How does Joinly sync Personio to Microsoft Entra ID?

Joinly reads each HR change in Personio through the REST API and applies it to the matching Entra ID account automatically. Personio holds the authoritative employee record, so it is the starting point for each identity action.

1. Joiner. HR completes the hire in Personio. Joinly reads the new employee record and determines the role from attributes like department, position, office and employment type. It then creates the account in Entra ID, assigns the right licences and maps the person into the correct groups — timed to the hire date held in Personio.

2. Mover. When someone changes position, department, office or legal entity in Personio, Joinly updates their group membership, permissions and licences to match. Access that no longer fits the new role is revoked, so permissions stay aligned with the actual job — including when a fixed-term contract converts to permanent.

3. Leaver. On the termination date recorded in Personio, Joinly disables the Entra ID account automatically. There are no orphaned accounts left active after someone has left, and a fixed-term contract ending is treated the same as any other departure, so working students and interns are offboarded on schedule too.

Example: A European SaaS scale-up hires a customer-success manager in Personio with a hire date next Monday, in its German legal entity. Joinly reads the record, waits until the hire date, creates the Entra ID account, assigns a Microsoft 365 E3 licence and adds the new joiner to the DE-CustomerSuccess group. When a working student in the same team is later given a fixed-term permanent contract, Joinly reads the employment-type change and swaps the limited licence for a full one the same day.

What manual user management costs

Without automation, every account starts as a Personio note or a line in a spreadsheet that IT works through by hand. Personio’s own Marketplace integration for Entra ID can create, update and deactivate users, but it explicitly does not add them to groups and has no role-to-group logic — so the part that actually decides access still falls to people.

• Onboarding delays. New joiners wait for accounts, licences and group access while a request sits in a queue, losing productive days in their first week.

• Permissions that don’t keep up (privilege creep). When movers change position or legal entity, old access often stays attached, so people accumulate rights they no longer need.

• Forgotten offboarding. Accounts that aren’t disabled on time are both a security and audit risk, and unused licences keep costing money — fixed-term and working-student contracts that simply end are especially easy to miss.

Joinly vs. the native Personio Entra integration

Personio’s Marketplace integration for Microsoft Entra ID is a fine baseline for pushing employee records, but it stops short of the part that actually decides access. Here’s how the two compare for a Personio-driven setup.

Watch-outs when connecting Personio to Microsoft Entra ID

A few Personio-specific details decide whether this connection stays reliable at scale.

• Employment types drive different access. Personio distinguishes permanent, fixed-term, working student, intern and freelancer. A naive rule gives them all the same access. Joinly reads the employment type and assigns the right licence and groups, so a working student doesn’t get a full-employee Microsoft 365 plan.

• Mapping department, position and legal entity to Entra groups. Department, team, office, position and legal entity don’t translate one-to-one to Entra ID groups. Joinly builds explicit mapping rules from those structures to the correct groups and licences, so role drives access rather than the manual assignment the native integration leaves to you.

• The v1-to-v2 API transition. Personio is retiring the classic v1 endpoints in 2026 in favour of a v2 OAuth 2.0 API. Joinly handles both and keeps the connection working across the change, so you don’t have to re-plumb your provisioning when the old endpoints are switched off.

• UPN format with duplicate names. When two employees share a name, a naive UPN rule produces collisions. Joinly applies custom transformation rules — a suffix, legal-entity code or controlled tiebreaker — so every UPN is unique and predictable from day one.

• Custom attributes and EU data residency. Personio custom attributes aren’t all exposed by default, and as a European HR system it carries works-council and GDPR expectations about what leaves it. Joinly maps the custom fields you need via Liquid templates and keeps all data in an EU data centre, so only the attributes you choose are synced.

Joinly handles each of these by default with custom mapping and transformation.

Always audit-ready

Every account action Joinly performs is logged: who was affected, when it happened, which access changed and which Personio change triggered it. For NIS2 that matters directly: access can be traced back to an authorised HR source rather than an ad-hoc request. Joinly is ISO 27001 certified, runs in an EU data centre in Amsterdam, applies least-privilege by default, and is built to meet NIS2 and ISO 27001 — and EU data residency makes works-council sign-off far easier.

Example case

Picture a European SaaS scale-up with around 900 employees across Germany, the Netherlands and Spain, running Personio as its HR core while its identity provisioning never quite keeps up. The native Personio-to-Entra integration creates the accounts, but because it doesn’t add users to groups, IT still hand-assigns every licence and security group — and with a steady mix of working students, interns and fixed-term contracts, the wrong people end up with full Microsoft 365 plans.

Connect Personio to Microsoft Entra ID with Joinly and that work disappears. Joinly reads each HR change in Personio at the source and acts on it automatically: new hires have their account, the right licence and group access ready on their hire date, role changes swap the right groups the same day, working students get a limited plan that upgrades automatically when their contract converts, and leavers are disabled on their termination date with a 30-day soft-delete grace window — all inside EU data centres.

“The native sync put people in Entra but not in any groups, so IT did the access by hand for every working student and intern. Now the right groups and the right licence are simply there on the hire date, and our works council is comfortable because nothing leaves the EU.” — Head of People Operations, European SaaS scale-up

The outcome this setup is designed for: onboarding drops from days to zero touch, employment-type licence mistakes stop entirely, and the team can walk into its next NIS2 assessment with a complete, source-backed audit trail.