HR-driven provisioning
HR-driven provisioning: your HR system as the source of access
Your HR system already knows who starts on Monday, who changes department next month and who leaves on Friday. HR-driven provisioning turns that knowledge into accounts, groups and licences, so IT stops retyping what HR has already entered.
No credit card, nothing to install. Talk to an IAM specialist
How it works
A provisioning platform reads the HR system on a schedule or on events. Each change becomes an action: a new employee becomes an account with a username, groups and a licence; a change of department moves the person to other groups; an end date disables the account and revokes sessions.
In between sits a rules layer. It decides which access belongs to which job, department and location, so a role change is one update in HR and the right access everywhere else.
What it needs
- A connector to your HR system that understands how it models employment: multiple contracts, rehires and changes with a future effective date.
- A naming convention for usernames and email addresses, with a check for duplicates.
- Rules that map HR fields to roles, groups and licences.
- A safe way to start: matching existing accounts to employees, and a dry run before anything is written.
How Joinly does it
Joinly reads the HR system through a ready-made connector, matches existing Entra ID accounts on employee ID or UPN, and writes to Entra ID through Microsoft Graph and to on-premises Active Directory through the Joinly Agent, which polls outbound and needs no inbound firewall rule. A dry run with an Excel export shows what would change, per-run thresholds and a hard stop guard against a broken HR export, and every change lands in the audit log with its source.
Hosted in the EU
All of Joinly's data and resources are hosted in Amsterdam, the Netherlands. Joinly is ISO 27001-certified, acts as your processor under a DPA, and every sub-processor is based in the EU.
Visit the trust centreFrequently asked
Questions about HR-driven provisioning: your HR system as the source of access
What is HR-driven provisioning?
Creating, changing and disabling accounts automatically from the HR system, so access follows the employee's start date, role and end date.
Is HR-driven provisioning the same as SCIM?
SCIM is one way to deliver the result to a directory. HR-driven provisioning is the whole chain: reading HR, deciding access and writing it. Joinly can write through Microsoft Graph or as SCIM bulk requests to Microsoft's inbound provisioning endpoint.
Does it work with on-premises Active Directory?
Yes. The Joinly Agent provisions to Active Directory and hybrid Exchange from inside your network, over an outbound connection.
Where is the data processed?
In Amsterdam, inside the EU. Joinly is ISO 27001-certified.
See what Joinly can do for your organisation?
Click through Joinly yourself in a free trial environment with demo data.
No credit card, nothing to install.
Rather talk to someone first? Talk to an IAM specialist