How does Joinly sync Deel to Microsoft Entra ID?

Joinly reads each HR change in Deel through the Public REST API and applies it to the matching Entra ID account automatically. Deel holds the authoritative worker record — including the worker type, legal entity and group — so it is the starting point for each identity action.

1. Joiner. HR completes the hire in Deel — an EOR contract, a global-payroll direct employee or a contractor agreement. Joinly reads the new worker record and determines the role from attributes like worker type, group, legal entity and location. It then creates the account in Entra ID, assigns the right licences and maps the person into the correct groups — with a different profile for a contractor than for a full employee.

2. Mover. When someone changes group, location or is converted from contractor to EOR employee in Deel, Joinly updates their group membership, permissions and licences to match. Access that no longer fits the new situation is revoked, so permissions stay aligned with the actual engagement.

3. Leaver. On the end date recorded in Deel — the last day of an EOR contract, a payroll termination or the end of a contractor agreement — Joinly disables the Entra ID account automatically. There are no orphaned accounts left active after someone has left, and each worker’s own local end date drives the timing rather than a single global run.

Example: A remote-first company hires a designer as an EOR employee in Portugal with a start date next Monday, and at the same time renews two contractors in Brazil. Joinly reads each Deel record, creates the Portuguese employee’s Entra ID account on Monday with an Office E3 licence and the Design group, and gives the Brazilian contractors a restricted account with no mailbox — all driven from the same Deel source, each on its own worker type and start date.

What manual user management costs

Without automation, every account starts as a Deel notification or a line in a spreadsheet that IT works through by hand. Deel’s own SCIM and its direct Okta/Entra integrations can push a user across, but they have no Group resource and no worker-type logic, so the part that actually decides access — which groups, which licence, and whether a contractor should get a full account at all — still falls to people.

• Onboarding delays. New joiners wait for accounts, licences and group access while a ticket sits in a queue, losing productive days in their first week — and with a distributed team the request often arrives in a different time zone than the admin.

• Permissions that don’t keep up (privilege creep). When movers change group or convert from contractor to employee, old access often stays attached, so people accumulate rights they no longer need.

• Forgotten offboarding. Accounts that aren’t disabled on time are both a security and audit risk, and unused licences keep costing money — and with contractors and EOR contracts ending on many different local dates, it is easy to miss one.

Joinly vs. Deel’s native SCIM provisioning

Deel’s own SCIM and its direct Okta/Entra ID integrations are a fine baseline, but they stop short of the part that actually decides access. Here’s how the two compare for a Deel-driven setup.

Watch-outs when connecting Deel to Microsoft Entra ID

A few Deel-specific details decide whether this connection stays reliable at scale.

• Mixed worker types in one org. A single Deel organisation holds EOR employees, direct global-payroll employees and independent contractors side by side. They should not all get the same account: a contractor often needs a restricted account with no mailbox or licence. Joinly reads the worker type and applies a different provisioning profile per type.

• EOR vs direct employment. For an EOR worker, Deel’s own entity is the legal employer, while the person actually works for your company. A naive rule that maps the Deel EOR entity to a group or licence gets it wrong. Joinly maps to your organisation’s groups from the group and location, not the EOR entity.

• Multi-country and multi-entity timing. Workers span many legal entities and countries, each with its own start date, notice period and end date. Joinly acts on each worker’s own local dates, so an account is created or disabled on the right day per country rather than in one global batch.

• No Group resource in Deel’s SCIM. Deel’s SCIM API exposes only the User resource, so group and role mapping can’t come from SCIM at all. Joinly reads the richer Deel REST API — group, entity, location and worker type — and builds explicit mapping rules to Entra ID groups and licences.

• UPN format with duplicate names. When two workers share a name, a naive UPN rule produces collisions. Joinly applies custom transformation rules — a suffix, entity code or controlled tiebreaker — so every UPN is unique and predictable from day one.

Joinly handles each of these by default with custom mapping and transformation.

Always audit-ready

Every account action Joinly performs is logged: who was affected, when it happened, which access changed and which Deel change triggered it. For NIS2 that matters directly: access can be traced back to an authorised HR source rather than an ad-hoc request. Joinly is ISO 27001 certified, runs in an EU data centre in Amsterdam, applies least-privilege by default, and is built to meet NIS2 and ISO 27001.

Example case

Picture a remote-first software company with around 400 people across 30 countries, running Deel for everything from EOR employees to a large bench of independent contractors, while its identity provisioning never quite keeps up. Deel’s native SCIM push handles the simple cases, yet it treats a contractor in Argentina exactly like a full EOR employee in Germany — both land with the same Entra ID account and licence — and every group assignment is still done by hand because Deel’s SCIM has no group concept at all.

Connect Deel to Microsoft Entra ID with Joinly and that work disappears. Joinly reads each HR change in Deel at the source and acts on it automatically: EOR and payroll employees get their account, Office licence and group access ready on their local start date, contractors get a restricted no-mailbox account, a contractor-to-employee conversion upgrades access the same day, and leavers are disabled on their end date with a 30-day soft-delete grace window.

“We hire in 30 countries through Deel, and half of them are contractors. Joinly finally tells the difference — a contractor gets a locked-down account, an EOR hire gets the full stack, and every group is mapped from Deel automatically instead of by hand.” — Head of IT, remote-first software company

The outcome this setup is designed for: onboarding drops from days to zero touch, contractors and employees get exactly the access their worker type warrants, and the team can walk into its next NIS2 assessment with a complete, source-backed audit trail.