Connect Oracle EBS HR to Microsoft Entra ID

How does Joinly sync Oracle EBS HR to Microsoft Entra ID?

Joinly reads each HR change in Oracle E-Business Suite HRMS — through the supported public APIs or a scheduled effective-dated extract — and applies it to the matching Entra ID account automatically. EBS HRMS holds the authoritative person and assignment record, so it is the starting point for each identity action.

1. Joiner. HR completes the hire in EBS HRMS. Joinly reads the new person and assignment records and determines the role from attributes like HR organization, position, job and legal entity. It then creates the account in Entra ID, assigns the right licences and maps the person into the correct groups — timed to the assignment’s effective start date.

2. Mover. When someone’s assignment changes position, HR organization or legal entity in EBS, Joinly updates their group membership, permissions and licences to match. Access that no longer fits the new assignment is revoked, so permissions stay aligned with the actual job.

3. Leaver. On the termination date recorded against the assignment in EBS, Joinly disables the Entra ID account automatically. There are no orphaned accounts left active after someone has left, and multiple assignments are taken into account so access is only removed when the person’s last active assignment ends.

Example: A global manufacturer runs EBS HRMS across several business groups and hires a process engineer with an effective start date next Monday in its German legal entity. Joinly reads the DateTrack record, waits until the start date, creates the Entra ID account, assigns an Office E3 licence and adds the engineer to the DE-Operations group. When that engineer later picks up a second, secondary assignment in a shared-services organization, Joinly keeps the primary assignment as the driver of the UPN and adds the extra group without breaking sign-in.

What manual user management costs

Without automation, every account starts as an EBS HR ticket or a line in a BI Publisher extract that IT works through by hand. A custom PL/SQL feed or an Oracle Identity Governance connector can move person data across, but they don’t map work structures to groups, and they stumble on DateTrack effective dating and multiple assignments — so the part that actually decides access still falls to people.

• Onboarding delays. New joiners wait for accounts, licences and group access while a ticket sits in a queue, losing productive days in their first week.

• Permissions that don’t keep up (privilege creep). When movers change assignment, position or legal entity, old access often stays attached, so people accumulate rights they no longer need.

• Forgotten offboarding. Accounts that aren’t disabled on time are both a security and audit risk, and unused licences keep costing money — and with multiple assignments it is easy to disable an account while another assignment is still active.

Joinly vs. a custom EBS extract or OIG connector

There is no native Entra provisioning app for on-premise EBS HR, so the alternative is a home-built PL/SQL / BI Publisher extract or an Oracle Identity Governance connector. Either is a fine baseline, but stops short of the part that actually decides access. Here’s how they compare for an EBS HRMS-driven setup.

Watch-outs when connecting Oracle EBS HR to Microsoft Entra ID

A few EBS-specific details decide whether this connection stays reliable at scale.

• DateTrack effective-dating. EBS HRMS stores every change with an effective date, and DateTrack modes mean a record can have a future row, a corrected row and historical rows at once. Reading the wrong effective row provisions the wrong state. Joinly reads the record effective on the right date and times account creation to it, so access is ready on the start date and not before.

• Multiple assignments. A person can hold several assignments in EBS but only one is marked primary. A naive read can drive the identity from a secondary — or terminated — assignment and break sign-in. Joinly applies explicit rules to pick the primary assignment as the driver of the UPN, while still reflecting the extra access.

• Business group and multi-org scope. EBS data is partitioned by business group and operating unit (MOAC). An integration scoped to the wrong business group sees the wrong population. Joinly reads the right scope and maps business group, legal entity and HR organization to the correct Entra groups and licences.

• Public API vs direct-table access. Direct writes to EBS tables are unsupported, and Oracle’s public HR_* APIs don’t auto-commit. Joinly integrates through the supported read path — public APIs or a controlled extract — so the connection stays upgrade-safe and doesn’t corrupt HRMS data.

• UPN format with duplicate names. When two employees share a name, a naive UPN rule produces collisions. Joinly applies custom transformation rules — a suffix, legal-entity code or controlled tiebreaker — so every UPN is unique and predictable from day one.

Joinly handles each of these by default with custom mapping and transformation.

Always audit-ready

Every account action Joinly performs is logged: who was affected, when it happened, which access changed and which Oracle EBS HR change triggered it. For NIS2 that matters directly: access can be traced back to an authorised HR source rather than an ad-hoc request. Joinly is ISO 27001 certified, runs in an EU data centre in Amsterdam, applies least-privilege by default, and is built to meet NIS2 and ISO 27001.

Example case

Picture a global manufacturer with around 9,000 employees across several business groups, running Oracle E-Business Suite HRMS as its HR core while its identity provisioning never quite keeps up. A home-built BI Publisher extract feeds a nightly script into Entra ID, but it handles only the simple cases — internal transfers between legal entities, secondary assignments in shared-services and future-dated hires keep breaking it. Engineers who pick up a second assignment end up with the wrong assignment driving their account, and future-dated hires are provisioned the night HR keys the record rather than on the effective start date.

Connect Oracle EBS HR to Microsoft Entra ID with Joinly and that work disappears. Joinly reads each HR change in EBS HRMS at the source and acts on it automatically: new hires have their account, Office licence and group access ready on the effective start date, transfers between legal entities swap the right groups the same day, secondary assignments keep a single, stable UPN, and leavers are disabled on their termination date with a 30-day soft-delete grace window.

“Multiple assignments used to be the thing that broke every sync. Now an account is simply ready on the effective start date, a second assignment just adds access, and we can show the auditor exactly which EBS change created every bit of access.” — Head of IT, global manufacturer

The outcome this setup is designed for: onboarding drops from days to zero touch, assignment errors stop entirely, and the team can walk into its next NIS2 assessment with a complete, source-backed audit trail.