How does Joinly sync Youforce to Microsoft Entra ID?

Joinly reads each HR change from Youforce through the IAM API and applies it to the matching Entra ID account automatically. Youforce — running on HR Core Beaufort or HR Core Business — holds the authoritative employment record, so it is the starting point for each identity action.

1. Joiner. HR completes the hire in Youforce. Joinly reads the new Person, Employment and Assignment records, determines the role from the job profile, organization unit and role assignment, then creates the account in Entra ID, assigns the right licences and maps the person into the correct groups — timed to the employment start date.

2. Mover. When someone changes job profile, organization unit or manager in Youforce, Joinly updates their group membership, permissions and licences to match. Access that no longer fits the new position is revoked, so permissions stay aligned with the actual job.

3. Leaver. On the employment end date recorded in Youforce, Joinly disables the Entra ID account automatically. There are no orphaned accounts left active after someone has left, and a soft-delete grace window keeps the account recoverable for a set period.

Example: A Dutch organisation runs Youforce on HR Core Beaufort and hires a policy advisor with a start date next Monday. Joinly reads the employment record, waits until the start date, creates the Entra ID account, assigns an Office E3 licence and adds the advisor to the group that matches their organization unit and job profile. When that person later transfers to another department, Joinly reads the new assignment and swaps the groups the same day, without anyone raising a ticket.

What manual user management costs

Without automation, every account starts as a Youforce export or a ticket that IT works through by hand. A generic IAM connector on the Youforce IAM API can pull the data across, but it maps roles to groups through rules you configure yourself and leaves future-dating and the Beaufort-vs-Business field differences to be handled manually — so the part that actually decides access still falls to people.

• Onboarding delays. New joiners wait for accounts, licences and group access while a ticket sits in a queue, losing productive days in their first week.

• Permissions that don’t keep up (privilege creep). When movers change job profile or organization unit, old access often stays attached, so people accumulate rights they no longer need.

• Forgotten offboarding. Accounts that aren’t disabled on time are both a security and audit risk, and unused licences keep costing money.

Joinly vs. a generic Youforce IAM connector

There is no first-party Microsoft provisioning app for Youforce, so the usual alternative is a generic IAM middleware on the Youforce IAM API or a legacy file import. Either reads the same data, but stops short of the part that actually decides access. Here’s how the two compare for a Youforce-driven setup.

Watch-outs when connecting Youforce to Microsoft Entra ID

A few Youforce-specific details decide whether this connection stays reliable at scale.

• HR Core Beaufort vs HR Core Business fields. The two HR cores expose different field sets — company and cost center, for example, are not available for HR Core Beaufort. Joinly builds the mapping against the core the customer actually runs, so nothing silently maps to an empty attribute.

• Scheduled refresh, not per-event push. Youforce delivers changes on a scheduled IAM API refresh rather than an event-by-event webhook, and future-dated changes come through ahead of time. Joinly polls the modified records and times each action — including future-dated hires — to the employment start and end dates instead of the moment HR saved the record.

• Manager and hierarchy from RoleAssignment. Youforce expresses manager and organisational hierarchy through RoleAssignment and OrganizationUnit rather than a single manager field. Joinly resolves those relationships so the manager attribute and group mapping reflect the real reporting line.

• Mapping job profile and organization unit to Entra groups. Job profile and organization unit don’t translate one-to-one to Entra ID groups. Joinly builds explicit mapping rules from those structures to the correct groups and licences, so role drives access rather than manual assignment.

• UPN format with duplicate names. When two employees share a name, a naive UPN rule produces collisions. Joinly applies custom transformation rules — a suffix, org-unit code or controlled tiebreaker — so every UPN is unique and predictable from day one.

Joinly handles each of these by default with custom mapping and transformation.

Always audit-ready

Every account action Joinly performs is logged: who was affected, when it happened, which access changed and which Youforce change triggered it. For NIS2 that matters directly: access can be traced back to an authorised HR source rather than an ad-hoc request. Joinly is ISO 27001 certified, runs in an EU data centre in Amsterdam, applies least-privilege by default, and is built to meet NIS2 and ISO 27001.

Example case

Picture a provincial government body with around 3,500 employees across several departments and agencies, running Youforce on HR Core Beaufort as its HR core while its identity provisioning never quite keeps up. A generic connector handles the simple cases, yet secondments between departments, temporary appointments and a steady stream of role changes keep breaking it — new advisors are provisioned the moment HR saves the record rather than on their actual start date, and manager relationships that live in role assignments never make it cleanly into Entra ID.

Connect Youforce to Microsoft Entra ID with Joinly and that work disappears. Joinly reads each HR change from the Youforce IAM API at the source and acts on it automatically: new hires have their account, Office licence and group access ready on their employment start date, transfers between organization units swap the right groups the same day, the manager attribute is resolved from the role assignment, and leavers are disabled on their end date with a 30-day soft-delete grace window.

“Our reorganisations and secondments used to break every sync. Now an account is simply ready on the start date, a transfer just swaps the groups, and we can show the auditor exactly which Youforce change created every bit of access.” — Head of IT, provincial government body

The outcome this setup is designed for: onboarding drops from days to zero touch, privilege creep from old roles is eliminated, and the team can walk into its next NIS2 assessment with a complete, source-backed audit trail.