How does Joinly sync Hailey HR to Microsoft Entra ID?

Joinly reads each HR change in Hailey through the Hailey HR API and applies it to the matching Entra ID account automatically. Hailey HR Core holds the authoritative employment record, so it is the starting point for each identity action.

1. Joiner. HR completes the hire in Hailey. Joinly reads the new employee and employment record and determines the role from attributes like department, location and title. It then creates the account in Entra ID, assigns the right licences and maps the person into the correct groups — timed to the employment start date.

2. Mover. When someone changes department, location or title in Hailey, Joinly updates their group membership, permissions and licences to match. Access that no longer fits the new position is revoked, so permissions stay aligned with the actual job.

3. Leaver. On the end date recorded in Hailey, Joinly disables the Entra ID account automatically. There are no orphaned accounts left active after someone has left, and a soft-delete grace window lets you retire the account safely once the notice period has passed.

Example: A fast-growing SaaS company runs Hailey HR and hires a customer-success specialist with a start date next Monday. Joinly reads the employment record, waits until the start date, creates the Entra ID account, assigns an Office E3 licence and adds the specialist to the CS-Team and Amsterdam-Office groups. When that person later moves from Support into Product, Joinly swaps the groups and licences the same day — the kind of role-to-group logic Hailey’s built-in Entra sync leaves to a person.

What manual user management costs

Without automation, every account starts as a message in Slack or a line in a spreadsheet that IT works through by hand. Hailey’s native Entra integration can push a fixed set of fields across on an hourly sync, but it maps no roles to groups, assigns no licences and never touches an OU — so the part that actually decides access still falls to people.

• Onboarding delays. New joiners wait for accounts, licences and group access while someone gets around to the request, losing productive days in their first week.

• Permissions that don’t keep up (privilege creep). When movers change department or role, old access often stays attached, so people accumulate rights they no longer need.

• Forgotten offboarding. Accounts that aren’t disabled on time are both a security and audit risk, and unused licences keep costing money — a real cost for a lean team where every seat counts.

Joinly vs. Hailey’s native Entra ID integration

Hailey’s built-in Microsoft Entra integration is a fine baseline for basic account creation, but it stops short of the part that actually decides access. Here’s how the two compare for a Hailey-driven setup.

Watch-outs when connecting Hailey HR to Microsoft Entra ID

A few Hailey-specific details decide whether this connection stays reliable as you grow.

• API key scope and access rights. Hailey’s API returns employee data according to the rights attached to the key, and the key itself is requested from Hailey Support. Joinly connects with a correctly scoped key and matches people to existing Entra accounts on import, so you get complete data without creating duplicates.

• Mapping a flat org model to Entra groups. Hailey’s department, legal entity and location fields are flexible rather than a deep hierarchy, so they don’t translate one-to-one to Entra ID groups. Joinly builds explicit mapping rules from those fields to the correct groups and licences, so role drives access rather than manual assignment.

• Filling the gaps Hailey’s native sync leaves. The built-in Entra integration syncs a fixed field set on an hourly, one-way basis with no role-to-group, licence or OU logic. Joinly takes over that decision-making layer, so onboarding produces a fully provisioned account, not just a bare user object.

• UPN format with duplicate names. When two employees share a name, a naive UPN rule produces collisions. Joinly applies custom transformation rules — a suffix, a location code or a controlled tiebreaker — so every UPN is unique and predictable from day one.

• Start dates and timing. Joinly reads the employment start date on the Hailey record and times account creation to it, so access is ready on the right day rather than the moment HR saved the hire.

Joinly handles each of these by default with custom mapping and transformation.

Always audit-ready

Every account action Joinly performs is logged: who was affected, when it happened, which access changed and which Hailey HR change triggered it. For NIS2 that matters directly: access can be traced back to an authorised HR source rather than an ad-hoc request. Joinly is ISO 27001 certified, runs in an EU data centre in Amsterdam, applies least-privilege by default, and is built to meet NIS2 and ISO 27001.

Example case

Picture a fast-growing SaaS startup with around 180 employees across two European offices, running Hailey HR as its HR core while its identity setup is held together by a shared spreadsheet and the odd Slack ping to IT. Hailey’s native Entra sync creates the bare account, but every new hire still needs someone to add the right groups, assign a licence and check the office and team are correct — and with hiring running hot, those manual steps are exactly where people slip through onboarding without the access they need.

Connect Hailey HR to Microsoft Entra ID with Joinly and that work disappears. Joinly reads each HR change in Hailey at the source and acts on it automatically: new hires have their account, Office licence and group access ready on their start date, a move from Support into Product swaps the right groups and licences the same day, and leavers are disabled on their end date with a soft-delete grace window.

“Hailey’s own Entra sync gave us an empty account and nothing else — we were still adding groups and licences by hand for every hire. Now the account is simply ready with the right access on day one, and we can show exactly which Hailey change created it.” — Head of IT, SaaS scale-up

The outcome this setup is designed for: onboarding drops from days to zero touch, licence spend stops leaking on forgotten accounts, and the team can walk into its next NIS2 assessment with a complete, source-backed audit trail.