How does Joinly sync rexx systems to Microsoft Entra ID?

Joinly reads each HR change in rexx through the rexx API and applies it to the matching Entra ID account automatically. rexx HR holds the authoritative personnel record, so it is the starting point for each identity action — and because the rexx export is bulk-oriented, Joinly compares each import against its last known state to work out exactly what changed.

1. Joiner. HR completes the hire in rexx. Joinly reads the new employee record and determines the role from attributes like Abteilung, Position and Kostenstelle. It then creates the account in Entra ID, assigns the right licences and maps the person into the correct groups — timed to the recorded start date (Eintrittsdatum).

2. Mover. When someone changes position, department or location (Standort) in rexx, Joinly updates their group membership, permissions and licences to match. Access that no longer fits the new position is revoked, so permissions stay aligned with the actual job.

3. Leaver. On the exit date (Austrittsdatum) recorded in rexx, Joinly disables the Entra ID account automatically. There are no orphaned accounts left active after someone has left, and a soft-delete grace window keeps the account recoverable for a set period.

Example: A German engineering firm hires a design engineer in rexx with a start date next Monday, in its Stuttgart Standort. Joinly reads the record, waits until the start date, creates the Entra ID account, assigns a Microsoft 365 E3 licence and adds the engineer to the DE-Engineering group. When that engineer later moves from the design department to project management, Joinly swaps the groups the same day and leaves nothing from the old role attached.

What manual user management costs

Without automation, every account starts as a rexx ticket or a line in a spreadsheet that IT works through by hand. A plain rexx CSV export or a generic API import can move attributes across, but it delivers a full list rather than the specific changes, maps nothing to groups, and has no concept of a joiner, mover or leaver — so the part that actually decides access still falls to people.

• Onboarding delays. New joiners wait for accounts, licences and group access while a ticket sits in a queue, losing productive days in their first week.

• Permissions that don’t keep up (privilege creep). When movers change position or location, old access often stays attached, so people accumulate rights they no longer need.

• Forgotten offboarding. Accounts that aren’t disabled on time are both a security and audit risk, and unused licences keep costing money — easy to miss when the source only delivers a full export rather than a clear leaver signal.

Joinly vs. a native rexx import to Entra ID

Entra Cloud Sync with a CSV or API feed (or a generic IAM connector on the rexx export) is a fine baseline, but it stops short of the part that actually decides access. Here’s how the two compare for a rexx-driven setup.

Watch-outs when connecting rexx systems to Microsoft Entra ID

A few rexx-specific details decide whether this connection stays reliable at scale.

• Bulk export, not delta updates. The rexx API export is primarily one-directional and returns the full population rather than only what changed, with no native joiner/mover/leaver event. Joinly compares each import against its last known state and turns the difference into precise account actions, so one HR change becomes exactly one Entra change.

• Mapping rexx org structures to Entra groups. Abteilung, Standort, Kostenstelle and Position from the Stellenplan don’t translate one-to-one to Entra ID groups. Joinly builds explicit mapping rules from those structures to the correct groups and licences, so role drives access rather than manual assignment.

• UPN format with duplicate names. When two employees share a name, a naive UPN rule produces collisions. Joinly applies custom transformation rules — a suffix, a Standort code or a controlled tiebreaker — so every UPN is unique and predictable from day one.

• Module and tenant variations. rexx is modular and hosted in different ways, so the exact fields exposed differ per tenant and module mix. Joinly maps the fields you actually have via Liquid templates, so a local personnel number or a custom attribute still lands in the right place.

Joinly handles each of these by default with custom mapping and transformation.

Always audit-ready

Every account action Joinly performs is logged: who was affected, when it happened, which access changed and which rexx change triggered it. For NIS2 that matters directly: access can be traced back to an authorised HR source rather than an ad-hoc request. Joinly is ISO 27001 certified, runs in an EU data centre in Amsterdam, applies least-privilege by default, and is built to meet NIS2 and ISO 27001.

Example case

Picture a German engineering firm with around 1,800 employees across three sites, running rexx systems as its HR core while its identity provisioning never quite keeps up. A nightly CSV export from rexx feeds a script that IT babysits — it lists everyone, so working out who actually joined, moved or left is a manual comparison every morning, and new engineers routinely wait until day two or three for their account, licence and group access.

Connect rexx systems to Microsoft Entra ID with Joinly and that work disappears. Joinly reads each HR change in rexx at the source and acts on it automatically: new hires have their account, Microsoft 365 licence and group access ready on their start date, a move from the design department to project management swaps the right groups the same day, duplicate names get a stable, unique UPN, and leavers are disabled on their exit date with a 30-day soft-delete grace window.

“We used to start every morning diffing a spreadsheet to find out who changed. Now an account is simply ready on the start date, a transfer just swaps the groups, and we can show the auditor exactly which rexx change created every bit of access.” — Head of IT, engineering firm

The outcome this setup is designed for: onboarding drops from days to zero touch, the daily manual diff disappears, and the team can walk into its next NIS2 assessment with a complete, source-backed audit trail.