How does Joinly sync Remote to Microsoft Entra ID?

Joinly reads each employment change in Remote through the Remote API and applies it to the matching Entra ID account automatically. Remote holds the authoritative employment record — for EOR employees, direct-payroll employees and contractors — so it is the starting point for each identity action.

1. Joiner. HR completes the hire in Remote and the employment moves through its lifecycle to an active status. Joinly reads the new employment record, determines the role from attributes like job title, department, country and legal entity, and checks the employment_type. It then creates the account in Entra ID, assigns the right licences and maps the person into the correct groups — timed to the start of active employment rather than the moment the record was first created.

2. Mover. When someone changes job title, department, country or legal entity in Remote — or converts from contractor to EOR employee — Joinly updates their group membership, permissions and licences to match. Access that no longer fits the new position is revoked, so permissions stay aligned with the actual role.

3. Leaver. When a Remote employment reaches its termination_date and the status moves to ‘archived’, Joinly disables the Entra ID account automatically. There are no orphaned accounts left active after someone has left, and because a person can hold more than one engagement, access is only removed when their last active employment ends.

Example: A distributed SaaS company hires a support engineer in Colombia as an EOR employee, with a start date next Monday. Joinly reads the Remote employment, waits until it becomes active, creates the Entra ID account, assigns a Microsoft 365 E3 licence and adds the engineer to the Support-LATAM group. A month later a marketing contractor in Portugal is converted to a direct employee under Remote Global Payroll; Joinly sees the employment_type change and swaps the account from a limited contractor profile to a full-employee group set without creating a duplicate.

What manual user management costs

Without automation, every account starts as a note from HR or a line exported from Remote that IT works through by hand. You can pull the Remote API into a CSV or a PowerShell script, but that leaves the part that actually decides access — which worker type gets which account, which country drives the UPN, which role maps to which group — to people, and it drifts the moment the workforce changes.

• Onboarding delays. New joiners wait for accounts, licences and group access while a request sits in a queue, losing productive days in their first week — and cross-border EOR hires are exactly the ones most likely to fall through the cracks.

• Permissions that don’t keep up (privilege creep). When people change role, country or convert from contractor to employee, old access often stays attached, so they accumulate rights they no longer need.

• Forgotten offboarding. Accounts that aren’t disabled on time are both a security and audit risk, and unused licences keep costing money — easy to miss when an offboarding in Remote is just one status change among many countries.

Joinly vs. a scripted Remote API integration

Remote’s own integrations point inward — it syncs natively with HRIS and finance tools like Workday, HiBob, BambooHR and Personio — but it doesn’t ship a role-to-group provisioning connector to Entra ID. So the realistic alternative is a home-grown script against the Remote API. Here’s how the two compare.

Watch-outs when connecting Remote to Microsoft Entra ID

A few Remote-specific details decide whether this connection stays reliable across countries and worker types.

• Mixed worker types in one tenant. EOR employees, direct-payroll employees and contractors all live under the same Remote company but shouldn’t all become the same Entra ID account — a contractor rarely needs a full licence and internal groups. Joinly reads employment_type and applies a different account profile to each, so classification drives access.

• Multi-country and multi-entity workforces. Remote owns a legal entity in each country it operates in, and country decides which fields are populated. A single global UPN or group rule breaks the moment you hire in a new country. Joinly keys UPN, licence and group rules off the legal entity and country so every account is correct wherever the person sits.

• Employment lifecycle timing. A Remote hire moves through ‘created’ and ‘invited’ during self-enrollment before it becomes ‘active’, and only flips to ‘archived’ when the termination_date passes. Provisioning on record creation gives people access before they’ve onboarded. Joinly acts on the lifecycle transition, so the account is ready when employment goes active and disabled when it is archived.

• Contractor-to-employee conversions. When a contractor converts to an EOR or direct employee, a naive sync can leave a stale contractor account alongside a new employee one. Joinly matches on the person and upgrades the existing account in place, so there is no duplicate.

• UPN format across countries and duplicate names. A large, distributed workforce means name collisions and inconsistent local formats. Joinly applies custom transformation rules — a suffix, country or legal-entity code or controlled tiebreaker — so every UPN is unique and predictable from day one.

Joinly handles each of these by default with custom mapping and transformation.

Always audit-ready

Every account action Joinly performs is logged: who was affected, when it happened, which access changed and which Remote change triggered it. For NIS2 that matters directly: access can be traced back to an authorised HR source rather than an ad-hoc request. Joinly is ISO 27001 certified, runs in an EU data centre in Amsterdam, applies least-privilege by default, and is built to meet NIS2 and ISO 27001.

Example case

Picture a distributed SaaS company with around 700 people across 30-odd countries, running Remote as its HR core — a mix of EOR employees, a handful of direct employees where it owns a local entity, and a steady rotation of contractors. IT provisions Entra ID from a monthly Remote export dropped into a script, and it never quite keeps up: contractors end up with the same licences and internal groups as full employees, a new hire in a new country breaks the UPN rule, and people who converted from contractor to employee carry two accounts.

Connect Remote to Microsoft Entra ID with Joinly and that work disappears. Joinly reads each employment change in Remote at the source and acts on it automatically: EOR employees get their account, Microsoft 365 licence and groups the day they go active, contractors get a deliberately limited profile, conversions upgrade the existing account in place, UPNs stay unique per legal entity, and leavers are disabled when their employment is archived on the termination date.

“We hire in a new country most months, and the old export-and-script routine broke every time. Now a support engineer in Colombia is ready on day one, a contractor never gets an employee’s access by accident, and we can show exactly which Remote change created every account.” — Head of IT, distributed SaaS company

The outcome this setup is designed for: onboarding drops from days to zero touch across every country, contractors and employees stop being treated the same, and the team can walk into its next NIS2 assessment with a complete, source-backed audit trail.