How does Joinly sync Insperity to Microsoft Entra ID?

Joinly reads each HR change in Insperity through the customer API and applies it to the matching Entra ID account automatically. Insperity holds the authoritative worksite-employee record, so it is the starting point for each identity action.

1. Joiner. HR completes the hire in Insperity. Joinly reads the new worksite-employee record and determines the role from attributes like department, location and job title. It then creates the account in Entra ID, assigns the right licences and maps the person into the correct groups — timed to the recorded start date.

2. Mover. When someone changes role, department or location in Insperity, Joinly updates their group membership, permissions and licences to match. Access that no longer fits the new position is revoked, so permissions stay aligned with the actual job.

3. Leaver. On the termination date recorded in Insperity, Joinly disables the Entra ID account automatically. There are no orphaned accounts left active after someone has left, and a soft-delete grace window keeps the account recoverable for a set period before it is removed.

Example: A financial-services firm hires a compliance analyst in Insperity with a start date next Monday. Joinly reads the record, waits until the start date, creates the Entra ID account, assigns a Microsoft 365 E3 licence and adds the analyst to the Compliance group. When that analyst later moves to the risk team, Joinly swaps the group membership and licences the same day, so access always matches the current role.

What manual user management costs

Without automation, every account starts as an Insperity export or a ticket that IT works through by hand. Microsoft’s API-driven inbound provisioning can move attributes across once you build a client for the Insperity API, but it maps roles to groups through manual expression rules and has no Insperity-specific logic — so the part that actually decides access still falls to people.

• Onboarding delays. New joiners wait for accounts, licences and group access while a ticket sits in a queue, losing productive days in their first week.

• Permissions that don’t keep up (privilege creep). When movers change role or department, old access often stays attached, so people accumulate rights they no longer need.

• Forgotten offboarding. Accounts that aren’t disabled on time are both a security and audit risk, and unused licences keep costing money.

Joinly vs. the native API-driven provisioning app

Microsoft’s Entra API-driven inbound provisioning is a fine baseline, but with Insperity there is no ready-made connector — you build and maintain the client yourself, and it stops short of the part that actually decides access. Here’s how the two compare for an Insperity-driven setup.

Watch-outs when connecting Insperity to Microsoft Entra ID

A few Insperity-specific details decide whether this connection stays reliable at scale.

• Co-employment and the employer of record. Insperity runs a PEO co-employment model in which it is the employer of record for payroll and tax, so records can carry Insperity’s own legal-entity framing rather than your company’s. Joinly maps each worksite employee to your own organisation, department and groups, so identity follows your structure and not the PEO’s.

• Customer-only, API-key access. The Insperity API is available to customers only and secured with an API key — there is no public sandbox. Joinly connects with your API key as a read-only source of truth and never writes HR data back, so Insperity stays authoritative.

• Mapping department and location to Entra groups. Department, location and job title don’t translate one-to-one to Entra ID groups. Joinly builds explicit mapping rules from those attributes to the correct groups and licences, so role drives access rather than manual assignment.

• UPN format with duplicate names. When two employees share a name, a naive UPN rule produces collisions. Joinly applies custom transformation rules — a suffix, location code or controlled tiebreaker — so every UPN is unique and predictable from day one.

Joinly handles each of these by default with custom mapping and transformation.

Always audit-ready

Every account action Joinly performs is logged: who was affected, when it happened, which access changed and which Insperity change triggered it. For NIS2 that matters directly: access can be traced back to an authorised HR source rather than an ad-hoc request. Joinly is ISO 27001 certified, runs in an EU data centre in Amsterdam, applies least-privilege by default, and is built to meet NIS2 and ISO 27001.

Example case

Picture a financial-services firm with around 900 employees, running Insperity as its HR platform under a PEO arrangement while its identity provisioning never quite keeps up. Every new hire starts as an Insperity export that IT reconciles by hand against Entra ID — creating the account, assigning the licence, adding the groups. Because Insperity is the employer of record, the records don’t line up cleanly with the firm’s own org chart, and each onboarding turns into a small mapping exercise that eats into the analyst’s first days.

Connect Insperity to Microsoft Entra ID with Joinly and that work disappears. Joinly reads each HR change in Insperity at the source and acts on it automatically: new hires have their account, Microsoft 365 licence and group access ready on their start date, mapped to the firm’s own departments rather than the PEO’s legal entity; role changes swap the right groups the same day; and leavers are disabled on their termination date with a 30-day soft-delete grace window.

“The co-employment setup used to make every onboarding a manual mapping job. Now an account is simply ready on the start date against our own org, and we can show the auditor exactly which Insperity change created every bit of access.” — Head of IT, financial-services firm

The outcome this setup is designed for: onboarding drops from days to zero touch, access always matches the firm’s own structure, and the team can walk into its next audit with a complete, source-backed trail.