How does Joinly sync Factorial to Microsoft Entra ID?

Joinly reads each HR change in Factorial through the public REST API and applies it to the matching Entra ID account automatically. Factorial holds the authoritative employment record, so it is the starting point for each identity action.

1. Joiner. HR completes the hire in Factorial. Joinly reads the new employee together with the latest contract version and determines the role from attributes like team, job and legal entity. It then creates the account in Entra ID, assigns the right licences and maps the person into the correct groups — timed to the start date on the record.

2. Mover. When someone changes team, location, legal entity or contract in Factorial, Joinly updates their group membership, permissions and licences to match. Access that no longer fits the new position is revoked, so permissions stay aligned with the actual job — and because Factorial reads the current job title from the latest contract version, a promotion is reflected correctly rather than left on an old title.

3. Leaver. On the termination date recorded in Factorial, Joinly disables the Entra ID account automatically. There are no orphaned accounts left active after someone has left, and unused licences are freed instead of quietly billing every month.

Example: A tech scale-up hires a backend engineer in Factorial with a start date next Monday, in its Spanish legal entity. Joinly reads the record and the latest contract version, waits until the start date, creates the Entra ID account, assigns a Microsoft 365 E3 licence and adds the engineer to the ES-Engineering group. When the company later opens a German entity and the engineer transfers, Joinly swaps the legal-entity groups and keeps the UPN stable, without anyone editing Entra by hand.

What manual user management costs

Without automation, every account starts as a Factorial ticket or a line in a spreadsheet that IT works through by hand. Microsoft’s API-driven inbound provisioning can move attributes across once you build the pipeline, but it maps roles to groups through manual expression rules and has no idea that the real job title lives on the latest contract version — so the part that actually decides access still falls to people.

• Onboarding delays. New joiners wait for accounts, licences and group access while a ticket sits in a queue, losing productive days in their first week.

• Permissions that don’t keep up (privilege creep). When movers change team, location or contract, old access often stays attached, so people accumulate rights they no longer need.

• Forgotten offboarding. Accounts that aren’t disabled on time are both a security and audit risk, and unused licences keep costing money — a real drag for a fast-growing SME watching its per-seat spend.

Joinly vs. native Entra API-driven provisioning

Factorial isn’t a pre-built app in the Entra gallery, so the native path is API-driven inbound provisioning: a script or Logic App that pushes Factorial data into Entra’s bulk-upload endpoint. It’s a fine baseline, but it stops short of the part that actually decides access. Here’s how the two compare for a Factorial-driven setup.

Watch-outs when connecting Factorial to Microsoft Entra ID

A few Factorial-specific details decide whether this connection stays reliable as you grow.

• Job title lives on the contract version. In Factorial the current job title sits on the latest contract version, not on the employee record, and an employee can have several contract versions over time. A naive read picks up a stale title and maps the wrong groups. Joinly always resolves the latest contract version, so promotions and contract changes drive the right access.

• Multiple legal entities across countries. As you expand across the EU, Factorial holds several legal entities with different countries, currencies and payroll cycles, and each employee belongs to exactly one. Joinly builds explicit rules from legal entity and country to the correct Entra groups, licences and UPN domain, so a Spanish and a German hire each land in the right place.

• Teams, locations and jobs to Entra groups. Team, location and job don’t translate one-to-one to Entra ID groups. Joinly builds explicit mapping rules from those structures to the correct groups and licences, so role drives access rather than manual assignment — which matters when an SME’s org chart is still changing every quarter.

• UPN format with duplicate names. When two employees share a name, a naive UPN rule produces collisions. Joinly applies custom transformation rules — a suffix, legal-entity code or controlled tiebreaker — so every UPN is unique and predictable from day one.

• Future start dates and terminations. Factorial stores a hire with a start date that can be in the future and a termination date on exit. Joinly times account creation to the start date and disables on the termination date, so access is ready on the right day and removed on time.

Joinly handles each of these by default with custom mapping and transformation.

Always audit-ready

Every account action Joinly performs is logged: who was affected, when it happened, which access changed and which Factorial change triggered it. For NIS2 that matters directly: access can be traced back to an authorised HR source rather than an ad-hoc request. Joinly is ISO 27001 certified, runs in an EU data centre in Amsterdam, applies least-privilege by default, and is built to meet NIS2 and ISO 27001.

Example case

Picture a tech scale-up with around 400 employees, doubling headcount year on year and running Factorial as its HR core while its identity provisioning never quite keeps up. A homegrown script pushes new hires into Entra ID overnight, but promotions sit on old job titles because the script reads the employee record instead of the latest contract version, and the two new legal entities opened for the German and French markets each needed a manual mapping nobody had time to maintain.

Connect Factorial to Microsoft Entra ID with Joinly and that work disappears. Joinly reads each HR change in Factorial at the source and acts on it automatically: new hires have their account, Microsoft 365 licence and group access ready on their start date, a promotion swaps groups the same day because Joinly reads the current contract version, transfers between legal entities move people cleanly across countries, and leavers are disabled on their termination date with a 30-day soft-delete grace window.

“Our old script always had someone stuck on last quarter’s job title. Now an account is ready on the start date, a promotion just updates the groups, and we can show exactly which Factorial change created every bit of access.” — Head of IT, tech scale-up

The outcome this setup is designed for: onboarding drops from days to zero touch, stale-title access errors stop entirely, and the team can walk into its next NIS2 assessment with a complete, source-backed audit trail.