Employes · SCIM
Employes SCIM provisioning to Microsoft Entra ID
"Employes SCIM to Entra ID" usually means one thing: getting Employes employees into Microsoft's API-driven inbound provisioning, which speaks SCIM. Joinly is the client that reads Employes, builds the SCIM bulk request and delivers it. This page describes that route — and when you do not need it.
What SCIM to Entra ID means for Employes
Microsoft's API-driven inbound provisioning exposes a /bulkUpload endpoint per provisioning app. It accepts SCIM 2.0 bulk requests — the core user schema, the enterprise extension and, if you register them, your own extension attributes — and the Entra provisioning service takes it from there: it compares each record with the directory, decides whether to create, update, enable or disable, applies the attribute mappings and writes to Entra ID or, through the provisioning agent, to on-premise Active Directory.
What the endpoint does not do is read Employes. In Microsoft's words, "the API developer/partner/system integrator builds an API client to send authoritative identity data". Whatever Employes itself offers toward Microsoft 365, this route needs a client that speaks Employes on one side and SCIM on the other.
How Joinly builds the SCIM request from Employes
Joinly reads Employes through the Employes REST API (v4) (bearer token (generated in Employes settings, valid one year)) into its normalised employee model and packages the identities as a SCIM 2.0 BulkRequest for the provisioning app you configured — API2AAD for Entra ID, API2AD for Active Directory.
- Attribute mapping per customer with Liquid templates: name, email / UPN, department (afdeling), job type (functie), employee number, manager, start and end date land on the SCIM attributes Entra expects, plus Joinly's own extension schema for anything Microsoft's core schema lacks.
- An identity filter decides which identities are in scope, so contractors, a pilot department or one legal entity can go first.
- A sample export to Excel shows the exact payload before the first upload, and a scheduled export runs it on your cadence afterwards.
- The provisioning history records every run, chunk by chunk, with the error Microsoft returned, so a failed upload is visible and the job can be restarted once the cause is fixed.
- Bulk requests are split into chunks of 50 operations, Microsoft's limit per call, so a large first load does not trip the endpoint.
SCIM or Microsoft Graph for Employes?
Joinly speaks both, and they are not competing routes so much as different places to put the write.
| SCIM to API-driven provisioning | Microsoft Graph | |
|---|---|---|
| Who writes to the directory | The Entra provisioning service | Joinly, through its app registration |
| On-premise Active Directory | Through the Microsoft Entra provisioning agent | Through the Joinly AD Agent |
| Licensing | Entra ID P1, P2 or Governance | No P1 or P2 required |
| Groups, licences, manager, TAP, sessions | Attribute flow only; the rest through Lifecycle Workflows | Part of the same workflow |
| Where the logs are | Entra provisioning logs plus Joinly's history | Joinly's audit log |
| Good fit when | Entra's provisioning service must remain the only writer, or Microsoft's provisioning agent is already in place | You want groups, licences and offboarding steps decided and applied in one place |
What you need for the SCIM route
- An API-driven inbound provisioning app from the Entra gallery — one per data source — with the attribute mappings you want.
- Microsoft Entra ID P1, P2 or Governance.
- For on-premise Active Directory: the Microsoft Entra provisioning agent on a server that can reach your domain.
- Access to Employes — bearer token (generated in Employes settings, valid one year) — for Joinly's import.
Frequently asked
Questions about Employes
Does Employes have a SCIM endpoint for Entra ID?
That is not how the route works. SCIM here is what Microsoft's inbound provisioning endpoint accepts; Employes is the source that has to be read and translated into it. Joinly is that translation, whatever Employes itself offers toward Microsoft 365.
Can I send the same data to Entra ID and to Active Directory?
Yes. Joinly keeps a provisioning configuration per target — API2AAD for Entra ID, API2AD for on-premise AD through Microsoft's provisioning agent — each with its own mapping and filter.
What happens to records Microsoft rejects?
The Entra provisioning logs report the outcome per record. Joinly's provisioning history keeps the result of every chunk it uploaded, with the error Microsoft returned, and the job can be restarted once the cause is fixed.
Is Graph not simpler?
Often, yes. If you are not tied to Entra's provisioning service as the writer, the Microsoft Graph path lets Joinly create the account and assign groups, licences and the manager in the same workflow, without an Entra ID P1 or P2 licence. The Employes installation guide describes that path.
Read next
Installation guides
See what Joinly can do for your organisation?
Start a free trial today or get in touch for advice on your HR and Microsoft environment.