How does Joinly sync Zucchetti to Microsoft Entra ID?

Joinly reads each HR change in HR Infinity through the Zucchetti API and applies it to the matching Entra ID account automatically. The Zucchetti employee master (anagrafica dipendente) holds the authoritative record, so it is the starting point for each identity action.

1. Joiner. HR completes the hire in HR Infinity. Joinly reads the new employee record and determines the role from attributes like the organizational unit, cost center and job title. It then creates the account in Entra ID, assigns the right licences and maps the person into the correct groups — matched on the matricola so there is no duplicate.

2. Mover. When someone changes organizational unit, cost center or role in HR Infinity, Joinly updates their group membership, permissions and licences to match. Access that no longer fits the new position is revoked, so permissions stay aligned with the actual job.

3. Leaver. On the cessazione (termination) date recorded in Zucchetti’s payroll, Joinly disables the Entra ID account automatically. There are no orphaned accounts left active after someone has left, and the payroll end date — not a rough manual entry — drives the exact moment access is removed.

Example: An Italian manufacturer hires a production planner in HR Infinity, assigned to the Stabilimento Nord organizational unit under a metalworking CCNL. Joinly reads the record, creates the Entra ID account, assigns an Office E3 licence and adds the planner to the Operations-Nord group — matched on the matricola. When that planner later transfers to a different centro di costo, Joinly swaps the groups the same day without breaking sign-in.

What manual user management costs

Without automation, every account starts as a Zucchetti ticket or a line in a spreadsheet that IT works through by hand. Microsoft’s generic HR-driven inbound provisioning can move attributes across, but it has no understanding of Zucchetti’s organizational model, matricola or CCNL and maps roles to groups through manual rules — so the part that actually decides access still falls to people.

• Onboarding delays. New joiners wait for accounts, licences and group access while a ticket sits in a queue, losing productive days in their first week.

• Permissions that don’t keep up (privilege creep). When movers change organizational unit or cost center, old access often stays attached, so people accumulate rights they no longer need.

• Forgotten offboarding. Accounts that aren’t disabled on time are both a security and audit risk, and unused licences keep costing money — and a leave date entered by hand rarely matches the real payroll cessazione date.

Joinly vs. native Entra HR-driven provisioning

Microsoft’s generic HR-driven / API-driven inbound provisioning is a fine baseline, but it stops short of the part that actually decides access. Here’s how the two compare for an HR Infinity-driven setup.

Watch-outs when connecting Zucchetti to Microsoft Entra ID

A few Zucchetti-specific details decide whether this connection stays reliable at scale.

• Matricola as the matching key. In Zucchetti the matricola (payroll employee number) is the stable identifier, not an email address. Joinly matches people on the matricola, so rehires and name changes attach to the right existing account instead of creating a duplicate.

• Modular suite and the authoritative record. HR Infinity is modular — Paghe (payroll), Presenze (attendance), Workflow — and the same person can appear in more than one module. Joinly pins the authoritative record and the organizational unit before mapping, so access is driven by the right source data.

• Mapping the organizational model to Entra groups. Unità organizzativa and centro di costo are separate hierarchies and neither maps one-to-one to Entra ID groups. Joinly builds explicit mapping rules from those structures to the correct groups and licences, so role drives access rather than manual assignment.

• CCNL-driven dates. Contract type and the payroll calendar (start date, cessazione) come from the CCNL rather than a simple leave field. Joinly reads the real payroll dates, so access starts and ends on the right day.

• UPN format with duplicate names. When two employees share a name, a naive UPN rule produces collisions. Joinly applies custom transformation rules — a suffix, a code or the matricola as a controlled tiebreaker — so every UPN is unique and predictable from day one.

Joinly handles each of these by default with custom mapping and transformation.

Always audit-ready

Every account action Joinly performs is logged: who was affected, when it happened, which access changed and which Zucchetti change triggered it. For NIS2 that matters directly: access can be traced back to an authorised HR source rather than an ad-hoc request. Joinly is ISO 27001 certified, runs in an EU data centre in Amsterdam, applies least-privilege by default, and is built to meet NIS2 and ISO 27001.

Example case

Picture an Italian manufacturer with around 3,500 employees across four plants, running HR Infinity as its HR core while its identity provisioning never quite keeps up. A generic connector handles the simple cases, yet the modular split between Paghe and Presenze, transfers between organizational units and matching on anything other than the matricola keep breaking it — rehired seasonal staff end up with duplicate accounts, and leavers stay active because a manual leave date never matched the real cessazione.

Connect Zucchetti to Microsoft Entra ID with Joinly and that work disappears. Joinly reads each HR change in HR Infinity at the source and acts on it automatically: new hires have their account, Office licence and group access ready on their start date, transfers between organizational units swap the right groups the same day, rehires reattach to the existing account on the matricola, and leavers are disabled on their payroll cessazione date with a 30-day soft-delete grace window.

“Matching on the matricola and the real payroll dates fixed the two things that broke every sync. Now an account is simply ready on the start date, a transfer just swaps the groups, and we can show the auditor exactly which Zucchetti change created every bit of access.” — Head of IT, Italian manufacturer

The outcome this setup is designed for: onboarding drops from days to zero touch, duplicate-account and stale-leaver errors stop entirely, and the team can walk into its next NIS2 assessment with a complete, source-backed audit trail.