Connect Exact to Microsoft Entra ID

How does Joinly sync Exact to Microsoft Entra ID?

Joinly reads each HR change in Exact Online through the REST API and applies it to the matching Entra ID account automatically. Exact Online holds the authoritative employee record — scoped per division — so it is the starting point for each identity action.

1. Joiner. HR completes the hire in Exact Online. Joinly reads the new employee record from the payroll / HRM area — employee number, department, cost centre, manager and dienstverband — and determines the role. It then creates the account in Entra ID, assigns the right licences and maps the person into the correct groups, timed to the recorded start date.

2. Mover. When someone changes department, cost centre or division in Exact Online, Joinly updates their group membership, permissions and licences to match. Access that no longer fits the new position is revoked, so permissions stay aligned with the actual job.

3. Leaver. On the end date recorded in Exact Online, Joinly disables the Entra ID account automatically. There are no orphaned accounts left active after someone has left, and a soft-delete grace window keeps the account recoverable for a set period before it is retired.

Example: An accountancy firm hires a junior auditor in Exact Online with a start date next Monday, in its Amsterdam division. Joinly reads the record, waits until the start date, creates the Entra ID account, assigns a Microsoft 365 E3 licence and adds the auditor to the Audit-Amsterdam group. When that auditor later transfers to the advisory department, Joinly swaps the group and updates the job title the same day, without anyone touching Entra ID by hand.

What manual user management costs

Without automation, every account starts as an Exact export or a line in a spreadsheet that IT works through by hand. Because Exact has no native provisioning connector, teams either build a custom integration on the Exact Online REST API or wire up a generic iPaaS flow — and in both cases the part that actually decides access, role-to-group mapping across divisions, still falls to people.

• Onboarding delays. New joiners wait for accounts, licences and group access while a ticket sits in a queue, losing productive days in their first week.

• Permissions that don’t keep up (privilege creep). When movers change department or division, old access often stays attached, so people accumulate rights they no longer need.

• Forgotten offboarding. Accounts that aren’t disabled on time are both a security and audit risk, and unused Microsoft 365 licences keep costing money every month.

Joinly vs. a custom Exact Online API integration

Exact ships no native identity-provisioning connector, so the realistic alternative is a custom build on the Exact Online REST API or a generic iPaaS flow. Here’s how that compares to Joinly for an Exact-driven setup.

Watch-outs when connecting Exact to Microsoft Entra ID

A few Exact-specific details decide whether this connection stays reliable at scale.

• Division (administratie) scoping. Every Exact Online API call runs against a single division and data does not span divisions, so an employee who appears in more than one administratie can produce duplicate or partial records. Joinly reads across the divisions you authorise and resolves each person to a single, correct Entra ID account.

• HR as a module on an accounting core. Exact is an ERP/accounting platform with HR as a module, so employee records can be thinner than a dedicated HR system and department and cost-centre links aren’t always populated the way you expect. Joinly maps exactly the fields you need and fills the gaps with your own rules.

• API rate limits. Exact Online allows 60 calls per minute and 5,000 per day per app-company (30,000 on a Premium licence). A naive full re-read hits those limits fast. Joinly syncs incrementally, reading only what changed, so provisioning stays inside the limits without throttling.

• Mapping departments and cost centres to Entra groups. Division, department and cost centre don’t translate one-to-one to Entra ID groups. Joinly builds explicit mapping rules from those structures to the correct groups and licences, so role drives access rather than manual assignment.

• UPN format with duplicate names. When two employees share a name, a naive UPN rule produces collisions. Joinly applies custom transformation rules — a suffix, division code or controlled tiebreaker — so every UPN is unique and predictable from day one.

Joinly handles each of these by default with custom mapping and transformation.

Always audit-ready

Every account action Joinly performs is logged: who was affected, when it happened, which access changed and which Exact change triggered it. For NIS2 that matters directly: access can be traced back to an authorised HR source rather than an ad-hoc request. Joinly is ISO 27001 certified, runs in an EU data centre in Amsterdam, applies least-privilege by default, and is built to meet NIS2 and ISO 27001.

Example case

Picture a mid-sized accountancy and advisory firm with around 900 staff across three offices, running Exact Online for its finance and HR while its identity provisioning never quite keeps up. There is no native Exact-to-Entra connector, so a hand-built script reads the API on a schedule — but it only ever looked at one division, transfers between the audit and advisory departments were re-keyed by hand, and every busy-season intake of trainees meant a queue of tickets before anyone could log in.

Connect Exact to Microsoft Entra ID with Joinly and that work disappears. Joinly reads each HR change in Exact Online at the source and acts on it automatically: new joiners have their account, Microsoft 365 licence and group access ready on their recorded start date, transfers between departments swap the right groups the same day, staff who sit in more than one administratie resolve to a single account, and leavers are disabled on their end date with a 30-day soft-delete grace window.

“The busy-season intake used to be a scramble of tickets and half-finished scripts. Now a trainee’s account is simply ready on day one, a transfer just changes the access, and we can show the auditor exactly which Exact change created every bit of access.” — Head of IT, accountancy and advisory firm

The outcome this setup is designed for: onboarding drops from days to zero touch, cross-division duplicate accounts stop entirely, and the team can walk into its next NIS2 assessment with a complete, source-backed audit trail.