How does Joinly sync a3innuva to Active Directory?

Joinly reads each HR change in a3innuva Nómina in the cloud through the CONECTIA API, then hands the action to the Joinly AD Agent inside your network, which makes the change in Active Directory. a3innuva holds the authoritative labour record; the agent is the only component that touches your domain.

1. Joiner. The payroll team — or the asesoría — completes the alta in a3innuva. Joinly reads the new empleado record, determines the role from empresa, centro de trabajo, categoría and centro de coste, and instructs the AD Agent to create the user in the correct OU, build the sAMAccountName and UPN from your rules, and add the right security groups — timed to the contract start date.

2. Mover. When someone changes centro de trabajo, categoría or empresa, Joinly tells the agent to move the user to the matching OU, swap security-group membership and update attributes. Access that no longer fits the new role is removed, so permissions stay aligned with the actual job.

3. Leaver. On the baja (termination) date, Joinly instructs the agent to disable the AD account and optionally move it to a disabled-users OU. The change is traced back to the exact a3innuva record that triggered it.

Example: A regional wholesaler runs a3innuva Nómina and an on-premise AD across three branches. It hires a warehouse clerk with a start date next Monday in its Valencia centro de trabajo. Joinly reads the new empleado record over CONECTIA, and on Monday morning the AD Agent creates the user in the Valencia > Warehouse OU, sets a unique sAMAccountName, and adds the Warehouse-Ops group. When the clerk later moves to the sales desk, the agent moves the object to the new OU and swaps the groups the same day.

What manual AD account management costs

Without automation, every account starts as a message from the payroll team or the asesoría that an admin works through in Active Directory Users and Computers by hand — creating the object, choosing the OU, building the sAMAccountName, adding groups. Because a3innuva has no native connector to AD, the only alternative is a custom CONECTIA-API script you build and maintain, so the decisions still fall to people.

• Onboarding delays. New joiners wait for an AD account and group access while a message from the asesoría sits in a queue, losing productive days in their first week.

• Permissions that don’t keep up (privilege creep). When people move between centros de trabajo, old security-group membership often stays attached, so they accumulate rights they no longer need.

• Forgotten offboarding. Accounts that aren’t disabled on time are a security and audit risk — especially when the baja is processed by an external accountant and never reaches IT.

Joinly vs. a custom a3innuva-to-AD integration

There is no native Microsoft or a3innuva connector that writes a3innuva data to on-premise AD, so the honest comparison is against a custom integration built on the CONECTIA REST API. That baseline can move attributes, but it stops short of the part that actually decides access — and you own the maintenance.

Watch-outs when connecting a3innuva to Active Directory

A few details decide whether this connection stays reliable at scale.

• sAMAccountName uniqueness and length. AD limits the sAMAccountName to 20 characters and it must be unique across the domain. Joinly builds it from your rules with a fallback pattern, so duplicate Spanish surnames never produce a collision or a truncated, unreadable login.

• OU placement from empresa / centro de trabajo. a3innuva’s empresa, centro de trabajo and categoría don’t map one-to-one to your OU structure. Joinly builds explicit rules that place each user — and move them on a change — into the correct OU.

• Data is often administered by an asesoría. For many a3innuva clients the payroll runs through an external accounting firm, so the CONECTIA credentials sit between the company and its gestoría. Joinly connects through a scoped Wolters Kluwer Account access profile, so the company gets its AD automation without the asesoría losing control of the data.

• Payroll-first data, so email / UPN may be derived. a3innuva is built around Spanish payroll, so a corporate email or UPN may be absent on the empleado record. Joinly derives the UPN, mail and sAMAccountName from nombre, apellidos and empresa with a uniqueness fallback.

• Service-account permissions. The agent acts under a service account with delegated rights. Joinly works with least-privilege delegation scoped to the target OUs, so the agent can create, move and disable users without domain-admin rights.

Joinly handles each of these by default with custom mapping and transformation.

Always audit-ready

Every account action the Joinly AD Agent performs is logged in the Joinly cloud: who was affected, when it happened, which OU and groups changed and which a3innuva change triggered it. For NIS2 that matters directly: access can be traced back to an authorised HR source rather than an ad-hoc request from the payroll team or the asesoría. Joinly is ISO 27001 certified, runs in an EU data centre in Amsterdam, applies least-privilege by default, and is built to meet NIS2 and ISO 27001.

Example case

Take a regional wholesaler with around 300 employees across three branches, running a3innuva Nómina for payroll but still living in an on-premise Active Directory for its warehouse and ERP systems. Every new picker, driver or sales clerk starts as an alta in a3innuva that IT processes by hand in AD — creating the object, choosing the OU for the right branch, building the login, adding groups. With seasonal peaks and frequent moves between branches the queue never empties, and new joiners wait until day two or three for their account.

Connect a3innuva to Active Directory with Joinly and that work disappears. The Joinly AD Agent creates each user in the right OU on the start date, builds a unique sAMAccountName, adds the correct security groups, moves people when they change centro de trabajo and disables accounts on the baja date with a 30-day grace window — all driven by the HR change read from a3innuva over the CONECTIA API.

“A warehouse account is simply ready in the right branch OU when the clerk walks in, moves between branches sort themselves out, and we can show the auditor exactly which a3innuva change created every bit of access.” — Head of IT, wholesale distributor

The outcome this setup is designed for: onboarding drops from days to zero touch, privilege creep from old branch roles is eliminated, and the team can walk into its next NIS2 assessment with a complete, source-backed audit trail.