How does Joinly sync Unit4 to Microsoft Entra ID?

Joinly reads each HR change in Unit4 ERPx through the REST API and applies it to the matching Entra ID account automatically. Unit4 holds the authoritative resource record, so it is the starting point for each identity action.

1. Joiner. HR completes the hire in Unit4, creating the resource and its position. Joinly reads the new resource and determines the role from attributes like position, cost centre, organisation unit and dimensions. It then creates the account in Entra ID, assigns the right licences and maps the person into the correct groups — timed to the effective start date.

2. Mover. When a resource changes position, cost centre or organisation unit in Unit4, Joinly updates their group membership, permissions and licences to match. Access that no longer fits the new position is revoked, so permissions stay aligned with the actual job.

3. Leaver. On the end date recorded in Unit4, Joinly disables the Entra ID account automatically. There are no orphaned accounts left active after someone has left, and where a resource holds more than one position the account is only disabled once the last active appointment ends.

Example: A higher-education institution hires a lecturer in Unit4 with a start date next Monday, attached to the Faculty of Science cost centre. Joinly reads the effective-dated record, waits until the start date, creates the Entra ID account, assigns an Office E3 licence and adds the lecturer to the Science-Staff group. When that lecturer later picks up a second, parallel position with a research centre, Joinly keeps the primary appointment as the driver of the UPN and adds the extra group without breaking sign-in.

What manual user management costs

Without automation, every account starts as a Unit4 ticket or a line in a spreadsheet that IT works through by hand. Unit4 has no first-party inbound provisioning app for Entra ID — Unit4 Identity Services handles sign-on, but joiner/mover/leaver provisioning is left to a custom Extension Kit build or generic middleware — so the part that actually decides access still falls to people.

• Onboarding delays. New joiners wait for accounts, licences and group access while a ticket sits in a queue, losing productive days in their first week.

• Permissions that don’t keep up (privilege creep). When resources change position or cost centre, old access often stays attached, so people accumulate rights they no longer need.

• Forgotten offboarding. Accounts that aren’t disabled on time are both a security and audit risk, and unused licences keep costing money — and where someone holds more than one position it is easy to disable an account while another appointment is still active.

Joinly vs. a custom Unit4 integration

Unit4 gives you a REST API, Unit4 Identity Services for SSO and an Extension Kit to build against, but no ready-made HR-driven provisioning to Entra ID. Here’s how Joinly compares with rolling your own from those parts.

Watch-outs when connecting Unit4 to Microsoft Entra ID

A few Unit4-specific details decide whether this connection stays reliable at scale.

• Multiple positions per resource. In Unit4 a single resource can hold more than one position at once — parallel appointments are common in higher education and local government. A naive rule can drive the account from the wrong appointment. Joinly applies explicit rules to pick the primary position as the driver of the UPN, while still reflecting the extra access.

• Mapping cost centres and VITA dimensions to Entra groups. Unit4’s flexible VITA model means cost centres, organisation units and dimensions differ from tenant to tenant and don’t translate one-to-one to Entra ID groups. Joinly builds explicit mapping rules from your dimension model to the correct groups and licences, so role drives access rather than manual assignment.

• Effective-dated future starts and fixed-term contracts. Unit4 stores a start as an effective-dated record before the first working day, and seasonal and fixed-term contracts are common in services and the public sector. Joinly reads the effective start and end dates and times account creation and disabling to them, so access is ready on the right day and removed on time.

• UPN format with duplicate names. When two resources share a name, a naive UPN rule produces collisions. Joinly applies custom transformation rules — a suffix, organisation code or controlled tiebreaker — so every UPN is unique and predictable from day one.

• Custom dimensions and fields. Because organisations extend the VITA model with their own dimensions, the fields you need aren’t all exposed the same way twice. Joinly maps the specific dimensions and fields you need via Liquid templates, so attributes like a local employee number or faculty code land in the right place.

Joinly handles each of these by default with custom mapping and transformation.

Always audit-ready

Every account action Joinly performs is logged: who was affected, when it happened, which access changed and which Unit4 change triggered it. For NIS2 that matters directly: access can be traced back to an authorised HR source rather than an ad-hoc request. Joinly is ISO 27001 certified, runs in an EU data centre in Amsterdam, applies least-privilege by default, and is built to meet NIS2 and ISO 27001.

Example case

Picture a higher-education institution with around 4,500 staff across several faculties, running Unit4 as its HR and finance core while its identity provisioning never quite keeps up. Unit4 Identity Services handles single sign-on, but there is no ready-made path from HR to Entra ID, so a lightly maintained script and a queue of tickets do the actual provisioning. Lecturers with a second, parallel appointment end up driven off the wrong position, and future-dated starts are created the moment HR saves the record rather than on the actual start date.

Connect Unit4 to Microsoft Entra ID with Joinly and that work disappears. Joinly reads each HR change in Unit4 ERPx at the source and acts on it automatically: new starters have their account, Office licence and group access ready on their effective start date, transfers between faculties swap the right groups the same day, a second appointment just adds access on one stable UPN, and leavers are disabled on their end date with a 30-day soft-delete grace window.

“Parallel appointments used to be the thing that broke every sync. Now an account is simply ready on the start date, a second position just adds access, and we can show the auditor exactly which Unit4 change created every bit of access.” — Head of IT, higher-education institution

The outcome this setup is designed for: onboarding drops from days to zero touch, appointment-related access errors stop entirely, and the team can walk into its next NIS2 assessment with a complete, source-backed audit trail.