How does Joinly sync SAP SuccessFactors to Microsoft Entra ID?

Joinly reads each HR change in Employee Central through the OData API and applies it to the matching Entra ID account automatically. Employee Central holds the authoritative employment record, so it is the starting point for each identity action.

1. Joiner. HR completes the hire in Employee Central. Joinly reads the new PerPerson, EmpEmployment and EmpJob records and determines the role from attributes like department, job classification and cost center. It then creates the account in Entra ID, assigns the right licences and maps the person into the correct groups — timed to the effective start date.

2. Mover. When someone changes position, department or legal entity in Employee Central, Joinly updates their group membership, permissions and licences to match. Access that no longer fits the new position is revoked, so permissions stay aligned with the actual job.

3. Leaver. On the termination date recorded in Employee Central, Joinly disables the Entra ID account automatically. There are no orphaned accounts left active after someone has left, and concurrent employments are taken into account so access is only removed when the last active employment ends.

Example: An international manufacturer hires a production planner in Employee Central with a start date next Monday, in its German legal entity. Joinly reads the effective-dated record, waits until the start date, creates the Entra ID account, assigns an Office E3 licence and adds the planner to the DE-Operations group. When that planner later picks up a second, concurrent assignment in the Polish entity, Joinly keeps the home employment as the driver of the UPN and adds the extra group without breaking sign-in.

What manual user management costs

Without automation, every account starts as a SuccessFactors ticket or a line in a spreadsheet that IT works through by hand. Microsoft's native SuccessFactors inbound provisioning app and SAP's Identity Provisioning Service can move attributes across, but they map roles to groups through manual expression rules and stumble on effective dating and concurrent employment — so the part that actually decides access still falls to people.

• Onboarding delays. New joiners wait for accounts, licences and group access while a ticket sits in a queue, losing productive days in their first week.

• Permissions that don't keep up (privilege creep). When movers change position or legal entity, old access often stays attached, so people accumulate rights they no longer need.

• Forgotten offboarding. Accounts that aren't disabled on time are both a security and audit risk, and unused licences keep costing money — and with concurrent employment it is easy to disable an account while another employment is still active.

Joinly vs. the native SuccessFactors provisioning app

Microsoft's Entra inbound provisioning for SAP SuccessFactors (and SAP's IPS) is a fine baseline, but it stops short of the part that actually decides access. Here's how the two compare for an Employee Central-driven setup.

Watch-outs when connecting SAP SuccessFactors to Microsoft Entra ID

A few SuccessFactors-specific details decide whether this connection stays reliable at scale.

• Effective-dated future hires. Employee Central stores a hire as a future-dated record well before the first working day, and provisioning too early or too late both cause problems. Joinly reads the effective start date and times account creation to it, so access is ready on the right day and not before.

• Concurrent employment and global assignments. An employee can hold more than one active employment at once. A naive rule can sync the wrong — or a terminated — employment to Entra ID and break sign-in. Joinly applies explicit rules to pick the home employment as the driver of the UPN, while still reflecting the extra access.

• Mapping foundation objects to Entra groups. Legal entity, business unit, division, department and job classification don't translate one-to-one to Entra ID groups. Joinly builds explicit mapping rules from those structures to the correct groups and licences, so role drives access rather than manual assignment.

• UPN format with duplicate names. When two employees share a name, a naive UPN rule produces collisions. Joinly applies custom transformation rules — a suffix, legal-entity code or controlled tiebreaker — so every UPN is unique and predictable from day one.

• Custom MDF fields. Custom Employee Central fields aren't all exposed by default. Joinly maps the custom fields you need via Liquid templates, so attributes like a local employee number land in the right place.

Joinly handles each of these by default with custom mapping and transformation.

Always audit-ready

Every account action Joinly performs is logged: who was affected, when it happened, which access changed and which SuccessFactors change triggered it. For NIS2 that matters directly: access can be traced back to an authorised HR source rather than an ad-hoc request. Joinly is ISO 27001 certified, runs in an EU data centre in Amsterdam, applies least-privilege by default, and is built to meet NIS2 and ISO 27001.

Customer story

An international manufacturer with around 3,000 employees across five legal entities ran Employee Central as its HR core, but its identity provisioning never kept up. The native SuccessFactors-to-Entra app handled the simple cases, yet seasonal contracts, internal transfers between entities and a steady stream of concurrent assignments kept breaking it — engineers with a second assignment regularly had the wrong employment synced to Entra ID, and future-dated hires were sometimes provisioned the moment HR saved the record rather than on their actual start date.

After connecting SAP SuccessFactors to Microsoft Entra ID with Joinly, that work disappeared. Joinly now reads each HR change in Employee Central at the source and acts on it automatically: new hires have their account, Office licence and group access ready on their effective start date, transfers between legal entities swap the right groups the same day, concurrent assignments keep a single, stable UPN, and leavers are disabled on their termination date with a 30-day soft-delete grace window.

"Concurrent employment used to be the thing that broke every sync. Now an account is simply ready on the start date, a second assignment just adds access, and we can show the auditor exactly which SuccessFactors change created every bit of access." (Head of IT at an international manufacturer)

The result: onboarding time dropped from days to zero touch, the concurrent-employment errors stopped entirely, and the team walked into its last NIS2 assessment with a complete, source-backed audit trail.