How does Joinly sync TeamSystem to Microsoft Entra ID?

Joinly reads each HR change in TeamSystem HR through its employee API and applies it to the matching Entra ID account automatically. The TeamSystem anagrafica holds the authoritative employment record, so it is the starting point for each identity action.

1. Joiner. HR completes the hire in TeamSystem HR. Joinly reads the new anagrafica and determines the role from attributes like unità organizzativa, mansione and centro di costo. It then creates the account in Entra ID, assigns the right licences and maps the person into the correct groups.

2. Mover. When someone changes mansione, unità organizzativa or sede in TeamSystem HR, Joinly updates their group membership, permissions and licences to match. Access that no longer fits the new position is revoked, so permissions stay aligned with the actual job.

3. Leaver. On the termination date recorded in TeamSystem HR, Joinly disables the Entra ID account automatically. There are no orphaned accounts left active after someone has left, and the matricola keeps the right person matched throughout.

Example: A professional-services firm hires a consultant in TeamSystem HR, assigned to the Milan sede and the Advisory unità organizzativa. Joinly reads the new anagrafica, creates the Entra ID account, assigns an Office E3 licence and adds the consultant to the Advisory-Milan group. When that consultant later moves to the Rome office and a new mansione, Joinly swaps the site and department groups the same day, keyed on the matricola so the account is never duplicated.

What manual user management costs

Without automation, every account starts as a TeamSystem ticket or a line in a spreadsheet that IT works through by hand. A plain attribute sync from TeamSystem to Entra ID can move fields across, but it maps roles to groups through manual rules and leaves username transformation and matching to people — so the part that actually decides access still falls to staff.

• Onboarding delays. New joiners wait for accounts, licences and group access while a ticket sits in a queue, losing productive days in their first week.

• Permissions that don’t keep up (privilege creep). When movers change mansione or unità organizzativa, old access often stays attached, so people accumulate rights they no longer need.

• Forgotten offboarding. Accounts that aren’t disabled on time are both a security and audit risk, and unused licences keep costing money.

Joinly vs. native Entra provisioning

There is no prebuilt Entra gallery app for TeamSystem, so the native route is a custom API-driven or CSV/SCIM inbound setup. That is a fine baseline for attributes, but it stops short of the part that actually decides access. Here’s how the two compare for a TeamSystem HR-driven setup.

Watch-outs when connecting TeamSystem to Microsoft Entra ID

A few TeamSystem-specific details decide whether this connection stays reliable at scale.

• Accented and Italian-specific characters. Names in the TeamSystem anagrafica routinely carry accented characters (à, è, ì, ò, ù). A naive UPN rule produces inconsistent or invalid logins. Joinly applies explicit transliteration rules, so every UPN is clean, valid and predictable.

• Matricola as the matching key. Names and email addresses change; the matricola (employee number) does not. Joinly matches on the matricola so an account stays linked to the right person through a name change, a marriage or a domain migration — instead of creating a duplicate.

• Mapping the organigramma to Entra groups. Unità organizzativa, sede, centro di costo and mansione don’t translate one-to-one to Entra ID groups. Joinly builds explicit mapping rules from those structures to the correct groups and licences, so role drives access rather than manual assignment.

• Edition and module differences. TeamSystem HR, Studio HR and Dipendenti in Cloud expose slightly different object models. Joinly maps to the fields your edition actually returns, confirmed against your tenant during setup.

Joinly handles each of these by default with custom mapping and transformation.

Always audit-ready

Every account action Joinly performs is logged: who was affected, when it happened, which access changed and which TeamSystem change triggered it. For NIS2 that matters directly: access can be traced back to an authorised HR source rather than an ad-hoc request. Joinly is ISO 27001 certified, runs in an EU data centre in Amsterdam, applies least-privilege by default, and is built to meet NIS2 and ISO 27001.

Example case

Picture a professional-services firm with around 900 people — consultants, analysts and support staff — across offices in Milan, Rome and Turin, running TeamSystem HR as its people core. New consultants and interns arrive in waves at the start of each project cycle, and every one of them starts as a TeamSystem ticket that IT works through by hand in Entra ID. Names carry accented characters, people move between offices and practices constantly, and the manual UPN rules keep producing collisions and inconsistent logins.

Connect TeamSystem to Microsoft Entra ID with Joinly and that work disappears. Joinly reads each change in the anagrafica at the source and acts on it automatically: new hires have their account, Office licence and practice-group access ready, transfers between offices swap the site and department groups the same day, accented names produce a clean and unique UPN every time, and leavers are disabled on their termination date with a soft-delete grace window — all keyed on the matricola so accounts are never duplicated.

“Accented names and constant office moves used to break every account we created by hand. Now a consultant is simply ready on day one, a move just swaps the groups, and we can show the auditor exactly which TeamSystem change created every bit of access.” — Head of IT, professional-services firm

The outcome this setup is designed for: onboarding drops from days to zero touch, duplicate and malformed accounts stop entirely, and the team can walk into its next NIS2 assessment with a complete, source-backed audit trail.