How does Joinly sync Simployer to Microsoft Entra ID?

Joinly reads each HR change from Simployer One through the HR Connect API and applies it to the matching Entra ID account automatically. Simployer holds the authoritative employee and employment record, so it is the starting point for each identity action.

1. Joiner. HR completes the hire in Simployer. Joinly reads the new employee and employment records and determines the role from attributes like department, team, office and cost center. It then creates the account in Entra ID, assigns the right licences and maps the person into the correct groups — timed to the employment start date.

2. Mover. When someone changes department, team or office in Simployer, Joinly updates their group membership, permissions and licences to match. Access that no longer fits the new position is revoked, so permissions stay aligned with the actual job — not with where the person started.

3. Leaver. On the employment end date recorded in Simployer, Joinly disables the Entra ID account automatically. There are no orphaned accounts left active after someone has left. A leave record — such as long-term sick leave — is treated as absence, not termination, so an employee on leave keeps their account.

Example: A Norwegian municipality hires a case worker in Simployer with a start date next Monday, in its Social Services department. Joinly reads the record, waits until the start date, creates the Entra ID account, assigns a Microsoft 365 licence and adds the case worker to the Social-Services group. When that person later goes on twelve weeks of parental leave, Joinly sees the leave record and leaves the account active and licensed, so nothing has to be recreated on their return.

What manual user management costs

Without automation, every account starts as a Simployer notification or a line in a spreadsheet that IT works through by hand. Simployer’s native SCIM Provisioning API can push a Users feed to services like Okta or Google Workspace, but it is one-way, exposes no groups and isn’t tested for Entra ID — so for a Microsoft shop the part that actually decides access still falls to people.

• Onboarding delays. New joiners wait for accounts, licences and group access while a ticket sits in a queue, losing productive days in their first week.

• Permissions that don’t keep up (privilege creep). When movers change department, team or office, old access often stays attached, so people accumulate rights they no longer need.

• Forgotten offboarding. Accounts that aren’t disabled on time are both a security and audit risk, and unused licences keep costing money — and it is easy to disable someone who is only on long-term leave rather than actually gone.

Joinly vs. native Simployer / Entra provisioning

Simployer’s SCIM feed and Microsoft’s Entra API-driven inbound provisioning are a fine baseline, but they stop short of the part that actually decides access. Here’s how the two compare for a Simployer-driven Entra ID setup.

Watch-outs when connecting Simployer to Microsoft Entra ID

A few Simployer-specific details decide whether this connection stays reliable at scale.

• The native SCIM feed is source-only and has no groups. Simployer’s Provisioning API sends a Users feed out of Simployer and exposes no Groups endpoint, so it can’t drive role-to-group mapping or clean deprovisioning by itself. Joinly reads the richer HR Connect API instead and builds the group and licence logic from department, team and office.

• Absence and long-term leave are not termination. Simployer treats sick leave and other absence as first-class records, and an employee on long-term leave is still active. A naive rule can read ‘absent’ as ‘gone’ and disable a live account. Joinly distinguishes a leave record from an employment end date, so access stays put during leave and is only removed when employment actually ends.

• Nordic names and UPN format. Norwegian and Swedish names use characters like ae, o and a with diacritics, and patronymic surnames are common. A naive UPN rule produces broken or duplicate logins. Joinly applies transliteration and custom transformation rules — a suffix or controlled tiebreaker — so every UPN is clean, unique and predictable from day one.

• Mapping Simployer structure to Entra groups. Organization, company, department, team, office and cost center don’t translate one-to-one to Entra ID groups. Joinly builds explicit mapping rules from those structures to the correct groups and licences, so role drives access rather than manual assignment.

• Mixed API generations. Some tenants still run the Simployer Classic HRConnect API alongside the newer Simployer One API. Joinly maps whichever object model your tenant exposes, so the connection doesn’t depend on which generation you are on.

Joinly handles each of these by default with custom mapping and transformation.

Always audit-ready

Every account action Joinly performs is logged: who was affected, when it happened, which access changed and which Simployer change triggered it. For NIS2 that matters directly: access can be traced back to an authorised HR source rather than an ad-hoc request. Joinly is ISO 27001 certified, runs in an EU data centre in Amsterdam, applies least-privilege by default, and is built to meet NIS2 and ISO 27001.

Example case

Picture a Norwegian municipality with around 3,200 employees across schools, care homes and administrative offices, running Simployer as its HR core while its identity provisioning never quite keeps up. Simployer’s SCIM feed works for a couple of cloud tools, but it sends Users only with no groups, so every new case worker, teacher or care assistant still becomes a manual ticket in Entra ID — and with a steady stream of long-term sick leave and parental leave, accounts are sometimes disabled for people who are simply absent, then scrambled back to life when they return.

Connect Simployer to Microsoft Entra ID with Joinly and that work disappears. Joinly reads each HR change from the Simployer HR Connect API at the source and acts on it automatically: new hires have their account, Microsoft 365 licence and group access ready on their start date, transfers between departments swap the right groups the same day, employees on leave keep a stable, licensed account, and leavers are disabled on their employment end date with a 30-day soft-delete grace window.

“Long-term leave used to be the thing that tripped up every sync — we’d disable someone who was only on parental leave. Now an account is simply ready on the start date, leave leaves it untouched, and we can show the auditor exactly which Simployer change created every bit of access.” — Head of IT, Norwegian municipality

The outcome this setup is designed for: onboarding drops from days to zero touch, absence-related disable errors stop entirely, and the team can walk into its next NIS2 assessment with a complete, source-backed audit trail.