How does Joinly sync SD Worx to Microsoft Entra ID?

Joinly reads each HR change in SD Worx through the REST API and applies it to the matching Entra ID account automatically. SD Worx holds the authoritative dienstverband, so it is the starting point for each identity action.

1. Joiner. HR completes the hire in SD Worx. Joinly reads the new werknemer record and determines the role from attributes like afdeling, kostenplaats and paritair comité. It then creates the account in Entra ID, assigns the right licences and maps the person into the correct groups — timed to the effective in-diensttreding (start date).

2. Mover. When someone changes function, afdeling or kostenplaats in SD Worx — or transfers to another werkgever entity — Joinly updates their group membership, permissions and licences to match. Access that no longer fits the new position is revoked, so permissions stay aligned with the actual job.

3. Leaver. On the uit-diensttreding (end date) recorded in SD Worx, Joinly disables the Entra ID account automatically. There are no orphaned accounts left active after someone has left, and where a person still holds another active employment, access is only removed when the last dienstverband ends.

Example: A Belgian retail group hires a store assistant in SD Worx with a start date next Monday, under the werkgever entity that runs its shops in Flanders. Joinly reads the future-dated record, waits until the start date, creates the Entra ID account, assigns a Microsoft 365 licence and adds the assistant to the Retail-Stores-BE group based on the kostenplaats. When that assistant later moves to the head-office payroll under a different Company ID, Joinly keeps a single stable UPN and swaps the groups the same day.

What manual user management costs

Without automation, every account starts as an email from HR or a line in a spreadsheet that IT works through by hand. A direct SD Worx REST integration or a middleware flow can move attributes across, but it maps departments and cost centers to groups through hand-written rules and has no notion of the werkgever entity or a future-dated dienstverband — so the part that actually decides access still falls to people.

• Onboarding delays. New joiners wait for accounts, licences and group access while a ticket sits in a queue, losing productive days in their first week.

• Permissions that don’t keep up (privilege creep). When movers change afdeling, kostenplaats or werkgever entity, old access often stays attached, so people accumulate rights they no longer need.

• Forgotten offboarding. Accounts that aren’t disabled on time are both a security and audit risk, and unused licences keep costing money — and when a person holds employments under more than one Company ID it is easy to disable an account while another dienstverband is still active.

Joinly vs. a direct SD Worx API integration

SD Worx exposes a solid REST API, but there’s no first-party Entra ID connector, so most teams build a direct integration or wire it through middleware. That baseline moves data; it stops short of the part that actually decides access. Here’s how the two compare for an SD Worx-driven setup.

Watch-outs when connecting SD Worx to Microsoft Entra ID

A few SD Worx-specific details decide whether this connection stays reliable at scale.

• Social-secretariat multi-entity model. As a sociaal secretariaat, SD Worx serves each client through one or more werkgever entities, and the REST API is scoped per Company ID. A person can move between those entities. Joinly resolves the active dienstverband to the right Company ID, so the correct entity drives the account rather than a stale or ended one.

• Multi-country Benelux employment. The same person can hold employments in Belgium, the Netherlands or Luxembourg under different local rulesets. A naive rule can pick the wrong tewerkstelling and break sign-in. Joinly applies explicit rules to choose the primary employment as the driver of the UPN, while still reflecting the extra access.

• Mapping Belgian payroll structures to Entra groups. Afdeling, kostenplaats and paritair comité don’t translate one-to-one to Entra ID groups. Joinly builds explicit mapping rules from those structures to the correct groups and licences, so role drives access rather than manual assignment.

• Future-dated in- and uit-diensttredingen. SD Worx records a hire and a termination with effective dates that can sit well before or after the change is entered. Joinly reads those dates and times account creation and disable to them, so access is ready on the start date and gone on the end date — not the moment HR saved the record.

• UPN format with duplicate names. When two employees share a name, a naive UPN rule produces collisions. Joinly applies custom transformation rules — a suffix, entity code or the personeelsnummer as a tiebreaker — so every UPN is unique and predictable from day one.

Joinly handles each of these by default with custom mapping and transformation.

Always audit-ready

Every account action Joinly performs is logged: who was affected, when it happened, which access changed and which SD Worx change triggered it. For NIS2 that matters directly: access can be traced back to an authorised HR source rather than an ad-hoc request. Joinly is ISO 27001 certified, runs in an EU data centre in Amsterdam, applies least-privilege by default, and is built to meet NIS2 and ISO 27001.

Example case

Picture a Belgian retail group with around 3,500 employees across a head office and a hundred-odd stores, running SD Worx for payroll while its identity provisioning never quite keeps up. A hand-built API integration handles the simple cases, yet seasonal store contracts, transfers between the shop and head-office werkgever entities, and staff who pick up hours under a second Company ID keep breaking it — people end up with the wrong dienstverband synced to Entra ID, and future-dated hires are provisioned the moment HR saves the record rather than on their actual start date.

Connect SD Worx to Microsoft Entra ID with Joinly and that work disappears. Joinly reads each HR change in SD Worx at the source and acts on it automatically: new hires have their account, Microsoft 365 licence and group access ready on their in-diensttreding, transfers between entities swap the right groups the same day, a second employment keeps a single, stable UPN, and leavers are disabled on their uit-diensttreding with a 30-day soft-delete grace window.

“Staff moving between our stores and head office used to be the thing that broke every sync. Now an account is simply ready on the start date, a transfer just swaps the access, and we can show the auditor exactly which SD Worx change created every bit of access.” — Head of IT, Belgian retail group

The outcome this setup is designed for: onboarding drops from days to zero touch, multi-entity errors stop entirely, and the team can walk into its next NIS2 assessment with a complete, source-backed audit trail.