How does Joinly sync Lucca to Microsoft Entra ID?

Joinly reads each HR change in Lucca through its API and applies it to the matching Entra ID account automatically. The Lucca directory holds the authoritative record for who someone is and where they sit in the organisation, so it is the starting point for each identity action.

1. Joiner. HR completes the hire in Lucca. Joinly reads the new user, its department, legal entity and manager, and determines the role from those attributes. It then creates the account in Entra ID, assigns the right licences and maps the person into the correct groups — timed to the contract start date rather than the moment HR saved the record.

2. Mover. When someone changes department, manager or legal entity in Lucca, Joinly updates their group membership, permissions and licences to match. Access that no longer fits the new position is revoked, so permissions stay aligned with the actual job.

3. Leaver. On the contract end date recorded in Lucca, Joinly disables the Entra ID account automatically. There are no orphaned accounts left active after someone has left, and you can add a soft-delete grace window before the account is retired for good.

Example: A French consultancy hires a consultant in Lucca with a start date next Monday, in its Paris legal entity and the Advisory department. Joinly reads the contract start date, waits until the start date, creates the Entra ID account, assigns a Microsoft 365 E3 licence and adds the consultant to the Advisory group. When that consultant later transfers to the Data department, Joinly swaps the group membership the same day and leaves the UPN untouched, so sign-in never breaks.

What manual user management costs

Without automation, every account starts as a Lucca notification or a line in a spreadsheet that IT works through by hand. Because Lucca has no native Entra provisioning connector, the alternative is a custom SCIM client you build and maintain yourself with Entra’s API-driven inbound provisioning — which can move attributes but leaves the role-to-group and timing logic to you. Either way, the part that actually decides access still falls to people.

• Onboarding delays. New joiners wait for accounts, licences and group access while a ticket sits in a queue, losing productive days in their first week.

• Permissions that don’t keep up (privilege creep). When movers change department or legal entity, old access often stays attached, so people accumulate rights they no longer need.

• Forgotten offboarding. Accounts that aren’t disabled on time are both a security and audit risk, and unused licences keep costing money — especially easy to miss when the contract end date lives in Lucca but the account lives in Entra.

Joinly vs. Entra API-driven inbound provisioning

Lucca has no dedicated Entra gallery connector, so the native path is a custom SCIM client built on Entra’s API-driven inbound provisioning. It’s a fine baseline, but it stops short of the part that actually decides access. Here’s how the two compare for a Lucca-driven setup.

Watch-outs when connecting Lucca to Microsoft Entra ID

A few Lucca-specific details decide whether this connection stays reliable at scale.

• Modular suite, one shared directory. Lucca splits into modules — Figgo for leave, Timmi for time, Pagga for payroll — that share a single directory but keep their own data. A naive read can miss the field that should drive access. Joinly reads the shared directory alongside the module data you need, so the right attribute decides the account, not a flat export.

• Mapping the department tree and legal entities. Lucca’s department is a hierarchical tree (with parentId and level) and legal entity is a separate axis; neither maps one-to-one to Entra ID groups. Joinly builds explicit mapping rules from that structure to the correct groups and licences, so role drives access rather than manual assignment.

• Contract start and end dates. Lucca stores contract start and end dates (dtContractStart / dtContractEnd) that can be set in the future. Joinly times account creation to the start date and disablement to the end date, so access is ready on the right day and removed on time.

• UPN format with duplicate names. When two employees share a name, a naive UPN rule produces collisions. Joinly applies custom transformation rules — a suffix, legal-entity code or controlled tiebreaker — so every UPN is unique and predictable from day one.

• API generation change (v3 to v5). Lucca’s v3 API is legacy and v5 is the strategic target; some v3 routes stop responding in September 2026. Joinly maintains the connection against the supported API shape, so your provisioning doesn’t break on a deprecated route.

Joinly handles each of these by default with custom mapping and transformation.

Always audit-ready

Every account action Joinly performs is logged: who was affected, when it happened, which access changed and which Lucca change triggered it. For NIS2 that matters directly: access can be traced back to an authorised HR source rather than an ad-hoc request. Joinly is ISO 27001 certified, runs in an EU data centre in Amsterdam, applies least-privilege by default, and is built to meet NIS2 and ISO 27001.

Example case

Picture a French consultancy with around 900 employees across three offices, running Lucca — Figgo for leave and Timmi for time — as its HR core while identity provisioning never quite keeps up. There is no native Lucca-to-Entra connector, so a couple of scheduled scripts read the Lucca API and push accounts into Entra ID, but internal transfers between departments and a steady flow of consultants on fixed-term contracts keep breaking them — new joiners are created the moment HR saves the record rather than on their start date, and department moves need a manual group change.

Connect Lucca to Microsoft Entra ID with Joinly and that work disappears. Joinly reads each HR change in the Lucca directory at the source and acts on it automatically: new hires have their account, Microsoft 365 licence and group access ready on their contract start date, transfers between departments swap the right groups the same day, and leavers are disabled on their contract end date with a 30-day soft-delete grace window.

“We used to babysit two scripts that broke every time someone changed department. Now an account is simply ready on the start date, a transfer just swaps the groups, and we can show the auditor exactly which Lucca change created every bit of access.” — Head of IT, consultancy firm

The outcome this setup is designed for: onboarding drops from days to zero touch, transfer errors stop entirely, and the team can walk into its next NIS2 assessment with a complete, source-backed audit trail.