How does Joinly sync Loket to Microsoft Entra ID?

Joinly reads each HR change in Loket through the REST API and applies it to the matching Entra ID account automatically. Loket holds the authoritative werknemer and dienstverband record, so it is the starting point for each identity action.

1. Joiner. The salarisadministrateur enters the new werknemer and dienstverband in Loket. Joinly reads the new employee and employment records through the API, determines the role from attributes like department, function and werkgever, then creates the account in Entra ID, assigns the right licences and maps the person into the correct groups — timed to the start date of the dienstverband.

2. Mover. When someone changes function, department or werkgever in Loket, Joinly updates their group membership, permissions and licences to match. Access that no longer fits the new position is revoked, so permissions stay aligned with the actual job.

3. Leaver. On the end date of the dienstverband recorded in Loket, Joinly disables the Entra ID account automatically. There are no orphaned accounts left active after someone has left, and because a persoon can hold more than one dienstverband, access is only removed when the last active employment ends.

Example: A dental practice group runs Loket for payroll across several werkgevers under one administratiekantoor. It hires a dental hygienist with a start date next Monday. Joinly reads the new dienstverband through the API, waits until the start date, creates the Entra ID account, assigns a Microsoft 365 Business licence and adds the hygienist to the Clinic-North group. When that hygienist later picks up a second, part-time dienstverband at another practice in the group, Joinly keeps a single stable UPN and adds the extra group without breaking sign-in.

What manual user management costs

Without automation, every account starts as an email from the salarisadministratie or a line in a spreadsheet that IT works through by hand. Loket exposes a clean REST API, but a raw connector only moves fields across — it has no concept of role-to-group mapping, no UPN rules, and no logic for a person with more than one dienstverband, so the part that actually decides access still falls to people.

• Onboarding delays. New joiners wait for accounts, licences and group access while a request sits in a queue, losing productive days in their first week.

• Permissions that don’t keep up (privilege creep). When movers change function or werkgever, old access often stays attached, so people accumulate rights they no longer need.

• Forgotten offboarding. Accounts that aren’t disabled on time are both a security and audit risk, and unused licences keep costing money — and with multiple dienstverbanden it is easy to disable an account while another contract is still active.

Joinly vs. a raw Loket API connector

Loket’s REST API is a clean, well-documented source, but reading it is only half the job. A generic iPaaS or HRIS connector moves attributes; it stops short of the part that actually decides access. Here’s how the two compare for a Loket-driven setup.

Watch-outs when connecting Loket to Microsoft Entra ID

A few Loket-specific details decide whether this connection stays reliable at scale.

• Accountant-administered provider structure. In Loket, one administratiekantoor (provider) often spans many client werkgevers, each with its own administratie. The API call has to be scoped to the right providerId and employer, or you sync the wrong company’s people. Joinly pins the connection to your werkgever(s) and administraties, so only the intended population flows to Entra ID.

• No native UPN or email attribute. Loket is a payroll-first system: it stores name, function and dienstverband, not a userPrincipalName or corporate email. Joinly builds the UPN, display name and mail from your own transformation rules, so every account is consistent and predictable from day one.

• Multiple dienstverbanden per person. A single persoon can hold more than one dienstverband, sometimes across different werkgevers. A naive rule can sync a terminated or secondary employment to Entra ID and break sign-in. Joinly applies explicit rules to pick the right active dienstverband as the driver of the UPN, while still reflecting the extra access.

• Mapping Loket structure to Entra groups. Werkgever, administratie, department and function don’t translate one-to-one to Entra ID groups. Joinly builds explicit mapping rules from those structures to the correct groups and licences, so role drives access rather than manual assignment.

• UPN format with duplicate names. When two employees share a name, a naive UPN rule produces collisions. Joinly applies custom transformation rules — a suffix, werkgever code or controlled tiebreaker — so every UPN is unique and predictable.

Joinly handles each of these by default with custom mapping and transformation.

Always audit-ready

Every account action Joinly performs is logged: who was affected, when it happened, which access changed and which Loket change triggered it. For NIS2 that matters directly: access can be traced back to an authorised HR source rather than an ad-hoc request. Joinly is ISO 27001 certified, runs in an EU data centre in Amsterdam, applies least-privilege by default, and is built to meet NIS2 and ISO 27001.

Example case

Picture a dental and medical practice group with around 350 staff spread across a dozen clinics, all payrolled in Loket under one administratiekantoor. Each clinic is a separate werkgever with its own administratie, and hygienists, assistants and front-desk staff move between locations or pick up a second contract at a sister practice all the time. Every new starter arrives as an email from the salarisadministratie, and IT creates the Entra ID account, licence and group access by hand — so a new assistant often waits until day two or three to log in, and a second dienstverband regularly ends up as a duplicate account.

Connect Loket to Microsoft Entra ID with Joinly and that work disappears. Joinly reads each HR change in Loket at the source and acts on it automatically: new hires have their account, Microsoft 365 licence and clinic group access ready on the start date of the dienstverband, moves between clinics swap the right groups the same day, a second contract just adds access to a single stable UPN, and leavers are disabled on their end date with a 30-day soft-delete grace window.

“People moving between clinics and picking up second contracts used to be what broke every sync. Now an account is simply ready on the start date, a second dienstverband just adds access, and we can show the auditor exactly which Loket change created every bit of access.” — Head of IT, dental and medical practice group

The outcome this setup is designed for: onboarding drops from days to zero touch, duplicate accounts from second contracts stop entirely, and the team can walk into its next NIS2 assessment with a complete, source-backed audit trail.