How does Joinly sync a3innuva to Microsoft Entra ID?

Joinly reads each HR change in a3innuva Nómina through the CONECTIA REST API and applies it to the matching Entra ID account automatically. a3innuva holds the authoritative labour and payroll record, so it is the starting point for each identity action.

1. Joiner. The payroll team — or the asesoría — completes the alta in a3innuva Nómina. Joinly reads the new empleado record and determines the role from attributes like empresa, centro de trabajo, categoría and centro de coste. It then creates the account in Entra ID, assigns the right licences and maps the person into the correct groups — timed to the contract start date.

2. Mover. When someone changes centro de trabajo, categoría or empresa in a3innuva, Joinly updates their group membership, permissions and licences to match. Access that no longer fits the new role is revoked, so permissions stay aligned with the actual job.

3. Leaver. On the baja (termination) date recorded in a3innuva, Joinly disables the Entra ID account automatically. There are no orphaned accounts left active after someone has left, and the change is traced back to the exact a3innuva record that triggered it.

Example: A professional-services firm runs a3innuva Nómina and hires a consultant with a start date next Monday, in its Madrid centro de trabajo. Joinly reads the new empleado record over CONECTIA, creates the Entra ID account, assigns a Microsoft 365 licence and adds the consultant to the Madrid-Consulting group — all on the start date, with no ticket and no manual export.

What manual user management costs

Without automation, every account starts as an email from the payroll team or the asesoría, then a line in a spreadsheet that IT works through by hand. Because a3innuva has no native Entra connector, the only alternatives are a custom CONECTIA-API integration you build and maintain, or a manual export-and-import — so the part that actually decides access still falls to people.

• Onboarding delays. New joiners wait for accounts, licences and group access while a message from the asesoría sits in a queue, losing productive days in their first week.

• Permissions that don’t keep up (privilege creep). When people move between centros de trabajo or change categoría, old access often stays attached, so they accumulate rights they no longer need.

• Forgotten offboarding. Accounts that aren’t disabled on time are both a security and audit risk, and unused Microsoft 365 licences keep costing money — especially when the baja is processed by an external accountant and never reaches IT.

Joinly vs. a custom a3innuva CONECTIA integration

There is no Microsoft-native provisioning app for a3innuva, so the honest comparison is against a custom integration built on the CONECTIA REST API (or a manual export). That baseline can move attributes across, but it stops short of the part that actually decides access — and you own the maintenance.

Watch-outs when connecting a3innuva to Microsoft Entra ID

A few a3innuva-specific details decide whether this connection stays reliable at scale.

• Data is often administered by an asesoría. For many a3innuva clients the payroll runs through an external accounting firm on the asesoría edition, so the CONECTIA credentials and data ownership sit between the company and its gestoría. Joinly connects through a scoped Wolters Kluwer Account access profile, so the company gets its identity automation without the asesoría losing control of the payroll data.

• CONECTIA is a paid add-on, not on by default. a3innuva does not expose a native identity/SCIM connector, and the CONECTIA API has to be activated per Wolters Kluwer Account. Joinly is built to consume CONECTIA directly, so you don’t have to build and host an integration to get provisioning working.

• Payroll-first data, so email / UPN may be derived. a3innuva is built around Spanish payroll and labour compliance, so a corporate email or UPN may be secondary or absent on the empleado record. Joinly builds the UPN and mail from your own rules — from nombre, apellidos and empresa — with a uniqueness fallback so every login is predictable from day one.

• Mapping empresa / centro de trabajo / categoría to Entra groups. a3innuva’s Spanish org structure — empresa, centro de trabajo, convenio colectivo, categoría, centro de coste — doesn’t translate one-to-one to Entra ID groups. Joinly builds explicit mapping rules from those structures to the correct groups and licences, so role drives access rather than manual assignment.

Joinly handles each of these by default with custom mapping and transformation.

Always audit-ready

Every account action Joinly performs is logged: who was affected, when it happened, which access changed and which a3innuva change triggered it. For NIS2 that matters directly: access can be traced back to an authorised HR source rather than an ad-hoc request from the payroll team or the asesoría. Joinly is ISO 27001 certified, runs in an EU data centre in Amsterdam, applies least-privilege by default, and is built to meet NIS2 and ISO 27001.

Example case

Picture an accountancy firm — an asesoría — with around 40 staff of its own and a growing IT footprint, running a3innuva Nómina both for its own payroll and on behalf of dozens of client companies. Its own onboarding is the neglected case: when the firm hires a new labour consultant or trainee, the alta goes into a3innuva but the Microsoft 365 account, group access and licence are created by hand, days later, whenever someone in IT gets to it. Leavers are worse — a departure is processed in payroll but the mailbox and Teams access can stay live for weeks.

Connect a3innuva to Microsoft Entra ID with Joinly and that work disappears. Joinly reads each HR change in a3innuva at the source over the CONECTIA API and acts on it automatically: new hires have their account, Microsoft 365 licence and group access ready on their start date, a move to a different centro de trabajo swaps the right groups the same day, and leavers are disabled on their baja date with a 30-day soft-delete grace window.

“We build integrations for our clients all day, but our own a3innuva-to-Microsoft link was always a manual job nobody owned. Now an account is simply ready on the start date, disabled on the leave date, and we can show exactly which a3innuva change created every bit of access.” — Head of IT, accountancy firm (asesoría)

The outcome this setup is designed for: onboarding drops from days to zero touch, forgotten leaver accounts stop entirely, and the firm can walk into its next audit with a complete, source-backed trail from a3innuva to Entra ID.