How does Joinly sync Cornerstone OnDemand to Microsoft Entra ID?

Joinly reads each change in Cornerstone through the Edge API and applies it to the matching Entra ID account automatically. Cornerstone holds the talent record and its OU structure; Joinly resolves the right person, then acts on the right account.

1. Joiner. A new user appears in Cornerstone with their Organizational Units set. Joinly reads the record through the Edge API, determines the role from Division, Position and Cost Center, and creates the account in Entra ID, assigns the right licences and maps the person into the correct groups — timed to the start date and bound to the stable userId rather than a username that may change.

2. Mover. When someone changes Position, Division or Location in Cornerstone, Joinly updates their group membership, permissions and licences to match. Access that no longer fits the new OU placement is revoked, so permissions stay aligned with the actual role.

3. Leaver. When a user’s status moves to inactive or terminated in Cornerstone — or their end date passes — Joinly disables the Entra ID account automatically. No orphaned accounts are left active, and the matching is done on the internal Cornerstone ID, so a recycled username never disables the wrong person.

Example: A university hires a research administrator in Cornerstone, placed in the Division ‘Faculty of Science’ and Position ‘Grant Coordinator’, with a start date next Monday. Joinly reads the record, waits until the start date, creates the Entra ID account, assigns an Office E3 licence and adds the coordinator to the SCI-Research group. When that person later transfers to the Position ‘Department Manager’, Joinly swaps the groups the same day — matching on the unchanged Cornerstone userId, not the email address that the move also rewrote.

What manual user management costs

Without automation, every account starts as a Cornerstone export or a line in a spreadsheet that IT works through by hand. The native Entra provisioning app for Cornerstone has been deprecated and Cornerstone retired its Entra SCIM path, so there is no supported out-of-the-box bridge left — what remains is the SFTP Data Feed, a third-party connector or manual effort, and none of those decide access for you.

• Onboarding delays. New joiners wait for accounts, licences and group access while a ticket sits in a queue, losing productive days in their first week.

• Permissions that don’t keep up (privilege creep). When movers change Position or Division, old access often stays attached, so people accumulate rights they no longer need.

• Forgotten offboarding. Accounts that aren’t disabled on time are both a security and audit risk, and unused licences keep costing money — and a username-based match can miss the right account entirely when an ID was recycled.

Joinly vs. the native Cornerstone provisioning options

The native Entra provisioning app for Cornerstone is deprecated and Cornerstone’s own Entra SCIM connector is gone, so the realistic alternatives are the SFTP Data Feed or a third-party connector. Here’s how that compares with Joinly for a Cornerstone-driven setup.

Watch-outs when connecting Cornerstone OnDemand to Microsoft Entra ID

A few Cornerstone-specific details decide whether this connection stays reliable at scale.

• Three identifiers that don’t auto-map. Cornerstone’s internal userId, the login username and the SSO subject are three separate things, and none derives from the others. Match on the wrong one and you update or disable the wrong account. Joinly keys on the stable userId and maintains the cross-system mapping, so a renamed username never breaks the link.

• Cornerstone may not be your source of truth. Cornerstone is talent/learning-first, and its OU data is itself usually fed from an upstream HRIS. Joinly lets you set which feed is authoritative per attribute, so weaker Cornerstone OU values don’t silently overwrite better data from a core HR system.

• Mapping Organizational Units to Entra groups. Division, Position, Location, Cost Center and Grade don’t translate one-to-one to Entra ID groups. Joinly builds explicit mapping rules from those OUs to the correct groups and licences, so role drives access rather than manual assignment.

• Reporting API lag and rate limits. The Reporting API reads the real-time data warehouse with a roughly 15-minute refresh, and high-volume reads are rate-limited. Joinly schedules reads sensibly and reconciles against the transactional API so a change isn’t missed or double-applied.

• UPN format with duplicate names. When two users share a name, a naive UPN rule produces collisions. Joinly applies custom transformation rules — a suffix, location code or controlled tiebreaker — so every UPN is unique and predictable from day one.

Joinly handles each of these by default with custom mapping and transformation.

Always audit-ready

Every account action Joinly performs is logged: who was affected, when it happened, which access changed and which Cornerstone change triggered it. For NIS2 that matters directly: access can be traced back to an authorised HR source rather than an ad-hoc request. Joinly is ISO 27001 certified, runs in an EU data centre in Amsterdam, applies least-privilege by default, and is built to meet NIS2 and ISO 27001.

Example case

Picture a university with around 9,000 staff and a large pool of seasonal teaching and research contracts, running Cornerstone OnDemand for learning and talent while its identity provisioning never quite keeps up. The old native Cornerstone-to-Entra app is gone, so accounts are created from a spreadsheet export — and because Cornerstone usernames get recycled and rewritten on transfers, the wrong account occasionally gets disabled when someone simply changes faculty.

Connect Cornerstone OnDemand to Microsoft Entra ID with Joinly and that work disappears. Joinly reads each change in Cornerstone at the source, matches on the stable internal userId, and acts on it automatically: new hires have their account, Office licence and group access ready on their start date, transfers between Divisions swap the right groups the same day, and leavers are disabled on their end date with a 30-day soft-delete grace window.

“Recycled usernames used to be the thing that broke every sync — we once disabled an active professor by accident. Now Joinly keys on the Cornerstone ID, an account is simply ready on the start date, and we can show the auditor exactly which change created every bit of access.” — Head of IT, university

The outcome this setup is designed for: onboarding drops from days to zero touch, mismatched-identifier errors stop entirely, and the team can walk into its next NIS2 assessment with a complete, source-backed audit trail.