AFAS integration with Entra ID

Joinly uses AFAS as the source and Microsoft Entra ID as the destination. When someone joins in AFAS, Joinly creates the account in Microsoft Entra ID and puts the right groups and permissions on it. When the job changes, the permissions move with it. When someone leaves, the account is deactivated. Nothing for you to do, and nothing for you to remember.

Entra provisioning is good at executing, but it does not decide who should get what. Joinly puts that governance on top: roles and a permission matrix, approvals, temporary access with an end date, several HR sources side by side, and an audit trail per change. Entra executes; Joinly decides.

The user account with name, UPN, email address, employee number, manager and whichever attributes you put in the mapping, plus group memberships and licences. Joinly can also enable and disable an account, reset a password or MFA, issue a Temporary Access Pass, revoke sessions and, on departure, set an out-of-office or clear the calendar.

From roles, not from a per-person list. You record once which roles belong to which job, department or location, and which access items sit inside those roles — groups, licences, applications, folders. A role change in AFAS makes Joinly recalculate: what belongs is added, what no longer belongs is removed.

Yes. The same source in AFAS can feed both Entra ID and an on-premises Active Directory, so cloud and on-premise follow the same truth. Joinly reaches the on-premises side through the Joinly Agent, which connects outbound — no inbound port, no VPN.

That is yours to set with the import schedule: hourly, daily or weekly, at a time you choose. As soon as the import lands, Joinly works out the consequences and provisioning to Microsoft Entra ID can run straight after it. An overnight import means, in practice, that the account is ready the next morning.

On the date from AFAS, Joinly revokes the access: the account in Microsoft Entra ID is switched off, group memberships and permissions lapse, and connected applications are taken along. Whatever else has to happen — releasing a licence, converting the mailbox to shared, informing the manager — is arranged as a workflow, so it is part of the same process instead of a loose task.

Not unasked. Joinly first imports what is in Microsoft Entra ID and matches those accounts to the employees from AFAS. Existing accounts are recognised and adopted rather than created twice; which matching strategy applies — person identifier, employee number or UPN — is yours to choose. Accounts that are not employees, such as service accounts, can be filtered out of the integration.

Yes. You run the import as a dry run and get an Excel export of exactly what would happen, without anything being written. A threshold then keeps protecting you: if the source delivers more new, activated or deactivated employees in one run than you allowed, Joinly blocks the run.

Access to your AFAS environment for the employee data, and an app registration in your Microsoft tenant that lets Joinly work over Microsoft Graph. Nothing else: nothing is installed on your own servers. Joinly tracks the client secret's expiry itself and warns you well in advance.

Joinly is ISO27001-certified. Every change is recorded, so per employee you can look back at which access was granted when, on the basis of which role, and when it was revoked again. That is precisely what an auditor or a NIS2 assessment asks of you.

The integration is part of the subscription — you pay per account per month, not per connector or per target system. The pricing page shows what the plans cost and what each one includes.