How does Joinly sync TriNet to Microsoft Entra ID?

Joinly reads each HR change from your TriNet tenant and applies it to the matching Entra ID account automatically. TriNet holds the authoritative employment record, so it is the starting point for each identity action — and Joinly reads the correct TriNet product for your setup, whether that is the PEO Platform or the HR Platform.

1. Joiner. HR completes the hire in TriNet. Joinly reads the new worksite-employee record and determines the role from attributes like department, job title and location. It then creates the account in Entra ID, assigns the right licences and maps the person into the correct groups — timed to the start date.

2. Mover. When someone changes department, location or manager in TriNet, Joinly updates their group membership, permissions and licences to match. Access that no longer fits the new role is revoked, so permissions stay aligned with the actual job.

3. Leaver. On the termination recorded in TriNet, Joinly disables the Entra ID account automatically. Because TriNet deactivates a terminated record rather than deleting it, Joinly reads the employment status — not the mere presence of the record — so leavers are offboarded on time and no orphaned accounts stay active.

Example: A professional-services firm hires a consultant in TriNet with a start date next Monday. Joinly reads the new worksite-employee record, waits until the start date, creates the Entra ID account, assigns an Office E3 licence and adds the consultant to the Consulting-EU group. When the consultant later moves from delivery to the strategy practice, Joinly swaps the group membership the same day, and when they leave, the deactivated TriNet status triggers a clean offboarding instead of leaving the account live.

What manual user management costs

Without automation, every account starts as a request from TriNet or a line in a spreadsheet that IT works through by hand. A raw TriNet API feed or a generic iPaaS flow can move attributes across, but it leaves role-to-group mapping, worksite-employee filtering and co-employment status handling to you — so the part that actually decides access still falls to people.

• Onboarding delays. New joiners wait for accounts, licences and group access while a request sits in a queue, losing productive days in their first week.

• Permissions that don’t keep up (privilege creep). When movers change department or location, old access often stays attached, so people accumulate rights they no longer need.

• Forgotten offboarding. Accounts that aren’t disabled on time are both a security and audit risk, and unused licences keep costing money — and because TriNet only deactivates terminated records rather than deleting them, a status-blind script can miss the leaver entirely.

Joinly vs. a raw TriNet API integration

There is no first-party Entra inbound provisioning app for TriNet, so the usual alternative is a custom integration against the TriNet API or a unified-HRIS broker. That moves data, but it stops short of the part that actually decides access. Here’s how the two compare.

Watch-outs when connecting TriNet to Microsoft Entra ID

A few TriNet-specific details decide whether this connection stays reliable at scale.

• Co-employment record retention. Because TriNet is a co-employer, a terminated worksite employee’s record is deactivated for compliance, not deleted. A rule that checks whether a record exists will treat a leaver as active. Joinly keys on employment status, so offboarding fires on the actual termination.

• Two TriNet products, two data shapes. The TriNet PEO Platform and the TriNet HR Platform (formerly Zenefits) expose employees differently. Joinly connects to the product your tenant actually uses, so the feed matches your real setup instead of guessing.

• Worksite employees vs the rest. Not every TriNet record should get an Entra ID account — contractors and non-WSE entries often shouldn’t. Joinly filters by employment type and status, so only the people who need an account get one.

• Role-to-group mapping. TriNet’s department, job title and location don’t translate one-to-one to Entra ID groups. Joinly builds explicit mapping rules from those attributes to the correct groups and licences, so role drives access rather than manual assignment.

• UPN format with duplicate names. When two employees share a name, a naive UPN rule produces collisions. Joinly applies custom transformation rules — a suffix, location code or controlled tiebreaker — so every UPN is unique and predictable from day one.

Joinly handles each of these by default with custom mapping and transformation.

Always audit-ready

Every account action Joinly performs is logged: who was affected, when it happened, which access changed and which TriNet change triggered it. For NIS2 that matters directly: access can be traced back to an authorised HR source rather than an ad-hoc request. Joinly is ISO 27001 certified, runs in an EU data centre in Amsterdam, applies least-privilege by default, and is built to meet NIS2 and ISO 27001.

Example case

Picture a professional-services firm with around 900 consultants across four European offices, running TriNet for its US-linked entity and HR administration while its identity provisioning never quite keeps up. IT builds accounts by hand from a weekly TriNet export, and the mismatches pile up: contractors slip into the same feed as worksite employees and get accounts they shouldn’t, and when a consultant leaves, the deactivated TriNet record still looks present to the old script, so the account lingers for weeks.

Connect TriNet to Microsoft Entra ID with Joinly and that work disappears. Joinly reads each HR change from TriNet at the source and acts on it automatically: new consultants have their account, Office licence and group access ready on their start date, moves between practices swap the right groups the same day, only real worksite employees are provisioned, and leavers are disabled the moment their TriNet status flips to terminated — with a 30-day soft-delete grace window.

“Terminated people used to linger because our script only checked whether the record was still there. Now Joinly reads the actual status, the account is disabled on the leave date, and I can show the auditor exactly which TriNet change created every bit of access.” — Head of IT, professional-services firm

The outcome this setup is designed for: onboarding drops from days to zero touch, terminated-record errors stop entirely, and the team can walk into its next NIS2 assessment with a complete, source-backed audit trail.