generic API-driven inbound provisioning or a middleware build against the Talentech REST APIs. That’s a fine transport layer, but it stops short of the part that actually decides access. Here’s how the two compare for a Talentech HR-driven setup.

Watch-outs when connecting Talentech to Microsoft Entra ID

A few Talentech-specific details decide whether this connection stays reliable at scale.

• Read the right module. Talentech is a suite: the Talent Recruiter ATS holds candidates, the onboarding module holds preboarding journeys, and the HR area holds the confirmed employee ‘Master Data’. Only the last is the identity source of truth. Joinly reads the HR master-data records, so candidates and unfinished onboarding never turn into live accounts.

• Preboarding starts before day one. Talentech engages new hires with preboarding before their first working day, so an employee-like record can exist well ahead of the start date. Joinly keys account creation to the confirmed start date rather than the opening of a preboarding journey, so access is ready on the right day and not before.

• Scopes across multiple product APIs. Talentech’s REST access is split across product APIs (Talent Manager, Talent Recruiter, Reachmee) with per-endpoint scopes on the OAuth client. Joinly requests only the scopes needed to read the HR master-data records, keeping the integration least-privilege and pointed at the right data.

• Mapping department and role to Entra groups. Talentech’s department, role and location fields don’t translate one-to-one to Entra ID groups. Joinly builds explicit mapping rules from those attributes to the correct groups and licences, so role drives access rather than manual assignment.

• UPN format with duplicate names. When two employees share a name, a naive UPN rule produces collisions. Joinly applies custom transformation rules — a suffix, location code or controlled tiebreaker — so every UPN is unique and predictable from day one.

Joinly handles each of these by default with custom mapping and transformation.

Always audit-ready

Every account action Joinly performs is logged: who was affected, when it happened, which access changed and which Talentech change triggered it. For NIS2 that matters directly: access can be traced back to an authorised HR source rather than an ad-hoc request. Joinly is ISO 27001 certified, runs in an EU data centre in Amsterdam, applies least-privilege by default, and is built to meet NIS2 and ISO 27001.

Example case

Picture a fast-growing digital media and technology group with around 900 employees across three countries, running Talentech end to end — Talent Recruiter for hiring, an onboarding journey for every new starter, and the HR area as its employee record. Account creation, though, still runs on hand-offs: an onboarding coordinator emails IT, IT reads the wrong screen, and every so often a candidate who never signed ends up with a half-provisioned account while a genuine hire waits until day two for theirs.

Connect Talentech to Microsoft Entra ID with Joinly and that work disappears. Joinly reads each HR change from the Talentech master-data API at the source and acts on it automatically: confirmed hires have their account, Microsoft 365 licence and group access ready on their real start date, movers between teams swap the right groups the same day, and leavers are disabled on their leaving date with a 30-day soft-delete grace window. Candidates and preboarding journeys never turn into accounts, because Joinly only ever reads the confirmed employee record.

“We used to provision from whatever screen was open, which meant candidates sometimes got accounts and real hires waited. Now an account is simply ready on the start date, and we can show exactly which Talentech record created every bit of access.” — Head of IT, digital media group

The outcome this setup is designed for: onboarding drops from days to zero touch, candidate records never leak into Entra ID, and the team can walk into its next NIS2 assessment with a complete, source-backed audit trail.