How does Joinly sync Yoobi to Microsoft Entra ID?

Joinly reads each employee change in Yoobi through the REST API and applies it to the matching Entra ID account automatically. Yoobi holds the authoritative employee and contract record, so it is the starting point for each identity action.

1. Joiner. HR completes the hire in Yoobi and the employee contract is set. Joinly reads the new employee and contract records through the REST API and determines the role from attributes like department and job function. It then creates the account in Entra ID, assigns the right licences and maps the person into the correct groups — timed to the contract start date.

2. Mover. When someone changes department, function or contract in Yoobi, Joinly updates their group membership, permissions and licences to match. Access that no longer fits the new role is revoked, so permissions stay aligned with the actual job.

3. Leaver. On the contract end date recorded in Yoobi, Joinly disables the Entra ID account automatically. There are no orphaned accounts left active after someone has left, and external or freelance records that should never have an account are excluded by rule.

Example: A professional-services firm hires a consultant in Yoobi with a contract starting next Monday, in its Advisory department. Joinly reads the contract record, waits until the start date, creates the Entra ID account, assigns a Microsoft 365 E3 licence and adds the consultant to the Advisory group. When that consultant later moves to the Delivery department, Joinly swaps the groups the same day without anyone raising a ticket.

What manual user management costs

Without automation, every account starts as a Yoobi export or a line in a spreadsheet that IT works through by hand. Yoobi has no native path to Entra ID, so unless you build and maintain custom middleware on the REST API yourself, the part that actually decides access still falls to people.

• Onboarding delays. New joiners wait for accounts, licences and group access while a ticket sits in a queue, losing productive days in their first week.

• Permissions that don’t keep up (privilege creep). When movers change department or function, old access often stays attached, so people accumulate rights they no longer need.

• Forgotten offboarding. Accounts that aren’t disabled on time are both a security and audit risk, and unused licences keep costing money — especially easy to miss when a contract simply expires in Yoobi without a ticket being raised.

Joinly vs. building it yourself on the Yoobi API

Yoobi ships no provisioning to Entra ID, so the realistic alternative is custom middleware or a generic iPaaS flow on the REST API. Here’s how that compares to Joinly for a Yoobi-driven setup.

Watch-outs when connecting Yoobi to Microsoft Entra ID

A few Yoobi-specific details decide whether this connection stays reliable at scale.

• Employees vs. external and freelance workers. Yoobi holds internal employees alongside external and freelance (ZZP) workers who book hours on projects. A naive sync would create Entra ID accounts for people who should never have one. Joinly filters on the employee and contract record so only genuine employees are provisioned.

• Contract record, not project assignment. In Yoobi a person’s identity is defined by the employee contract — department, function, start and end date — while project assignments only say what they book hours against. Joinly drives every account from the contract, so the home department, not a project, decides access.

• The API module and its permissions. The Yoobi REST API is an optional module activated per organisation, with permissions set per API user and object. Joinly needs read access to Employees and Employee contracts on your tenant subdomain; we help you scope a least-privilege API user during setup.

• Mapping department and function to Entra groups. Yoobi’s afdeling and functie don’t translate one-to-one to Entra ID groups. Joinly builds explicit mapping rules from those structures to the correct groups and licences, so role drives access rather than manual assignment.

• UPN format with duplicate names. When two employees share a name, a naive UPN rule produces collisions. Joinly applies custom transformation rules — a suffix, department code or controlled tiebreaker — so every UPN is unique and predictable from day one.

Joinly handles each of these by default with custom mapping and transformation.

Always audit-ready

Every account action Joinly performs is logged: who was affected, when it happened, which access changed and which Yoobi change triggered it. For NIS2 that matters directly: access can be traced back to an authorised HR source rather than an ad-hoc request. Joinly is ISO 27001 certified, runs in an EU data centre in Amsterdam, applies least-privilege by default, and is built to meet NIS2 and ISO 27001.

Example case

Picture a consultancy and professional-services agency with around 350 employees, running Yoobi for its employee administration, time registration and project billing while its identity management never quite keeps up. IT exports a list from Yoobi every so often and works through it by hand, but with freelancers booking hours alongside staff, and consultants moving between advisory and delivery teams, the list is always slightly wrong — external workers occasionally end up with accounts they shouldn’t have, and a consultant’s move to a new department takes days to reflect in their access.

Connect Yoobi to Microsoft Entra ID with Joinly and that work disappears. Joinly reads each employee change in Yoobi at the source and acts on it automatically: new hires have their account, Microsoft 365 licence and group access ready on their contract start date, moves between departments swap the right groups the same day, freelancers are excluded by rule, and leavers are disabled on their contract end date with a soft-delete grace window.

“The messy part was always telling staff apart from freelancers and keeping department moves current. Now an account is simply ready on the start date, a move just swaps the groups, and we can show exactly which Yoobi change created every bit of access.” — Head of IT, professional-services agency

The outcome this setup is designed for: onboarding drops from days to zero touch, external workers never get accounts by accident, and the team can walk into its next NIS2 assessment with a complete, source-backed audit trail.