How does Joinly sync Paylocity to Microsoft Entra ID?

Joinly reads each HR change in Paylocity through the Web Services API and applies it to the matching Entra ID account automatically. Paylocity holds the authoritative employee record, so it is the starting point for each identity action.

1. Joiner. HR completes the hire in Paylocity. Joinly reads the new employee record and determines the role from attributes like department, position, cost center and work location. It then creates the account in Entra ID, assigns the right licences and maps the person into the correct groups — timed to the hire date on the record.

2. Mover. When someone changes position, department, cost center or work location in Paylocity, Joinly updates their group membership, permissions and licences to match. Access that no longer fits the new role is revoked, so permissions stay aligned with the actual job — even when the change is a transfer to a different Paylocity company.

3. Leaver. When the employee’s status code in Paylocity flips to terminated on the effective date, Joinly disables the Entra ID account automatically. There are no orphaned accounts left active after someone has left, and a leave-of-absence status doesn’t trigger an unwanted disable.

Example: A nonprofit hires a programme coordinator in Paylocity with a start date next Monday, in cost center 4200 (Community Services) at its Denver work location. Joinly reads the record, waits until the start date, creates the Entra ID account, assigns a Microsoft 365 Business Premium licence and adds the coordinator to the Community-Services group. When that coordinator later transfers to the Grants department under a different Paylocity company in the client’s set, Joinly recognises the same person, keeps one account and swaps the groups the same day.

What manual user management costs

Without automation, every account starts as a Paylocity report or a line in a spreadsheet that IT works through by hand. Paylocity’s own Entra integration handles SSO and can push portal access via SCIM, but it provisions users into Paylocity — not the other way round — so the HR-driven account creation, role-to-group mapping and offboarding in Entra ID still fall to people.

• Onboarding delays. New joiners wait for accounts, licences and group access while a ticket sits in a queue, losing productive days in their first week.

• Permissions that don’t keep up (privilege creep). When movers change position or cost center, old access often stays attached, so people accumulate rights they no longer need.

• Forgotten offboarding. Accounts that aren’t disabled on time are both a security and audit risk, and unused licences keep costing money — and when a status code only changes inside Paylocity, IT may never hear about the leaver at all.

Joinly vs. Paylocity’s native Entra integration

Paylocity’s built-in Microsoft Entra integration covers SSO and SCIM into Paylocity, but it doesn’t provision identities the other way. For HR-driven provisioning into Entra ID, here’s how Joinly compares to the partner connectors people reach for instead.

Watch-outs when connecting Paylocity to Microsoft Entra ID

A few Paylocity-specific details decide whether this connection stays reliable at scale.

• Cost-center-driven org structure. In Paylocity the cost-center and labor-level hierarchy, not a tidy department tree, often defines where someone really sits. Joinly reads the cost-center / labor-level structure and builds explicit rules from it to the correct Entra ID groups and licences, so role drives access rather than manual assignment.

• Multiple companies under one client. A single Paylocity client can hold several companies, each with its own numeric Company ID, and a person can move between them. Joinly merges the population across company IDs into one identity per person, so a cross-company transfer swaps access instead of spawning a duplicate account.

• Customizable employee status codes. Employee Status in Paylocity is a client-defined code, not a fixed list, so ‘terminated’, ‘on leave’ and ‘active’ look different per company. Joinly maps your specific status codes to joiner, mover and leaver actions, so a leave of absence doesn’t disable an account and a real termination always does.

• UPN format with duplicate names. When two employees share a name, a naive UPN rule produces collisions. Joinly applies custom transformation rules — a suffix, work-location code or controlled tiebreaker — so every UPN is unique and predictable from day one.

• Hire date vs. entry date. HR often enters a new hire days or weeks before the start date. Joinly reads the hire date on the Paylocity record and times account creation to it, so access is ready on the right day and not the moment the record is saved.

Joinly handles each of these by default with custom mapping and transformation.

Always audit-ready

Every account action Joinly performs is logged: who was affected, when it happened, which access changed and which Paylocity change triggered it. For NIS2 that matters directly: access can be traced back to an authorised HR source rather than an ad-hoc request. Joinly is ISO 27001 certified, runs in an EU data centre in Amsterdam, applies least-privilege by default, and is built to meet NIS2 and ISO 27001.

Example case

Picture a nonprofit with around 900 staff and volunteers across three legal entities, running Paylocity for HR and payroll while its identity provisioning never quite keeps up. Programme staff sit under one Paylocity company, the retail-fundraising arm under another, and grant-funded roles move between cost centers throughout the year. IT learns about most changes from a forwarded payroll report, so new coordinators wait until day two or three for an account and old volunteer logins linger long after the grant ends.

Connect Paylocity to Microsoft Entra ID with Joinly and that work disappears. Joinly reads each HR change in Paylocity at the source and acts on it automatically: new hires have their account, Microsoft 365 licence and group access ready on their start date, a cost-center move swaps the right groups the same day, a transfer between the two Paylocity companies keeps one account, and leavers are disabled when their status code flips to terminated, with a 30-day soft-delete grace window.

“Volunteers and grant staff used to slip through the cracks between two Paylocity companies. Now an account is simply ready on the start date, a transfer just swaps groups, and we can show a funder’s auditor exactly which Paylocity change created every bit of access.” — Head of IT, national nonprofit

The outcome this setup is designed for: onboarding drops from days to zero touch, cross-company duplicates stop entirely, and the team can walk into its next NIS2 assessment with a complete, source-backed audit trail.