How does Joinly sync Talentia to Microsoft Entra ID?

Joinly reads each HR change in Talentia HCM through its web-service or scheduled-extract interface and applies it to the matching Entra ID account automatically. Talentia’s People & Organisation module holds the authoritative employment record, so it is the starting point for each identity action.

1. Joiner. HR completes the hire in Talentia. Joinly reads the new employee record and determines the role from attributes like department, position and cost center. It then creates the account in Entra ID, assigns the right licences and maps the person into the correct groups — timed to the recorded start date.

2. Mover. When someone changes position, department, cost center or company in Talentia, Joinly updates their group membership, permissions and licences to match. Access that no longer fits the new position is revoked, so permissions stay aligned with the actual job.

3. Leaver. On the termination date recorded in Talentia, Joinly disables the Entra ID account automatically. There are no orphaned accounts left active after someone has left, and multi-company employments are taken into account so access is only removed when the last active employment ends.

Example: A Southern-European insurance group hires a claims handler in Talentia with a start date next Monday, under its Spanish legal entity. Joinly reads the record, waits until the start date, creates the Entra ID account, assigns an Office E3 licence and adds the handler to the ES-Claims group. When that person later takes on a second role under the group’s Italian company, Joinly keeps the primary employment as the driver of the UPN and adds the extra group without breaking sign-in.

What manual user management costs

Without automation, every account starts as a Talentia ticket or a line in a spreadsheet that IT works through by hand. Because Talentia has no documented native identity API, teams often fall back on CSV exports and manual imports into Entra ID — which move a few attributes across but leave the part that actually decides access, the role-to-group mapping, to people.

• Onboarding delays. New joiners wait for accounts, licences and group access while a ticket sits in a queue, losing productive days in their first week.

• Permissions that don’t keep up (privilege creep). When movers change position, cost center or company, old access often stays attached, so people accumulate rights they no longer need.

• Forgotten offboarding. Accounts that aren’t disabled on time are both a security and audit risk, and unused licences keep costing money — and in a multi-company group it is easy to disable an account while another employment is still active.

Joinly vs. manual imports and native Entra provisioning

There is no dedicated Talentia connector for Entra ID, so the realistic alternatives are Microsoft’s generic Entra inbound provisioning (which has no Talentia source) or manual CSV/file imports. Here’s how Joinly compares for a Talentia-driven setup.

Watch-outs when connecting Talentia to Microsoft Entra ID

A few Talentia-specific details decide whether this connection stays reliable at scale.

• No documented native identity API. Talentia does not publish a self-service REST or SCIM identity API, so the connection is built over its web services or scheduled extracts. Joinly establishes and maintains that interface for you and confirms the available fields and sync cadence per tenant, so you don’t end up hand-building and babysitting a fragile export.

• Multi-company and multi-entity records. The same person can appear under more than one company or legal entity in a Talentia group. A naive rule can sync the wrong entity to Entra ID and create a duplicate or break sign-in. Joinly applies explicit rules to pick the primary employment as the driver of the UPN, while still reflecting the extra access.

• Mapping the organisational model to Entra groups. Company, legal entity, organisational unit, department, cost center and position don’t translate one-to-one to Entra ID groups. Joinly builds explicit mapping rules from those structures to the correct groups and licences, so role drives access rather than manual assignment.

• UPN format with accented names and multiple surnames. Southern-European names carry accents and, in Spain and Portugal, two surnames, which naive UPN rules mangle or collide. Joinly applies custom transformation rules — transliteration, a suffix or a controlled tiebreaker — so every UPN is valid and unique from day one.

• Local employee numbers and custom fields. Local identifiers and country-specific fields aren’t always exposed the same way across entities. Joinly maps the fields you need via Liquid templates, so attributes like a local employee number land in the right place.

Joinly handles each of these by default with custom mapping and transformation.

Always audit-ready

Every account action Joinly performs is logged: who was affected, when it happened, which access changed and which Talentia change triggered it. For NIS2 that matters directly: access can be traced back to an authorised HR source rather than an ad-hoc request. Joinly is ISO 27001 certified, runs in an EU data centre in Amsterdam, applies least-privilege by default, and is built to meet NIS2 and ISO 27001.

Example case

Picture a Southern-European insurance group with around 3,500 employees across four legal entities in Spain, Italy and Portugal, running Talentia HCM as its HR and payroll core while identity provisioning never quite keeps up. There is no native Talentia connector for Entra ID, so IT exports a spreadsheet from Talentia and works through new hires by hand — and internal transfers between the group’s companies, accented and double surnames, and people carrying a role in two entities keep breaking it. Future-dated hires are created whenever someone remembers to run the import rather than on the actual start date.

Connect Talentia to Microsoft Entra ID with Joinly and that work disappears. Joinly reads each HR change in Talentia at the source and acts on it automatically: new hires have their account, Office licence and group access ready on their recorded start date, transfers between companies swap the right groups the same day, a second role under another entity keeps a single stable UPN, and leavers are disabled on their termination date with a 30-day soft-delete grace window.

“We had no real connector, just a spreadsheet and a lot of manual fixing for double surnames and people working across two of our companies. Now an account is simply ready on the start date, a second role just adds access, and we can show the auditor exactly which Talentia change created every bit of access.” — Head of IT, insurance group

The outcome this setup is designed for: onboarding drops from days to zero touch, multi-company and name-collision errors stop entirely, and the team can walk into its next NIS2 assessment with a complete, source-backed audit trail.