How does Joinly sync UKG Pro to Microsoft Entra ID?

Joinly reads each HR change in UKG Pro through the HCM REST API and applies it to the matching Entra ID account automatically. UKG Pro holds the authoritative employment record, so it is the starting point for each identity action.

1. Joiner. HR completes the hire in UKG Pro. Joinly reads the new employment record and determines the role from attributes like job, location, company and Organization Levels 1 to 4. It then creates the account in Entra ID, assigns the right licences and maps the person into the correct groups — timed to the hire date on the record.

2. Mover. When someone changes job, location, company or an Org Level in UKG Pro, Joinly updates their group membership, permissions and licences to match. Access that no longer fits the new job is revoked, so permissions stay aligned with the actual position.

3. Leaver. On the termination date recorded in UKG Pro, Joinly disables the Entra ID account automatically. There are no orphaned accounts left active after someone has left, and an employee holding secondary jobs is only offboarded when their last active employment record ends.

Example: A national retail chain hires a store associate in UKG Pro with a start date next Monday, in its Midwest company under Org Level 2 ‘Stores’. Joinly reads the record, waits until the hire date, creates the Entra ID account, assigns an Office E1 licence and adds the associate to the Stores-Midwest group. When that associate later picks up a second, seasonal job at the distribution centre, Joinly keeps the Make-Primary record as the driver of the UPN and adds the extra group without breaking sign-in.

What manual user management costs

Without automation, every account starts as a UKG Pro ticket or a line in a spreadsheet that IT works through by hand. Because UKG ships no first-party Entra inbound connector, teams stitch together SFTP exports, a generic SCIM feed or middleware like Aquera — these move attributes across but leave Org-Level-to-group mapping, primary-record selection and rehire matching to manual configuration, so the part that actually decides access still falls to people.

• Onboarding delays. New joiners wait for accounts, licences and group access while a ticket sits in a queue, losing productive days in their first week.

• Permissions that don’t keep up (privilege creep). When movers change job, location or company, old access often stays attached, so people accumulate rights they no longer need.

• Forgotten offboarding. Accounts that aren’t disabled on time are both a security and audit risk, and unused licences keep costing money — and with secondary jobs it is easy to disable an account while another employment record is still active.

Joinly vs. an SFTP / SCIM / middleware feed for UKG Pro

Because UKG offers no native Entra inbound app, the baseline is an SFTP/CSV extract, a generic SCIM feed or middleware such as Aquera — all fine at moving attributes, but stopping short of the part that actually decides access. Here’s how the two compare for a UKG Pro-driven setup.

Watch-outs when connecting UKG Pro to Microsoft Entra ID

A few UKG Pro-specific details decide whether this connection stays reliable at scale.

• Multiple and secondary jobs. An employee can hold more than one active employment record, each with its own job and supervisor. A naive rule can let a secondary job drive the account and assign the wrong access. Joinly honours the Make-Primary record as the driver of the UPN, while still reflecting the extra job’s groups.

• Rehires and duplicate records. A rehire in UKG Pro often creates a fresh employment record rather than reactivating the old one, which can spawn a second Entra ID account. Joinly matches the rehire back to the existing person by employee number, so the original account is reactivated instead of duplicated.

• Mapping Org Levels and companies to Entra groups. Organization Levels 1 to 4, company and location are a free-form cost hierarchy that doesn’t translate one-to-one to Entra ID groups. Joinly builds explicit mapping rules from those codes to the correct groups and licences, so role drives access rather than manual assignment.

• UPN format with duplicate names. When two employees share a name, a naive UPN rule produces collisions. Joinly applies custom transformation rules — a suffix, company code or controlled tiebreaker — so every UPN is unique and predictable from day one.

• Supervisor resolution across companies. UKG Pro links the supervisor by employee identifier, which can sit in a different component company. Joinly resolves the manager reference to the right Entra ID account so the org chart and manager-based rules stay correct.

Joinly handles each of these by default with custom mapping and transformation.

Always audit-ready

Every account action Joinly performs is logged: who was affected, when it happened, which access changed and which UKG Pro change triggered it. For NIS2 that matters directly: access can be traced back to an authorised HR source rather than an ad-hoc request. Joinly is ISO 27001 certified, runs in an EU data centre in Amsterdam, applies least-privilege by default, and is built to meet NIS2 and ISO 27001.

Example case

Picture a national retail chain with around 7,500 employees across 180 stores, running UKG Pro as its HR core while its identity provisioning never quite keeps up. With no native UKG-to-Entra connector, IT runs a nightly SFTP extract into a script that handles the simple cases, yet seasonal hiring, store-to-store transfers and a steady stream of secondary jobs keep breaking it — associates who pick up a second job end up with the wrong record driving their account, and rehired seasonal staff get a brand-new duplicate account each year.

Connect UKG Pro to Microsoft Entra ID with Joinly and that work disappears. Joinly reads each HR change through the HCM REST API and acts on it automatically: new hires have their account, Office licence and group access ready on their hire date, transfers between stores swap the right Org-Level groups the same day, secondary jobs keep a single, stable UPN driven by the primary record, and leavers are disabled on their termination date with a 30-day soft-delete grace window.

“Secondary jobs and seasonal rehires used to break every sync. Now an account is simply ready on the hire date, a second job just adds access, a rehire reactivates the old account, and we can show the auditor exactly which UKG Pro change created every bit of access.” — Head of IT, national retail chain

The outcome this setup is designed for: onboarding drops from days to zero touch, duplicate accounts from rehires stop entirely, and the team can walk into its next NIS2 assessment with a complete, source-backed audit trail.