Roles and governance
Access review and audit log: proving who can access what
An access review compares the access someone actually has with the access their role should give, and an audit log records every grant and removal. KoppelHet does both with Joinly, which compares access in Microsoft Entra ID and Active Directory with the roles from the HR system and logs every change immutably.
What it is
An auditor asks the same questions every time. Why does this person have access to this system? Were leavers closed off on time? Where is it recorded when someone got access? Does actual access match intended access?
Without central access management, answering takes days of exports and screenshots. With an automated and logged process the evidence is already there.
How Joinly handles it
- The access review shows the difference between actual and intended access, correctable per identity or in bulk.
- The audit log records every change with actor, source and the old and new value.
- Logs are stored immediately and cannot be changed afterwards.
- You filter by employee, system or period.
- Exports match audit reporting.
- An audit dashboard and notifications show the relevant events.
- Joinly deactivates accounts nobody uses any more automatically.
What KoppelHet does
The first access review is usually the baseline: the difference between HR and the directory. KoppelHet starts IAM projects with that comparison, so you see per employee what differs before anything happens automatically.
Joinly
Continue at Joinly
Joinly is KoppelHet's IAM software. joinly.app shows how the product handles this, with screens, pricing and a demo.
Common integrations
Visma Raet YouForce → Active Directory
YouForce to Active Directory integration: accounts opened and closed from Visma Raet
Workday → Microsoft Entra ID
Workday to Entra ID integration: Microsoft accounts for the Netherlands from global HR
Visma Raet YouForce → Ping Identity
YouForce to Ping Identity integration: Visma Raet as the HR source for users and groups in PingOne
Workday → Ping Identity
Workday to Ping Identity integration: what PingOne's Workday provisioner does, and where custom work starts
ADP iHCM → Okta
ADP iHCM to Okta integration: ADP as the HR source for Okta, with groups per country
Loket → Okta
Loket to Okta integration: employees from Loket.nl as the HR source for Okta, per employer
Dayforce → Okta
Dayforce to Okta integration: Dayforce as the HR source for Okta, with dates ahead and the right manager
Customer case
DAEL Groep
Installation engineering
AFAS is the source for Active Directory and Entra ID. Accounts, email addresses and groups are created, updated and deactivated automatically based on HR changes.
“Thanks to KoppelHet's user comparison between the HR system and our AD, we quickly saw where AFAS and Microsoft differed.”
Frequently asked questions
What is the difference between an access evaluation and an access review?
An access review is the periodic check whether access is still right. Joinly's access evaluation calculates the difference between actual and intended access, so the review covers the deviations instead of every line.
Can logs be changed afterwards?
No. Joinly keeps logs in an immutable archive.
How often do you run an access review?
You decide. Joinly advises a fixed cadence and recording the corrections. That is the evidence the NIS2 duty of care asks for.
More on Identity and access management
Identity and access management: the overview
Lifecycle
Roles and governance
- Roles and RBACAccess based on job, department and location from HR.
- Segregation of duties (SoD)Stopping dangerous permission combinations before they arise.
- Access review and audit logActual next to intended access, and every change logged.
Integrations
- HR as the sourceThe HR system decides who gets an account, with which data.
- Microsoft Entra IDAccounts, groups and licences in Entra ID from HR.
- Active DirectoryOn-premises AD and hybrid Exchange through an agent without an open port.
- Application provisioningAccounts and roles in your business applications, from HR.
- SCIM and SCIM GatewayThe provisioning standard, also for applications without SCIM.
Compliance and sectors
- NIS2 and the Dutch Cyber Security ActWhat the duty of care asks of access management, and what it does not.
- IAM in educationSchool board staff, ready for the IBP standards framework.
- IAM in governmentMunicipalities, provinces and water boards, with BIO and ENSIA.
- IAM in healthcareFlexible staff, multiple contracts and NEN 7510.