How does Joinly sync Liantis to Active Directory?

Joinly reads each change in your Liantis personnel file in the cloud, then hands the action to the Joinly AD Agent inside your network, which makes the change in Active Directory. Liantis holds the authoritative employment record; the agent is the only component that touches your domain.

1. Joiner. HR records the new hire in Liantis and the Dimona is declared. Joinly reads the new employment record, determines the role from job, joint committee and cost data, and instructs the AD Agent to create the user in the correct OU, build the sAMAccountName and UPN from your rules, and add the right security groups — timed to the effective start date.

2. Mover. When someone changes job, department or contract in Liantis, Joinly tells the agent to move the user to the matching OU, swap security-group membership and update attributes. Access that no longer fits the new position is removed, so permissions stay aligned with the actual job.

3. Leaver. When Liantis records the end of the employment, Joinly instructs the agent to disable the AD account on the termination date and optionally move it to a disabled-users OU, so no login stays active after the contract has ended.

Example: A Belgian transport and logistics company runs its payroll through Liantis and an on-premise AD across three depots. It hires a warehouse driver with a start date next Monday. Joinly reads the employment record, and on Monday morning the AD Agent creates the user in the Depot-North > Operations OU, sets a unique sAMAccountName built from name rules, and adds the Logistics-Drivers group. When the driver later moves to dispatch, the agent moves the object to the new OU and swaps the groups the same day.

What manual AD account management costs

Without automation, every account starts as an export from My Liantis or a message from the payroll administrator that an admin works through in Active Directory Users and Computers by hand — creating the object, choosing the OU, building the sAMAccountName, adding groups. Liantis is a payroll and social-secretariat system with no native path to AD, so every one of those decisions falls to people.

• Onboarding delays. New joiners wait for an AD account and group access while a request sits in a queue, losing productive days in their first week.

• Permissions that don’t keep up (privilege creep). When movers change job or depot, old security-group membership often stays attached, so people accumulate rights they no longer need.

• Forgotten offboarding. Accounts that aren’t disabled on time are a security and audit risk — especially with the high driver and warehouse turnover typical of logistics.

Joinly vs. the Entra provisioning agent for AD

Liantis has no native path to on-premise AD, so the realistic alternatives are a manual My Liantis export re-keyed in AD, or wiring a generic HRIS feed into Microsoft’s Entra provisioning agent. Here’s how the Joinly AD Agent compares to that native agent path.

Watch-outs when connecting Liantis to Active Directory

A few details decide whether this connection stays reliable at scale.

• sAMAccountName uniqueness and length. AD limits the sAMAccountName to 20 characters and it must be unique across the domain. Joinly builds it from your rules with a fallback pattern, so duplicate names never produce a collision or a truncated, unreadable login — and the rijksregisternummer is never used to force uniqueness.

• OU placement from a payroll-shaped record. Liantis structures the record for the sociaal secretariaat — job, joint committee, cost data — not for your OU tree. Joinly builds explicit rules that derive the correct OU from those fields and move the user on a transfer.

• Start date behind the Dimona. The employment record can exist before the person’s real first working day, tied to the Dimona declaration. Joinly reads the effective start date and has the agent create the account on the right day, not before.

• The national number is sensitive. The rijksregisternummer (INSZ/NISS) uniquely identifies a person in Liantis but must never become a login or username. Joinly uses it only for matching where appropriate and builds the sAMAccountName and UPN from name rules instead.

• Service-account permissions. The agent acts under a service account with delegated rights. Joinly works with least-privilege delegation scoped to the target OUs, so the agent can create, move and disable users without domain-admin rights.

Joinly handles each of these by default with custom mapping and transformation.

Always audit-ready

Every account action the Joinly AD Agent performs is logged in the Joinly cloud: who was affected, when it happened, which OU and groups changed and which Liantis change triggered it. For NIS2 that matters directly: access can be traced back to an authorised HR source rather than an ad-hoc request. Joinly is ISO 27001 certified, runs in an EU data centre in Amsterdam, applies least-privilege by default, and is built to meet NIS2 and ISO 27001.

Example case

Take a Belgian transport and logistics company with around 900 employees across four depots, running its payroll through Liantis but still living in an on-premise Active Directory for its warehouse and planning systems. Every new driver, warehouse worker or planner starts as an export from My Liantis that IT processes by hand in AD — creating the object, choosing the depot OU, building the login, adding groups. With high turnover and seasonal peaks the queue never empties, and new starters wait until day two or three for their account.

Connect Liantis to Active Directory with Joinly and that work disappears. The Joinly AD Agent creates each user in the right depot OU on the start date, builds a unique sAMAccountName from name rules, adds the correct security groups, moves people on a transfer and disables accounts on the contract end date with a 30-day grace window — all driven by the change in the Liantis personnel file, and never using the rijksregisternummer as a login.

“With this turnover we couldn’t keep AD in step with Liantis by hand. Now an account is ready in the right depot OU on the first shift, transfers move themselves, and leavers are gone on the contract end date.” — Head of IT, transport and logistics company

The outcome this setup is designed for: onboarding drops from days to zero touch, privilege creep from old depot roles is eliminated, and the team can walk into its next NIS2 assessment with a complete, source-backed audit trail.