How does Joinly sync Justworks to Microsoft Entra ID?

Joinly reads each member change in the Justworks directory through a unified HR API connector and applies it to the matching Entra ID account automatically. Justworks holds the authoritative member record — title, department, manager, office and member type — so it is the starting point for each identity action.

1. Joiner. An admin adds the new member in Justworks with a title, department and manager. Joinly reads the new member record and determines the role from title, department and office. It then creates the account in Entra ID, assigns the right licences and maps the person into the correct groups. For contractors, Joinly applies a separate rule so they get a scoped account rather than a full employee footprint.

2. Mover. When someone changes title, department or manager in Justworks, Joinly updates their group membership, permissions and licences to match. Access that no longer fits the new role is revoked, so permissions stay aligned with the actual job rather than accumulating over time.

3. Leaver. When a member is offboarded in Justworks and their end date passes, Joinly disables the Entra ID account automatically. There are no orphaned accounts left active after someone has left, and unused licences are freed rather than quietly billed month after month.

Example: A creative agency adds a new motion designer in Justworks with the title Motion Designer, the Creative department and an office in New York. Joinly reads the member record, creates the Entra ID account, assigns a Microsoft 365 Business Premium licence and adds the designer to the Creative and NYC-Office groups. When the agency later brings on a freelance editor as a contractor, Joinly applies the contractor rule: a scoped account with project-tool access only, no full licence, and automatic deactivation when the contract ends.

What manual user management costs

Without automation, every account starts as a note from HR or a line in a spreadsheet that IT works through by hand. Because Justworks exposes no native Entra provisioning app, the usual fallback is a unified-API connector or a CSV export that copies attributes across — but neither decides who belongs in which group, and neither knows a contractor from an employee, so the part that actually determines access still falls to people.

• Onboarding delays. New joiners wait for accounts, licences and group access while a request sits in a queue, losing productive days in their first week.

• Permissions that don’t keep up (privilege creep). When members change title or department, old access often stays attached, so people accumulate rights they no longer need.

• Forgotten offboarding. Accounts that aren’t disabled on time are both a security and audit risk, and unused Microsoft licences keep costing money — an avoidable expense for a small team watching its budget.

Joinly vs. a generic HR-API connector

There is no Microsoft-published Entra inbound provisioning app for Justworks, so the default is a generic unified-API connector or a manual CSV import. Those are a fine way to copy attributes, but they stop short of the part that actually decides access. Here’s how the two compare for a Justworks-driven setup.

Watch-outs when connecting Justworks to Microsoft Entra ID

A few Justworks-specific details decide whether this connection stays reliable as your team grows.

• No public provisioning API or SCIM. Justworks doesn’t publish an open lifecycle API or a SCIM endpoint, so Joinly reads the directory through a unified HR API connector and treats Justworks as a read source of truth. Provisioning decisions happen in Joinly, which keeps the connection stable even as Justworks changes.

• Contractors alongside employees. Justworks lists contractors and employees together as members. A naive rule would give a contractor the same account and licences as staff. Joinly keys off the member type so contractors get a scoped account and employees get the full footprint.

• PEO co-employment model. As a PEO, Justworks is the co-employer of record for payroll and benefits, but you keep control of hiring, titles and comp — the very fields that should drive access. Joinly reads exactly those fields, so provisioning follows your decisions rather than the payroll relationship.

• Flat department structure. Justworks puts a member in one department at a time with no department hierarchy. Joinly builds explicit mapping rules from title, department and office to the correct Entra groups and licences, so a flat source still drives a rich group model.

• UPN format with duplicate names. When two members share a name, a naive UPN rule produces collisions. Joinly applies custom transformation rules — a suffix, office code or controlled tiebreaker — so every UPN is unique and predictable from day one.

Joinly handles each of these by default with custom mapping and transformation.

Always audit-ready

Every account action Joinly performs is logged: who was affected, when it happened, which access changed and which Justworks change triggered it. For NIS2 that matters directly: access can be traced back to an authorised HR source rather than an ad-hoc request. Joinly is ISO 27001 certified, runs in an EU data centre in Amsterdam, applies least-privilege by default, and is built to meet NIS2 and ISO 27001.

Example case

Picture a creative agency of around 120 people across two offices, running Justworks for payroll and HR while its Microsoft 365 accounts are set up by hand. New designers, producers and freelancers arrive in bursts around big campaigns, and every one of them starts as a message to the office manager who creates the account, guesses the right groups and picks a licence. Freelancers routinely end up with full staff licences that nobody remembers to cancel, and when a contract ends the account often lingers for weeks.

Connect Justworks to Microsoft Entra ID with Joinly and that work disappears. Joinly reads each member change in Justworks and acts on it automatically: new employees have their account, Microsoft 365 licence and group access ready on day one, contractors get a scoped account with no full licence, role changes swap the right groups the same day, and leavers are disabled when their end date passes with a soft-delete grace window.

“We used to give every freelancer a full licence and forget to turn it off. Now a designer is ready on day one, a freelancer gets exactly what the project needs, and nothing lingers after a contract ends.” — Head of IT, creative agency

The outcome this setup is designed for: onboarding drops from days to zero touch, contractor accounts stop leaking licence spend, and the team can show exactly which Justworks change created every bit of access.