How does Joinly sync Sympa to Microsoft Entra ID?

Joinly reads each HR change in Sympa through the Open REST API and applies it to the matching Entra ID account automatically. Sympa holds the authoritative employment record, so it is the starting point for each identity action.

1. Joiner. HR completes the hire in Sympa. Joinly reads the new employee profile through the REST API and determines the role from attributes like entity, unit, department and job title. It then creates the account in Entra ID, assigns the right licences and maps the person into the correct groups — timed to the recorded start date.

2. Mover. When someone changes position, unit or entity in Sympa, Joinly updates their group membership, permissions and licences to match. Access that no longer fits the new position is revoked, so permissions stay aligned with the actual job — including transfers between entities in a multi-country structure.

3. Leaver. On the end date recorded in Sympa, Joinly disables the Entra ID account automatically. There are no orphaned accounts left active after someone has left, and a soft-delete grace window keeps the account recoverable before it is retired.

Example: A Nordic retailer hires a store supervisor in Sympa with a start date next Monday, in its Swedish entity. Joinly reads the profile through the REST API, waits until the start date, creates the Entra ID account, assigns a Microsoft 365 licence and adds the supervisor to the SE-Retail-Stores group. When that supervisor later transfers to the Finnish entity, Joinly swaps the entity-specific groups the same day and keeps a single, stable UPN.

What manual user management costs

Without automation, every account starts as a Sympa ticket or a line in a spreadsheet that IT works through by hand. Sympa’s native Entra ID connector can push employee data across, but it runs as a once-a-day full sync from one entity to one Entra environment and has no role-to-group logic — so the part that actually decides access still falls to people.

• Onboarding delays. New joiners wait for accounts, licences and group access while a ticket sits in a queue, losing productive days in their first week.

• Permissions that don’t keep up (privilege creep). When movers change position, unit or entity, old access often stays attached, so people accumulate rights they no longer need.

• Forgotten offboarding. Accounts that aren’t disabled on time are both a security and audit risk, and unused licences keep costing money — and a once-a-day sync can leave a leaver active for the rest of the day.

Joinly vs. the native Sympa Entra ID connector

Sympa’s own Microsoft Entra ID connector is a fine baseline, but it stops short of the part that actually decides access. Here’s how the two compare for a Sympa-driven setup.

Watch-outs when connecting Sympa to Microsoft Entra ID

A few Sympa-specific details decide whether this connection stays reliable at scale.

• Multi-country, multi-entity structure. In a typical Nordic Sympa setup a person sits under an entity, a unit and a geography and can move between them. A naive rule can put someone in the wrong groups after a cross-entity transfer. Joinly builds explicit mapping from entity, unit and geography to the correct Entra groups and licences, and reapplies it on every move.

• Fully configurable data model. Sympa lets each customer build custom interfaces and fields, so the attributes your tenant exposes through the API differ from the next. Joinly maps the exact interfaces and fields your Sympa exposes rather than assuming a fixed schema, so nothing is missed and nothing is guessed.

• Mapping units and entities to Entra groups. Entity, unit, department and job title don’t translate one-to-one to Entra ID groups. Joinly builds explicit mapping rules from those structures to the correct groups and licences, so role drives access rather than manual assignment.

• UPN format with duplicate names. When two employees share a name, a naive UPN rule produces collisions. Joinly applies custom transformation rules — a suffix, entity code or controlled tiebreaker — so every UPN is unique and predictable from day one.

• Sync frequency vs. the native connector. The native Sympa connector runs a full sync once a day. Joinly reads the REST API multiple times per day, so a joiner, transfer or leaver reaches Entra ID within hours rather than waiting for the next nightly run.

Joinly handles each of these by default with custom mapping and transformation.

Always audit-ready

Every account action Joinly performs is logged: who was affected, when it happened, which access changed and which Sympa change triggered it. For NIS2 that matters directly: access can be traced back to an authorised HR source rather than an ad-hoc request. Joinly is ISO 27001 certified, runs in an EU data centre in Amsterdam, applies least-privilege by default, and is built to meet NIS2 and ISO 27001.

Example case

Picture a Nordic retail chain with around 4,500 employees across some 180 stores in Sweden, Finland and Norway, running Sympa as its HR core while its identity provisioning never quite keeps up. The native Sympa-to-Entra connector handles the simple cases, yet seasonal store staff, frequent transfers between stores and entities, and a steady stream of short contracts keep it behind — the once-a-day full sync means a new supervisor can wait most of a day for access, and cross-entity transfers leave people in the wrong groups.

Connect Sympa to Microsoft Entra ID with Joinly and that work disappears. Joinly reads each HR change in Sympa at the source and acts on it automatically: new hires have their account, Microsoft 365 licence and group access ready on their start date, transfers between entities swap the right groups the same day, duplicate names get a stable, unique UPN, and leavers are disabled on their end date with a 30-day soft-delete grace window.

“Peak season used to mean a backlog of store accounts and people in the wrong groups after every transfer. Now an account is simply ready on the start date, a transfer just swaps the access, and we can show the auditor exactly which Sympa change created every bit of access.” — Head of IT, Nordic retail chain

The outcome this setup is designed for: onboarding drops from most of a day to zero touch, cross-entity transfer errors stop, and the team can walk into its next NIS2 assessment with a complete, source-backed audit trail.