How does Joinly sync Namely to Microsoft Entra ID?

Joinly reads each HR change in Namely through the REST API and applies it to the matching Entra ID account automatically. Namely holds the authoritative employee record, so its Profiles endpoint is the starting point for every identity action.

1. Joiner. HR completes the hire in Namely. Joinly reads the new profile — job title, department, the Groups the person belongs to and their reports-to manager — and determines the role from those attributes. It then creates the account in Entra ID, assigns the right licences and maps the person into the correct groups, ready on the recorded start date.

2. Mover. When someone’s job title, department or Group membership changes in Namely, Joinly updates their Entra ID group membership, permissions and licences to match. Access that no longer fits the new role is revoked, so permissions stay aligned with the actual job.

3. Leaver. When a profile’s user_status changes to an inactive status on the termination date in Namely, Joinly disables the Entra ID account automatically. There are no orphaned accounts left active after someone has left, and rehires are matched back to the existing account instead of creating a duplicate.

Example: A digital media company hires a video editor in Namely, in its Content department, with a start date next Monday. Joinly reads the profile, waits until the start date, creates the Entra ID account, assigns a Microsoft 365 E3 licence and adds the editor to the Content-Production group based on their Namely Group. When that editor later moves into the Brand team, Joinly swaps the group membership the same day, without anyone opening a ticket.

What manual user management costs

Without automation, every account starts as a Namely note or a line in a spreadsheet that IT works through by hand. Namely’s Entra gallery app only covers single sign-on, and generic SCIM or third-party connectors move a few attributes across but map roles to groups by hand — so the part that actually decides access still falls to people.

• Onboarding delays. New joiners wait for accounts, licences and group access while a request sits in a queue, losing productive days in their first week.

• Permissions that don’t keep up (privilege creep). When movers change job title, department or Group in Namely, old access often stays attached, so people accumulate rights they no longer need.

• Forgotten offboarding. Accounts that aren’t disabled on time are both a security and audit risk, and unused licences keep costing money — and an SSO-only setup does nothing to deprovision the account behind the login.

Joinly vs. Namely’s native Entra options

Namely publishes an Entra/Azure AD gallery app for single sign-on, but there is no first-party inbound provisioning connector — so the alternative is Microsoft’s generic API-driven / SCIM inbound provisioning or a third-party SSO tool. Here’s how the two compare for a Namely-driven setup.

Watch-outs when connecting Namely to Microsoft Entra ID

A few Namely-specific details decide whether this connection stays reliable at scale.

• No native inbound provisioning. Namely’s Entra gallery app is single sign-on only, so nothing creates, updates or disables accounts on its own. Joinly reads the Namely REST API and drives the full joiner/mover/leaver lifecycle, so the account behind the login is actually managed.

• Mapping Groups and Group Types to Entra groups. Namely models structure through free-form Groups, Group Types, Departments and Divisions rather than a fixed hierarchy, so they don’t translate one-to-one to Entra ID groups. Joinly builds explicit mapping rules from those structures to the correct groups and licences, so role drives access rather than manual assignment.

• user_status and employee_type. Namely separates a profile’s user_status from its employee_type, and includes inactive and guest profiles. A naive rule can suspend or reactivate the wrong accounts. Joinly maps these states explicitly so only the intended profiles create, keep or lose an account.

• Resolving the reports-to manager. The manager is stored as a reports-to reference to another Namely profile. Joinly resolves that link to the correct Entra ID account, so the manager attribute and any manager-based rules stay accurate.

• UPN format with duplicate names. When two employees share a name, a naive UPN rule produces collisions. Joinly applies custom transformation rules — a suffix, department code or controlled tiebreaker — so every UPN is unique and predictable from day one.

Joinly handles each of these by default with custom mapping and transformation.

Always audit-ready

Every account action Joinly performs is logged: who was affected, when it happened, which access changed and which Namely change triggered it. For NIS2 that matters directly: access can be traced back to an authorised HR source rather than an ad-hoc request. Joinly is ISO 27001 certified, runs in an EU data centre in Amsterdam, applies least-privilege by default, and is built to meet NIS2 and ISO 27001.

Example case

Picture a digital media company with around 900 employees across three offices, running Namely as its HR core while its identity provisioning never quite keeps up. Namely’s Entra app handles single sign-on, but it doesn’t create or disable anything — so every new editor, producer or account manager still starts as a note that IT works through by hand in Entra ID, and freelancers and fixed-term contracts keep the queue full. New joiners regularly wait until day two for their account, and when someone moves between the Content and Brand teams their old group access lingers.

Connect Namely to Microsoft Entra ID with Joinly and that work disappears. Joinly reads each HR change in Namely at the source and acts on it automatically: new hires have their account, Microsoft 365 licence and group access ready on their start date, moves between teams swap the right groups the same day, inactive and guest profiles map to the correct account state, and leavers are disabled on their termination date with a 30-day soft-delete grace window.

“Single sign-on was never the problem — the account behind it was. Now an account is simply ready on the start date, a move just swaps the groups, and we can show exactly which Namely change created every bit of access.” — Head of IT, digital media company

The outcome this setup is designed for: onboarding drops from days to zero touch, privilege creep from old teams stops, and the team can walk into its next NIS2 assessment with a complete, source-backed audit trail.