How does Joinly sync Gusto to Microsoft Entra ID?

Joinly reads each HR change in Gusto through the REST API and applies it to the matching Entra ID account automatically. Gusto holds the authoritative employee record, so it is the starting point for each identity action.

1. Joiner. HR adds the new hire in Gusto with their department, job and work location. Joinly reads the employee, job and department records, determines the role, then creates the account in Entra ID, assigns the right licences and maps the person into the correct groups — timed to the hire date.

2. Mover. When someone changes department, job or location in Gusto, Joinly updates their group membership, permissions and licences to match. Access that no longer fits the new role is revoked, so permissions stay aligned with the actual job.

3. Leaver. When an employee is terminated in Gusto, Joinly disables the Entra ID account automatically. There are no orphaned accounts left active after someone has left, and the change is applied on the termination date recorded in Gusto.

Example: A software startup hires a customer-success rep in Gusto with a start date next Monday, in its Support department at the Austin location. Joinly reads the record, waits until the hire date, creates the Entra ID account, assigns an Office E3 licence and adds the rep to the Support-Team group. When that rep later moves into a team-lead job, Joinly reads the new active job, swaps the group membership the same day and leaves the old access behind.

What manual user management costs

Without automation, every account starts as a Gusto notification or a line in a spreadsheet that IT works through by hand. Gusto has no native Microsoft Entra provisioning app, so unless you build against the API yourself, the part that actually decides access still falls to people.

• Onboarding delays. New joiners wait for accounts, licences and group access while a request sits in a queue, losing productive days in their first week.

• Permissions that don’t keep up (privilege creep). When movers change department or job, old access often stays attached, so people accumulate rights they no longer need.

• Forgotten offboarding. Accounts that aren’t disabled on time are both a security and audit risk, and unused licences keep costing money long after someone has left.

Joinly vs. building on the Gusto API yourself

Gusto has no first-party Entra provisioning app, so the realistic alternatives are JIT SSO provisioning or a script you build against the Gusto API. Here’s how that compares with Joinly for a Gusto-driven setup.

Watch-outs when connecting Gusto to Microsoft Entra ID

A few Gusto-specific details decide whether this connection stays reliable at scale.

• No native SCIM or Entra provisioning app. Gusto exposes a REST API but no inbound SCIM endpoint and no Microsoft-published Entra provisioning connector. Joinly reads the Gusto API directly and handles OAuth 2.0 token refresh, so you don’t have to build or babysit the integration.

• One employee, multiple jobs. In Gusto an employee can hold more than one job, each with its own title and compensation. A naive read can pick the wrong one. Joinly resolves the active job so the correct title and role drive access.

• Mapping departments and locations to Entra groups. Gusto departments, jobs and work locations don’t translate one-to-one to Entra ID groups. Joinly builds explicit mapping rules from those structures to the correct groups and licences, so role drives access rather than manual assignment.

• Onboarding not yet complete. A newly created Gusto employee may not have a work email or manager until self-onboarding finishes. Joinly applies rules so the account is created cleanly and enriched as Gusto fills the record in, rather than provisioning on incomplete data.

• UPN format with duplicate names. When two employees share a name, a naive UPN rule produces collisions. Joinly applies custom transformation rules — a suffix, location code or controlled tiebreaker — so every UPN is unique and predictable from day one.

Joinly handles each of these by default with custom mapping and transformation.

Always audit-ready

Every account action Joinly performs is logged: who was affected, when it happened, which access changed and which Gusto change triggered it. For NIS2 that matters directly: access can be traced back to an authorised HR source rather than an ad-hoc request. Joinly is ISO 27001 certified, runs in an EU data centre in Amsterdam, applies least-privilege by default, and is built to meet NIS2 and ISO 27001.

Example case

Picture a fast-growing software startup with around 180 employees, running Gusto for payroll and HR while its IT team keeps up with account creation by hand. Every new engineer, sales rep or support hire starts as a Slack message or a Gusto notification, and someone in IT creates the Entra ID account, assigns an Office licence and adds the groups from memory. As hiring accelerates the queue grows, new joiners wait until their second day for access, and nobody is quite sure which accounts belong to people who have already left.

Connect Gusto to Microsoft Entra ID with Joinly and that work disappears. Joinly reads each HR change in Gusto at the source and acts on it automatically: new hires have their account, Office licence and group access ready on their hire date, a move into a new department or job swaps the right groups the same day, and leavers are disabled on their termination date with a 30-day soft-delete grace window.

“We were creating accounts by hand from Slack pings. Now an account is simply ready on the start date, a role change just updates access, and we can show exactly which Gusto change created every bit of access.” — Head of IT, software startup

The outcome this setup is designed for: onboarding drops from days to zero touch, privilege creep from old roles is eliminated, and the team has a complete, source-backed audit trail without building anything on the Gusto API itself.