How does Joinly sync YouServe to Microsoft Entra ID?

Joinly reads each HR change from YouServe HR Core through the IAM API and applies it to the matching Entra ID account automatically. The IAM API is the interface Visma built specifically so identity systems can provision from HR Core, so it is the authoritative starting point for each identity action.

1. Joiner. HR completes the hire in YouServe. Joinly reads the new person, employment and organization-unit records, groups them by personCode and determines the role from the organization unit, job profile and cost center. It then creates the account in Entra ID, assigns the right licences and maps the person into the correct groups — timed to the employment start date.

2. Mover. When someone changes organization unit, job profile or department in YouServe, Joinly updates their group membership, permissions and licences to match. Access that no longer fits the new position is revoked, so permissions stay aligned with the actual job.

3. Leaver. On the employment end date recorded in YouServe, Joinly disables the Entra ID account automatically. There are no orphaned accounts left active after someone has left, and because a person can hold more than one employment, access is only removed when the last active employment ends.

Example: A housing corporation hires a maintenance planner in YouServe with a start date next Monday, in its Vastgoedbeheer organization unit. Joinly reads the new records, waits until the start date, creates the Entra ID account, assigns a Microsoft 365 licence and adds the planner to the Vastgoed-Operations group. When that planner later picks up a second, small employment as an on-call duty officer, Joinly keeps the newest primary record as the identity, adds the extra group and leaves the single account and sign-in intact.

What manual user management costs

Without automation, every account starts as a YouServe export or a line in a spreadsheet that IT works through by hand. A flat-file route or a plain IAM-API pull can move attributes across, but it leaves role-to-group mapping, the personCode-based identity choice and the manager-from-organization-unit lookup to people — so the part that actually decides access still falls to your team.

• Onboarding delays. New joiners wait for accounts, licences and group access while a ticket sits in a queue, losing productive days in their first week.

• Permissions that don’t keep up (privilege creep). When movers change organization unit or job profile, old access often stays attached, so people accumulate rights they no longer need.

• Forgotten offboarding. Accounts that aren’t disabled on time are both a security and audit risk, and unused licences keep costing money — and with multiple employments per person it is easy to disable an account while another employment is still active.

Joinly vs. a plain YouServe IAM-API export

A direct IAM-API pull or a flat-file export is a fine baseline, but it stops short of the part that actually decides access. Here’s how the two compare for a YouServe HR Core-driven setup.

Watch-outs when connecting YouServe to Microsoft Entra ID

A few YouServe-specific details decide whether this connection stays reliable at scale.

• Multiple employments per person. The IAM API returns an employee record for each employment, grouped by personCode. A naive integration can sync a dormant or wrong employment as the identity. Joinly groups by personCode and picks the newest record as the person, so a second employment adds access instead of a duplicate account.

• Manager comes from the organization unit, not a role. In HR Core Business the manager reference lives on the organizationUnits endpoint and the Assignments endpoint isn’t available. Joinly resolves the manager and hierarchy from organization units automatically, so the manager attribute in Entra ID is always correct.

• The Person layer must be enabled. The persons endpoint only returns data once the Person layer is switched on in YouServe HR Core. Joinly’s onboarding checks this up front, so the connection isn’t silently returning empty person data.

• Mapping organization units to Entra groups. Organisatorische eenheden, job profiles and cost centers don’t translate one-to-one to Entra ID groups. Joinly builds explicit mapping rules from those structures to the correct groups and licences, so role drives access rather than manual assignment.

• UPN format with duplicate names. When two employees share a name, a naive UPN rule produces collisions. Joinly applies custom transformation rules — a suffix, personCode fragment or controlled tiebreaker — so every UPN is unique and predictable from day one.

Joinly handles each of these by default with custom mapping and transformation.

Always audit-ready

Every account action Joinly performs is logged: who was affected, when it happened, which access changed and which YouServe change triggered it. For NIS2 that matters directly: access can be traced back to an authorised HR source rather than an ad-hoc request. Joinly is ISO 27001 certified, runs in an EU data centre in Amsterdam, applies least-privilege by default, and is built to meet NIS2 and ISO 27001.

Example case

Picture a housing corporation with around 900 employees across a head office and several district teams, running YouServe HR Core as its HR core while its identity provisioning never quite keeps up. A nightly export handles the simple cases, yet on-call duty officers with a second small employment, internal transfers between district teams and future-dated contracts keep breaking it — people with two employments end up with the wrong one synced to Entra ID, and the manager attribute is often blank because it lives on the organization unit rather than a role.

Connect YouServe to Microsoft Entra ID with Joinly and that work disappears. Joinly reads each HR change through the IAM API and acts on it automatically: new hires have their account, Microsoft 365 licence and group access ready on their start date, transfers between district teams swap the right groups the same day, a second employment just adds access to one stable account, and leavers are disabled on their end date with a 30-day soft-delete grace window.

“Two employments on one person used to be the thing that broke every sync. Now an account is simply ready on the start date, a second employment just adds access, and we can show the auditor exactly which YouServe change created every bit of access.” — Head of IT, housing corporation

The outcome this setup is designed for: onboarding drops from days to zero touch, multi-employment errors stop entirely, and the team can walk into its next NIS2 assessment with a complete, source-backed audit trail.