Justworks · SCIM
Justworks SCIM provisioning to Microsoft Entra ID
"Justworks SCIM to Entra ID" usually means one thing: getting Justworks employees into Microsoft's API-driven inbound provisioning, which speaks SCIM. Joinly is the client that reads Justworks, builds the SCIM bulk request and delivers it. This page describes that route — and when you do not need it.
What SCIM to Entra ID means for Justworks
Microsoft's API-driven inbound provisioning exposes a /bulkUpload endpoint per provisioning app. It accepts SCIM 2.0 bulk requests — the core user schema, the enterprise extension and, if you register them, your own extension attributes — and the Entra provisioning service takes it from there: it compares each record with the directory, decides whether to create, update, enable or disable, applies the attribute mappings and writes to Entra ID or, through the provisioning agent, to on-premise Active Directory.
What the endpoint does not do is read Justworks. In Microsoft's words, "the API developer/partner/system integrator builds an API client to send authoritative identity data". Whatever Justworks itself offers toward Microsoft 365, this route needs a client that speaks Justworks on one side and SCIM on the other.
How Joinly builds the SCIM request from Justworks
Joinly reads Justworks through the Justworks directory via unified HR API connector (authorised connector credentials; no deprecated basic auth or exposed domain controller) into its normalised employee model and packages the identities as a SCIM 2.0 BulkRequest for the provisioning app you configured — API2AAD for Entra ID, API2AD for Active Directory.
- Attribute mapping per customer with Liquid templates: name, email / UPN, department, title, manager, office, member type, start and end date land on the SCIM attributes Entra expects, plus Joinly's own extension schema for anything Microsoft's core schema lacks.
- An identity filter decides which identities are in scope, so contractors, a pilot department or one legal entity can go first.
- A sample export to Excel shows the exact payload before the first upload, and a scheduled export runs it on your cadence afterwards.
- The provisioning history records every run, chunk by chunk, with the error Microsoft returned, so a failed upload is visible and the job can be restarted once the cause is fixed.
- Bulk requests are split into chunks of 50 operations, Microsoft's limit per call, so a large first load does not trip the endpoint.
SCIM or Microsoft Graph for Justworks?
Joinly speaks both, and they are not competing routes so much as different places to put the write.
| SCIM to API-driven provisioning | Microsoft Graph | |
|---|---|---|
| Who writes to the directory | The Entra provisioning service | Joinly, through its app registration |
| On-premise Active Directory | Through the Microsoft Entra provisioning agent | Through the Joinly AD Agent |
| Licensing | Entra ID P1, P2 or Governance | No P1 or P2 required |
| Groups, licences, manager, TAP, sessions | Attribute flow only; the rest through Lifecycle Workflows | Part of the same workflow |
| Where the logs are | Entra provisioning logs plus Joinly's history | Joinly's audit log |
| Good fit when | Entra's provisioning service must remain the only writer, or Microsoft's provisioning agent is already in place | You want groups, licences and offboarding steps decided and applied in one place |
What you need for the SCIM route
- An API-driven inbound provisioning app from the Entra gallery — one per data source — with the attribute mappings you want.
- Microsoft Entra ID P1, P2 or Governance.
- For on-premise Active Directory: the Microsoft Entra provisioning agent on a server that can reach your domain.
- Access to Justworks — authorised connector credentials; no deprecated basic auth or exposed domain controller — for Joinly's import.
Frequently asked
Questions about Justworks
Does Justworks have a SCIM endpoint for Entra ID?
That is not how the route works. SCIM here is what Microsoft's inbound provisioning endpoint accepts; Justworks is the source that has to be read and translated into it. Joinly is that translation, whatever Justworks itself offers toward Microsoft 365.
Can I send the same data to Entra ID and to Active Directory?
Yes. Joinly keeps a provisioning configuration per target — API2AAD for Entra ID, API2AD for on-premise AD through Microsoft's provisioning agent — each with its own mapping and filter.
What happens to records Microsoft rejects?
The Entra provisioning logs report the outcome per record. Joinly's provisioning history keeps the result of every chunk it uploaded, with the error Microsoft returned, and the job can be restarted once the cause is fixed.
Is Graph not simpler?
Often, yes. If you are not tied to Entra's provisioning service as the writer, the Microsoft Graph path lets Joinly create the account and assign groups, licences and the manager in the same workflow, without an Entra ID P1 or P2 licence. The Justworks installation guide describes that path.
Read next
Installation guides
See what Joinly can do for your organisation?
Start a free trial today or get in touch for advice on your HR and Microsoft environment.