How does Joinly sync Employes to Microsoft Entra ID?

Joinly reads each HR change in Employes through its REST API and applies it to the matching Entra ID account automatically. The Employes werknemersdossier holds the authoritative employment record, so it is the starting point for each identity action.

1. Joiner. HR completes the hire in Employes. Joinly reads the new werknemer and its dienstverband — including department, job type and start date — and determines the role. It then creates the account in Entra ID, assigns the right licences and maps the person into the correct groups, timed to the start date on the employment record.

2. Mover. When someone changes department (afdeling), job type (functie) or gets a new contract in Employes, Joinly updates their group membership, permissions and licences to match. Access that no longer fits the new position is revoked, so permissions stay aligned with the actual job.

3. Leaver. On the end date recorded on the Employes employment, Joinly disables the Entra ID account automatically. There are no orphaned accounts left active after someone has left, and where a person holds more than one dienstverband, access is only removed when the last active employment ends.

Example: A retail chain runs Employes for its shop and head-office staff. It hires a store assistant with a start date next Monday in the Rotterdam branch. Joinly reads the new employment record, waits until the start date, creates the Entra ID account, assigns a Microsoft 365 Business licence and adds the assistant to the Store-Rotterdam group. When that assistant later picks up extra weekend hours as a second dienstverband at head office, Joinly keeps a single, stable UPN and simply adds the extra group.

What manual user management costs

Without automation, every account starts as an email from the payroll administrator or a line in a spreadsheet that IT works through by hand. Because Employes has no native Entra or identity connector, the usual alternatives are a custom script against its REST API or a generic iPaaS flow — both of which still leave the part that actually decides access, the role-to-group mapping, to people to build and maintain.

• Onboarding delays. New joiners wait for accounts, licences and group access while a request sits in someone’s inbox, losing productive days in their first week.

• Permissions that don’t keep up (privilege creep). When movers change department or pick up a new contract, old access often stays attached, so people accumulate rights they no longer need.

• Forgotten offboarding. Accounts that aren’t disabled on time are both a security and audit risk, and unused licences keep costing money — and with more than one dienstverband it is easy to disable an account while another employment is still active.

Joinly vs. a custom Employes API integration

Employes has no native Entra ID or identity connector, so the realistic alternative is a script or iPaaS flow your team builds against the Employes REST API. That is a fine way to move data, but it stops short of the part that actually decides — and safely maintains — access. Here’s how the two compare.

Watch-outs when connecting Employes to Microsoft Entra ID

A few Employes-specific details decide whether this connection stays reliable at scale.

• Dutch name particles (tussenvoegsel). Employes stores the surname prefix (van, van der, de) in a separate surname_prefix field. A naive display-name or UPN rule either drops it or mangles it. Joinly builds the display name, mail and UPN from explicit rules, so ‘Sanne van der Berg’ resolves to a clean, predictable identity every time.

• Multiple employments per person. An employee can hold more than one dienstverband in Employes at the same time. Joinly picks the active/primary employment as the driver of the account and adds the extra access, so a second contract never creates a duplicate account or breaks sign-in — and ending one employment doesn’t disable someone who is still employed.

• Poll-based sync and future dates. The Employes API has no webhooks, so provisioning runs on a frequent scheduled import rather than an instant push. Joinly reads the start and end dates on the employment record and times account creation and disabling to those dates, so access is ready on the right day rather than the moment the sync happens to run.

• Mapping departments and job types to Entra groups. Employes departments (afdeling) and job types (functie) don’t translate one-to-one to Entra ID groups. Joinly builds explicit mapping rules from those structures to the correct groups and licences, so role drives access rather than manual assignment.

Joinly handles each of these by default with custom mapping and transformation.

Always audit-ready

Every account action Joinly performs is logged: who was affected, when it happened, which access changed and which Employes change triggered it. For NIS2 that matters directly: access can be traced back to an authorised HR source rather than an ad-hoc request. Joinly is ISO 27001 certified, runs in an EU data centre in Amsterdam, applies least-privilege by default, and is built to meet NIS2 and ISO 27001.

Example case

Picture a retail chain with around 700 staff across forty stores and a head office, running Employes for payroll and HR while account creation lives in the office manager’s inbox. Seasonal hires, students on flexible contracts and people who pick up shifts at a second store keep breaking the routine — new joiners wait until day two or three for a Microsoft 365 account, and when someone leaves one store but keeps working at another, their account sometimes gets switched off by mistake.

Connect Employes to Microsoft Entra ID with Joinly and that work disappears. Joinly reads each HR change in Employes at the source and acts on it automatically: new hires have their account, Microsoft 365 licence and store group ready on their start date, a move between stores swaps the right groups the same day, a second contract just adds access on a single stable account, and leavers are disabled on their end date with a 30-day soft-delete grace window.

“Half our people work flexible or seasonal contracts, and staff at two stores used to break every account. Now an account is simply ready on the start date, a second contract just adds access, and we can show exactly which Employes change created it.” — Head of IT, retail chain

The outcome this setup is designed for: onboarding drops from days to zero touch, duplicate-contract errors stop entirely, and the team can walk into its next NIS2 assessment with a complete, source-backed audit trail.