AFAS integrate with (Azure) Active Directory

Joinly uses AFAS as the source and (Azure) Active Directory as the destination. When someone joins in AFAS, Joinly creates the account in (Azure) Active Directory and puts the right groups and permissions on it. When the job changes, the permissions move with it. When someone leaves, the account is deactivated. Nothing for you to do, and nothing for you to remember.

That is exactly what it is for. Joinly reaches your on-premises Active Directory through the Joinly Agent: a lightweight service in your own network that connects outbound. No inbound port has to be opened and no VPN is needed. Hybrid organisations get the same automation as cloud-only customers.

The AD account in the right OU, with name, UPN, email address, employee number, manager and whichever attributes you put in the mapping, plus membership of your on-premises groups. On a hybrid Exchange, Joinly can create the remote mailbox as well.

From roles, not from a per-person list. You record once which roles belong to which job, department or location, and which access items sit inside those roles — groups, licences, applications, folders. A role change in AFAS makes Joinly recalculate: what belongs is added, what no longer belongs is removed.

Yes. The same source in AFAS can feed both your on-premises Active Directory and Microsoft Entra ID. Joinly reaches Entra ID directly over Microsoft Graph, with its own app registration in your tenant.

That is yours to set with the import schedule: hourly, daily or weekly, at a time you choose. As soon as the import lands, Joinly works out the consequences and provisioning to (Azure) Active Directory can run straight after it. An overnight import means, in practice, that the account is ready the next morning.

On the date from AFAS, Joinly revokes the access: the account in (Azure) Active Directory is switched off, group memberships and permissions lapse, and connected applications are taken along. Whatever else has to happen — releasing a licence, converting the mailbox to shared, informing the manager — is arranged as a workflow, so it is part of the same process instead of a loose task.

Not unasked. Joinly first imports what is in (Azure) Active Directory and matches those accounts to the employees from AFAS. Existing accounts are recognised and adopted rather than created twice; which matching strategy applies — person identifier, employee number or UPN — is yours to choose. Accounts that are not employees, such as service accounts, can be filtered out of the integration.

Yes. You run the import as a dry run and get an Excel export of exactly what would happen, without anything being written. A threshold then keeps protecting you: if the source delivers more new, activated or deactivated employees in one run than you allowed, Joinly blocks the run.

Access to your AFAS environment for the employee data, and the Joinly Agent on a server in your own network. It only connects outbound, so there is no inbound firewall rule to open and no VPN to set up.

Joinly is ISO27001-certified. Every change is recorded, so per employee you can look back at which access was granted when, on the basis of which role, and when it was revoked again. That is precisely what an auditor or a NIS2 assessment asks of you.

The integration is part of the subscription — you pay per account per month, not per connector or per target system. The pricing page shows what the plans cost and what each one includes.