How does Joinly sync Infor HCM to Microsoft Entra ID?

Joinly authenticates to the Infor ION API Gateway and reads each HR change Global HR publishes as a BOD, then applies it to the matching Entra ID account automatically. Global HR holds the authoritative people record and work assignment, so it is the starting point for each identity action.

1. Joiner. HR completes the hire in Global HR. Joinly reads the new person record and its work assignment over IONAPI and determines the role from attributes like organization unit, position and job. It then creates the account in Entra ID, assigns the right licences and maps the person into the correct groups — timed to the effective start date of the work assignment.

2. Mover. When someone’s work assignment changes — a new position, organization unit or location — Joinly updates their group membership, permissions and licences to match. Access that no longer fits the new assignment is revoked, so permissions stay aligned with the actual job.

3. Leaver. On the termination date recorded in Global HR, Joinly disables the Entra ID account automatically. There are no orphaned accounts left active after someone has left, and multiple work assignments are taken into account so access is only removed when the last active assignment ends.

Example: An industrial distribution group hires a regional fulfilment planner in Global HR with a start date next Monday, in a position under its Benelux organization unit. Joinly reads the effective-dated work assignment over IONAPI, waits until the start date, creates the Entra ID account, assigns an Office E3 licence and adds the planner to the BNL-Operations group. When that planner later picks up a second work assignment in a procurement position, Joinly keeps the primary assignment as the driver of the UPN and adds the extra group without breaking sign-in.

What manual user management costs

Without automation, every account starts as an Infor HCM ticket or a line in a spreadsheet that IT works through by hand. A custom ION/IONAPI integration with BOD document flows can move attributes across, but it is built and maintained by your integration team, has no concept of role-to-group mapping, and inherits ION’s asynchronous, effective-dated quirks — so the part that actually decides access still falls to people.

• Onboarding delays. New joiners wait for accounts, licences and group access while a ticket sits in a queue, losing productive days in their first week.

• Permissions that don’t keep up (privilege creep). When movers change position or organization unit, old access often stays attached, so people accumulate rights they no longer need.

• Forgotten offboarding. Accounts that aren’t disabled on time are both a security and audit risk, and unused licences keep costing money — and with multiple work assignments it is easy to disable an account while another assignment is still active.

Joinly vs. a custom ION integration

There is no first-party Infor inbound provisioning app for Entra ID — the realistic alternative is a custom ION/IONAPI integration your team builds with BOD document flows. (Microsoft’s Entra connector for Infor CloudSuite is SCIM outbound for app access, not an HR-driven feed.) Here’s how the two compare for a Global HR-driven setup.

Watch-outs when connecting Infor HCM to Microsoft Entra ID

A few Infor-specific details decide whether this connection stays reliable at scale.

• Everything routes through Infor ION. Global HR has no point-to-point HR API; identity data is only reachable through the ION API Gateway and the document flows that publish person and work-assignment BODs. Joinly authenticates to IONAPI with the .ionapi credentials and subscribes to the right BODs, so you don’t stand up and babysit a bespoke ION integration.

• Asynchronous BOD messaging. ION is event-driven and asynchronous: a request moves through a pending state until an Acknowledge BOD comes back, so a record isn’t usable the instant it’s sent. Joinly handles that handshake and retries, so provisioning waits for confirmation instead of acting on a half-applied change.

• Effective-dated work assignments. Global HR stores a hire or transfer as an effective-dated work assignment well before it is active, and provisioning too early or too late both cause problems. Joinly reads the effective date and times account creation to it, so access is ready on the right day and not before.

• Work assignment vs position vs organization unit. These building blocks don’t translate one-to-one to Entra ID groups, and a person can hold more than one work assignment. Joinly builds explicit mapping rules from position and organization unit to the correct groups and licences, and picks the primary assignment to drive the UPN.

• UPN format with duplicate names. When two employees share a name, a naive UPN rule produces collisions. Joinly applies custom transformation rules — a suffix, organization-unit code or controlled tiebreaker — so every UPN is unique and predictable from day one.

Joinly handles each of these by default with custom mapping and transformation.

Always audit-ready

Every account action Joinly performs is logged: who was affected, when it happened, which access changed and which Infor HCM change triggered it. For NIS2 that matters directly: access can be traced back to an authorised HR source rather than an ad-hoc request. Joinly is ISO 27001 certified, runs in an EU data centre in Amsterdam, applies least-privilege by default, and is built to meet NIS2 and ISO 27001.

Example case

Picture an industrial distribution group with around 5,000 employees across several operating companies, running Infor CloudSuite HCM as its HR core while its identity provisioning never quite keeps up. A custom ION integration handles the simple cases, yet seasonal warehouse contracts, transfers between operating companies and a steady stream of second work assignments keep breaking it — planners with a procurement assignment alongside their main role end up with the wrong assignment driving Entra ID, and future-dated hires are provisioned the moment HR saves the record rather than on their actual start date.

Connect Infor HCM to Microsoft Entra ID with Joinly and that work disappears. Joinly reads each HR change in Global HR over IONAPI and acts on it automatically: new hires have their account, Office licence and group access ready on their effective start date, transfers between operating companies swap the right groups the same day, second work assignments keep a single, stable UPN, and leavers are disabled on their termination date with a 30-day soft-delete grace window.

“Multiple work assignments and the ION handshake used to break every sync we built. Now an account is simply ready on the start date, a second assignment just adds access, and we can show the auditor exactly which Infor change created every bit of access.” — Head of IT, industrial distribution group

The outcome this setup is designed for: onboarding drops from days to zero touch, work-assignment errors stop entirely, and the team can walk into its next NIS2 assessment with a complete, source-backed audit trail.