How does Joinly sync PeopleStrong to Microsoft Entra ID?

Joinly reads each HR change in PeopleStrong through its REST API and applies it to the matching Entra ID account automatically. PeopleStrong holds the authoritative employment record, so it is the starting point for each identity action.

1. Joiner. HR completes the hire in PeopleStrong. Joinly reads the new worker record — Org Unit, Worksite, Entity, job title and manager — and determines the role from those attributes. It then creates the account in Entra ID, assigns the right licences and maps the person into the correct groups.

2. Mover. When someone changes Org Unit, Worksite or Entity in PeopleStrong, Joinly updates their group membership, permissions and licences to match. Access that no longer fits the new position is revoked, so permissions stay aligned with the actual job.

3. Leaver. On the termination date recorded in PeopleStrong, Joinly disables the Entra ID account automatically. There are no orphaned accounts left active after someone has left, and a soft-delete grace window keeps the account recoverable before it is removed.

Example: An Indian retail group runs PeopleStrong across several store banners held under different Entities. It hires a category buyer for its Mumbai head office. Joinly reads the new record, creates the Entra ID account, assigns a Microsoft 365 licence and adds the buyer to the Merchandising group based on the Org Unit — while keeping the person tied to the correct Entity for reporting. When that buyer later transfers to a regional distribution Entity, Joinly swaps the groups the same day without breaking sign-in.

What manual user management costs

Without automation, every account starts as a PeopleStrong ticket or a line in a spreadsheet that IT works through by hand. Microsoft’s API-driven inbound provisioning can ingest data once you build and maintain the pipeline that pulls it from PeopleStrong, but it maps roles to groups through manual expression rules — so the part that actually decides access still falls to people.

• Onboarding delays. New joiners wait for accounts, licences and group access while a ticket sits in a queue, losing productive days in their first week.

• Permissions that don’t keep up (privilege creep). When movers change Org Unit, Worksite or Entity, old access often stays attached, so people accumulate rights they no longer need.

• Forgotten offboarding. Accounts that aren’t disabled on time are both a security and audit risk, and unused licences keep costing money.

Joinly vs. native Entra API-driven provisioning

Because PeopleStrong isn’t a pre-built Entra provisioning app, the native path is API-driven inbound provisioning — you build the pipeline that pulls PeopleStrong data and posts it to Microsoft Graph, then Entra applies mapping. Here’s how the two compare.

Watch-outs when connecting PeopleStrong to Microsoft Entra ID

A few PeopleStrong-specific details decide whether this connection stays reliable at scale.

• Multi-entity, multi-country group structures. In APAC enterprise deployments a worker can sit in one Entity and Worksite while reporting into an Org Unit somewhere else. A naive rule mixes these up and grants the wrong groups. Joinly maps Org Unit, Worksite and Entity as separate dimensions, so each one drives the right part of the access decision.

• Request-only API access. PeopleStrong provisions API access per tenant on request, with OAuth 2.0 credentials scoped to that tenant. Joinly’s setup assumes those credentials and the tenant token, so the connection is authenticated correctly from the first run rather than falling back to fragile exports.

• Full-load vs modified-data reconciliation. Relying only on the modified-data window can miss changes if a run is skipped or a record is backdated. Joinly combines the full-load and delta calls and reconciles them, so the Entra ID picture matches PeopleStrong even after an interruption.

• Mapping Org Units to Entra groups. The PeopleStrong Org Unit hierarchy doesn’t translate one-to-one to Entra ID groups. Joinly builds explicit mapping rules from Org Unit, Worksite and Entity to the correct groups and licences, so role drives access rather than manual assignment.

• UPN format with duplicate names. When two employees share a name, a naive UPN rule produces collisions. Joinly applies custom transformation rules — a suffix, an Entity code or the Employee Code as a controlled tiebreaker — so every UPN is unique and predictable from day one.

Joinly handles each of these by default with custom mapping and transformation.

Always audit-ready

Every account action Joinly performs is logged: who was affected, when it happened, which access changed and which PeopleStrong change triggered it. For NIS2 that matters directly: access can be traced back to an authorised HR source rather than an ad-hoc request. Joinly is ISO 27001 certified, runs in an EU data centre in Amsterdam, applies least-privilege by default, and is built to meet NIS2 and ISO 27001.

Example case

Picture an Indian retail group with around 8,000 employees across several store banners, each held under a different Entity, running PeopleStrong as its HR core while identity provisioning never quite keeps up. Store staff turn over quickly, transfers between banners are constant, and every new hire starts as a PeopleStrong ticket that IT works through by hand — so a new store associate often waits days for their Microsoft 365 account and access to the merchandising tools.

Connect PeopleStrong to Microsoft Entra ID with Joinly and that work disappears. Joinly reads each HR change at the source and acts on it automatically: new hires have their account, licence and group access ready without a ticket, transfers between banners swap the right groups the same day while keeping the person tied to the correct Entity, and leavers are disabled on their termination date with a 30-day soft-delete grace window.

“With store staff turning over constantly, provisioning by hand was a losing battle. Now an account is simply ready when someone starts, a transfer just swaps the groups, and we can show exactly which PeopleStrong change created every bit of access.” — Head of IT, retail group

The outcome this setup is designed for: onboarding drops from days to zero touch, transfers between entities stop causing access gaps, and the team can walk into its next NIS2 assessment with a complete, source-backed audit trail.