How does Joinly sync PayFit to Microsoft Entra ID?

Joinly reads each HR change in PayFit through the REST API and applies it to the matching Entra ID account automatically. PayFit holds the authoritative collaborator and contract record, so it is the starting point for each identity action.

1. Joiner. HR completes the hire in PayFit. Joinly reads the new collaborator and their active contract and determines the role from attributes like job title, department, company and manager. It then creates the account in Entra ID, assigns the right licences and maps the person into the correct groups — timed to the contract start date.

2. Mover. When a collaborator changes role, department or company in PayFit, or a new contract becomes the active one, Joinly updates their group membership, permissions and licences to match. Access that no longer fits the new position is revoked, so permissions stay aligned with the actual job.

3. Leaver. On the contract end date recorded in PayFit, Joinly disables the Entra ID account automatically. There are no orphaned accounts left active after someone has left, and where a collaborator holds more than one contract, access is only removed when the last active contract ends.

Example: A French tech scale-up hires a back-end engineer in PayFit with a start date next Monday, on a French company (SIRET). Joinly reads the collaborator and contract, waits until the start date, creates the Entra ID account, assigns a Microsoft 365 E3 licence and adds the engineer to the FR-Engineering group. When that person later picks up a second contract on the group’s Spanish entity, Joinly keeps a single stable UPN and adds the extra group rather than creating a duplicate account.

What manual user management costs

Without automation, every account starts as a PayFit change that IT works through by hand or a line in a spreadsheet. A generic HRIS/iPaaS connector can move PayFit attributes into Entra ID, but it maps roles to groups through hand-built rules and doesn’t understand PayFit’s contract model — so the part that actually decides access still falls to people.

• Onboarding delays. New joiners wait for accounts, licences and group access while a request sits in a queue, losing productive days in their first week.

• Permissions that don’t keep up (privilege creep). When movers change role, company or contract, old access often stays attached, so people accumulate rights they no longer need.

• Forgotten offboarding. Accounts that aren’t disabled on time are both a security and audit risk, and unused licences keep costing money — and with multi-contract collaborators it is easy to disable an account while another contract is still active.

Joinly vs. a generic HRIS connector

There is no Microsoft-published PayFit inbound provisioning app, and Entra Cloud Sync can’t read PayFit, so the realistic alternative is a generic unified-HRIS or iPaaS connector. It’s a fine pipe for attributes, but it stops short of the part that actually decides access. Here’s how the two compare for a PayFit-driven setup.

Watch-outs when connecting PayFit to Microsoft Entra ID

A few PayFit-specific details decide whether this connection stays reliable at scale.

• The contract is the central object. In PayFit a collaborator is always tied to one or more contracts, and by default PayFit exposes the last active contract only. A naive rule can therefore drive a stale or wrong contract into Entra ID. Joinly applies explicit rules to pick the contract that should own the account, so the identity reflects the person’s real current position.

• Multi-contract and rehired collaborators. A collaborator can hold more than one active contract, or return on a new one. Joinly keeps a single, stable UPN driven by the primary contract while still reflecting the extra access, so a second contract adds groups rather than creating a duplicate account.

• Multi-country structure (SIREN / SIRET). PayFit organises data as a holding (SIREN) with one or more companies (SIRET), and endpoints and fields differ per country. Joinly builds mapping rules per company, so a French, Spanish, German or UK entity each lands in the right Entra groups and licences.

• UPN format with duplicate names. When two collaborators share a name, a naive UPN rule produces collisions. Joinly applies custom transformation rules — a suffix, company code or controlled tiebreaker — so every UPN is unique and predictable from day one.

• Country-specific and custom fields. Not every PayFit attribute is available on every plan or country. Joinly maps the fields you actually have via Liquid templates, so attributes like a local employee number or cost centre land in the right place.

Joinly handles each of these by default with custom mapping and transformation.

Always audit-ready

Every account action Joinly performs is logged: who was affected, when it happened, which access changed and which PayFit change triggered it. For NIS2 that matters directly: access can be traced back to an authorised HR source rather than an ad-hoc request. Joinly is ISO 27001 certified, runs in an EU data centre in Amsterdam, applies least-privilege by default, and is built to meet NIS2 and ISO 27001.

Example case

Picture a French tech startup with around 220 employees across offices in Paris, Barcelona and Berlin, running PayFit as its HR and payroll core while its identity setup never quite keeps up. A generic HRIS connector pushes basic attributes into Entra ID, yet fast hiring, contractors converting to permanent staff and the odd person on a second contract across two entities keep breaking it — engineers with an extra contract end up with the wrong details synced, and new hires are provisioned the moment HR saves the record rather than on their actual start date.

Connect PayFit to Microsoft Entra ID with Joinly and that work disappears. Joinly reads each HR change in PayFit at the source and acts on it automatically: new hires have their account, Microsoft 365 licence and group access ready on their contract start date, a move between entities swaps the right groups the same day, a second contract keeps a single, stable UPN, and leavers are disabled on their end date with a 30-day soft-delete grace window.

“We were hiring faster than IT could create accounts, and multi-country contracts made it worse. Now an account is simply ready on the start date, a second contract just adds access, and we can show exactly which PayFit change created every bit of access.” — Head of IT, tech startup

The outcome this setup is designed for: onboarding drops from days to zero touch, multi-contract errors stop, and the team can walk into its next NIS2 assessment with a complete, source-backed audit trail.