How does Joinly sync Paychex Flex to Microsoft Entra ID?

Joinly reads each worker change in Paychex Flex through the Paychex Flex API and applies it to the matching Entra ID account automatically. Paychex Flex holds the authoritative worker record, so it is the starting point for each identity action — and once it’s set up, no one on your side has to touch it.

1. Joiner. A new hire is added in Paychex Flex. Joinly reads the worker across the API’s separate endpoints — the base worker, the job, the organization assignment and the communications (email) — and determines the role from department, location and job title. It then creates the Entra ID account, assigns the right Microsoft 365 licences and adds the person to the correct groups, timed to the hire date.

2. Mover. When a worker changes department, location or supervisor in Paychex Flex, Joinly updates their group membership, permissions and licences to match. Access that no longer fits the new role is revoked, so permissions stay aligned with the actual job — even though these moves happen in small, frequent batches with no one tracking them manually.

3. Leaver. When a worker’s status flips to terminated on their termination date in Paychex Flex, Joinly disables the Entra ID account automatically. There are no orphaned accounts left active after someone has left, and no unused licences quietly billing every month.

Example: A 40-person accounting firm runs Paychex Flex and Microsoft 365. It hires a junior auditor with a hire date next Monday in its Tax department. Joinly reads the worker, waits until the hire date, creates the Entra ID account, assigns a Business Premium licence and adds the auditor to the Tax-Staff group. When the firm later spins up a new ‘Advisory’ department and moves three people into it, Joinly picks up the new department on the next sync and swaps each person’s groups without anyone editing Entra ID by hand.

What manual user management costs

Without automation, every account starts as a note from the office manager or a line in a spreadsheet that someone works through by hand — and in a small Paychex Flex shop, that ‘someone’ usually isn’t an IT specialist. The native Paychex Flex Entra app only does single sign-on, so account creation, licences and group access are entirely manual, and Entra ID’s own SCIM provisioning needs a Premium P1/P2 licence per user that small clients rarely have.

• Onboarding delays. New joiners wait for accounts, licences and group access while the office manager finds time between other work, losing productive days in their first week.

• Permissions that don’t keep up (privilege creep). When workers move department or location, old access often stays attached, so people accumulate rights they no longer need — and with no IT review, no one catches it.

• Forgotten offboarding. Accounts that aren’t disabled on time are both a security and audit risk, and unused Microsoft 365 licences keep costing money every month after someone has gone.

Joinly vs. the native Paychex Flex options

The Paychex Flex Entra gallery app is single sign-on only — it provisions nothing. Buyers usually compare Joinly against third-party connectors (RoboMQ Hire2Retire, Aquera) or Entra ID’s own SCIM. Here’s how the options stack up for a small Paychex Flex client.

Watch-outs when connecting Paychex Flex to Microsoft Entra ID

A few Paychex Flex-specific details decide whether this connection stays reliable in a small organisation with no dedicated IT.

• No IT team to babysit the sync. Most Paychex Flex clients are small businesses without a dedicated admin or middleware. A sync that needs hand-holding will quietly fail. Joinly runs zero-touch in the cloud after setup, so the chain keeps working without anyone watching it.

• The worker is split across several API endpoints. The Paychex Flex API returns the base worker, the job, the organization assignment and the email on separate endpoints. A naive integration that reads only the base worker provisions an account with no department or email. Joinly joins all the endpoints into one complete record before it acts.

• Flat structure, frequent small changes. Small orgs have a handful of departments and locations that change often in ad-hoc ways — a new department, a renamed branch, a status set to leave. Joinly maps that structure to Entra groups with explicit rules and picks up each change on the next sync.

• Worker status nuances. Paychex Flex distinguishes active, leave and terminated. A worker on leave should keep an account; a terminated one should not. Joinly maps each status to the right Entra action so a temporary leave never disables a live account.

• UPN format with duplicate names. In a small firm, two people sharing a first name is common. Joinly applies custom transformation rules — a suffix or controlled tiebreaker — so every UPN is unique and predictable from day one.

Joinly handles each of these by default with custom mapping and transformation.

Always audit-ready

Every account action Joinly performs is logged: who was affected, when it happened, which access changed and which Paychex Flex change triggered it. For NIS2 that matters directly: access can be traced back to an authorised HR source rather than an ad-hoc request from the office manager. Joinly is ISO 27001 certified, runs in an EU data centre in Amsterdam, applies least-privilege by default, and is built to meet NIS2 and ISO 27001.

Example case

Picture a 40-person accounting firm running Paychex Flex for payroll and Microsoft 365 for everything else, with no IT department — the office manager handles new accounts between client deadlines. New auditors wait until day two or three for their login, leavers keep an active mailbox for weeks, and at tax season the temporary hires double the backlog. The native Paychex Flex Entra app only signs people in; it never creates the account in the first place.

Connect Paychex Flex to Microsoft Entra ID with Joinly and that work disappears. Joinly reads each worker change at the source and acts on it automatically: new hires have their account, Business Premium licence and group access ready on their hire date, a move into the new Advisory department swaps groups the same day, a status set to leave is handled correctly, and terminations disable the account on the termination date with a 30-day soft-delete grace window — all without anyone on staff touching Entra ID.

“We don’t have an IT person, so ‘set it and forget it’ was the only option that worked. Now an auditor’s account is simply ready on their first day, and at the next review we can show exactly which Paychex change created every login.” — Managing Partner, accounting firm

The outcome this setup is designed for: onboarding drops from days to zero touch, no one chases the office manager for a login, and the firm can show a complete, source-backed audit trail without ever hiring an IT admin.