How does Joinly sync Sesame HR to Microsoft Entra ID?

Joinly reads each HR change in Sesame HR through its REST API and applies it to the matching Entra ID account automatically. Sesame HR holds the authoritative employee record, so it is the starting point for each identity action.

1. Joiner. HR completes the hire in Sesame HR. Joinly reads the new employee record and determines the role from attributes like department, office and job title. It then creates the account in Entra ID, assigns the right licences and maps the person into the correct groups — timed to the recorded start date.

2. Mover. When someone changes department, office or manager in Sesame HR, Joinly updates their group membership, permissions and licences to match. Access that no longer fits the new position is revoked, so permissions stay aligned with the actual job.

3. Leaver. On the end date recorded in Sesame HR, Joinly disables the Entra ID account automatically. There are no orphaned accounts left active after someone has left, and because SME workforces churn — part-time, temporary and seasonal staff — Joinly matches a rehire back to the person’s existing account rather than creating a duplicate.

Example: A hospitality group hires a front-desk employee in Sesame HR with a start date next Monday, at its Barcelona office. Joinly reads the record, waits until the start date, creates the Entra ID account, assigns a Business Basic licence and adds the person to the Barcelona-FrontOffice group. When that employee later returns for the next season, Joinly recognises the rehire and re-activates the same account instead of spinning up a second one.

What manual user management costs

Without automation, every account starts as a Sesame HR note or a line in a spreadsheet that IT works through by hand. You can wire Sesame HR’s REST API to Entra ID’s generic API-driven provisioning yourself, but that moves attributes at best — it has no role-to-group logic and no Sesame-specific handling, so the part that actually decides access still falls to people.

• Onboarding delays. New joiners wait for accounts, licences and group access while a request sits in a queue, losing productive days in their first week — painful when a shift worker is expected on the floor from day one.

• Permissions that don’t keep up (privilege creep). When movers change department or office, old access often stays attached, so people accumulate rights they no longer need.

• Forgotten offboarding. Accounts that aren’t disabled on time are both a security and audit risk, and unused licences keep costing money — and with frequent seasonal turnover it is easy to lose track of who has actually left.

Joinly vs. native Entra ID provisioning

There is no prebuilt Entra ID provisioning app for Sesame HR, so the native path means wiring the Sesame HR API to Entra’s generic API-driven (custom SCIM) provisioning and maintaining it yourself. Here’s how the two compare for a Sesame HR-driven setup.

Watch-outs when connecting Sesame HR to Microsoft Entra ID

A few Sesame HR-specific details decide whether this connection stays reliable at scale.

• Sparse or attendance-first records. Sesame HR started as a time-tracking tool, so the employee directory is often lighter on structured org attributes than an enterprise HR core — a department, office or manager may be missing. Joinly builds mapping rules with sensible fallbacks so a thin record still resolves to the right group rather than failing the sync.

• Part-time, temporary and seasonal churn. SME workforces here turn over quickly, and the same person often comes back next season. A naive rule creates a fresh account each time. Joinly matches a rehire to the existing identity and re-activates it, so history and mailbox stay intact.

• Mapping departments and offices to Entra groups. Sesame HR departments and offices (work centres) don’t translate one-to-one to Entra ID groups. Joinly builds explicit mapping rules from those structures to the correct groups and licences, so role drives access rather than manual assignment.

• UPN format with duplicate names. When two employees share a name, a naive UPN rule produces collisions. Joinly applies custom transformation rules — a suffix, office code or controlled tiebreaker — so every UPN is unique and predictable from day one.

• Frequent sync without over-reading attendance data. Sesame HR carries a lot of high-volume time and clock-in data alongside identities. Joinly reads the employee, department and office objects it needs on a frequent schedule and leaves the attendance stream alone, so provisioning stays fast and focused.

Joinly handles each of these by default with custom mapping and transformation.

Always audit-ready

Every account action Joinly performs is logged: who was affected, when it happened, which access changed and which Sesame HR change triggered it. For NIS2 that matters directly: access can be traced back to an authorised HR source rather than an ad-hoc request. Joinly is ISO 27001 certified, runs in an EU data centre in Amsterdam, applies least-privilege by default, and is built to meet NIS2 and ISO 27001.

Example case

Picture a hospitality group with around 900 employees across a dozen hotels and restaurants, running Sesame HR for time tracking and scheduling while its identity management never quite keeps up. Every seasonal hire, transfer between venues and returning summer worker becomes a manual account job, and with staff expected on shift from day one, a new starter waiting for a login is a real operational problem. Returning seasonal staff keep getting brand-new accounts, so mailboxes and history are scattered.

Connect Sesame HR to Microsoft Entra ID with Joinly and that work disappears. Joinly reads each HR change in Sesame HR at the source and acts on it automatically: new hires have their account, licence and group access ready on their start date, transfers between venues swap the right groups the same day, returning seasonal staff are matched back to their existing account, and leavers are disabled on their end date with a 30-day soft-delete grace window.

“Seasonal turnover used to mean a pile of manual account work and duplicate logins every summer. Now an account is simply ready on the start date, a returning worker keeps their old one, and we can show exactly which Sesame HR change created every bit of access.” — Head of IT, hospitality group

The outcome this setup is designed for: onboarding drops from days to zero touch, duplicate accounts from rehires stop entirely, and the team can walk into its next NIS2 assessment with a complete, source-backed audit trail.