Integrations
Application provisioning: accounts in your business applications from HR
Application provisioning means that accounts and permissions in business applications are created, updated and removed automatically based on HR data and roles. KoppelHet does this with Joinly, which provisions applications such as TOPdesk, ServiceNow, Nedap ONS, Magister and Google Workspace from the HR system through SCIM or a direct API connection.
What it is
Entra ID and Active Directory are not the only places where an employee needs an account. Think of the service desk, the ERP, the care record or the pupil administration system. Without an integration an administrator creates those accounts by hand, and forgets them when someone leaves.
Many applications support SCIM, often through Entra ID. Others only have their own API or no provisioning at all.
How Joinly handles it
- Direct connectors for TOPdesk, ServiceNow, Freshservice, Nedap ONS, Magister, ESIS, ParnasSys, Odoo, SAP and Google Workspace, among others.
- Provisioning through SCIM or a direct API connection per target system.
- Custom mappings translate HR data into application accounts and roles.
- Groups, licences and roles in the application follow the employee's role.
- Each app integration also has an SSO variant: sign-in through Entra ID, with provisioning through SCIM.
- If an application is not listed, Joinly adds an integration.
What KoppelHet does
KoppelHet also connects HR directly to applications when it is about more than an account, for example people and departments to TOPdesk, employees to Nedap ONS or a school board's staff to ESIS.
Joinly
Continue at Joinly
Joinly is KoppelHet's IAM software. joinly.app shows how the product handles this, with screens, pricing and a demo.
Common integrations
Workday → TOPdesk
Workday TOPdesk integration: Dutch employees and onboarding tickets from Workday
Microsoft Entra ID → ESIS
Entra ID to ESIS integration: teachers set up in ESIS, access removed on departure
AFAS Profit → Google Workspace
Connect AFAS to Google Workspace: Google accounts from HR
Workday → Okta
Workday to Okta integration: identities from HR, with your own rules for the Netherlands
Frequently asked questions
What is the difference between SSO and provisioning?
SSO handles sign-in: the employee signs in with their Entra ID account. Provisioning makes sure the account exists in the application, with the right role, and disappears on departure. You usually need both.
What if an application does not support SCIM?
Then it runs through a direct API connection or through Joinly's SCIM Gateway.
Our application is not listed. Is it still possible?
Joinly adds new integrations on request. If the application has an API or SCIM, that is usually the route.
More on Identity and access management
Identity and access management: the overview
Lifecycle
Roles and governance
Integrations
- HR as the sourceThe HR system decides who gets an account, with which data.
- Microsoft Entra IDAccounts, groups and licences in Entra ID from HR.
- Active DirectoryOn-premises AD and hybrid Exchange through an agent without an open port.
- Application provisioningAccounts and roles in your business applications, from HR.
- SCIM and SCIM GatewayThe provisioning standard, also for applications without SCIM.
Compliance and sectors
- NIS2 and the Dutch Cyber Security ActWhat the duty of care asks of access management, and what it does not.
- IAM in educationSchool board staff, ready for the IBP standards framework.
- IAM in governmentMunicipalities, provinces and water boards, with BIO and ENSIA.
- IAM in healthcareFlexible staff, multiple contracts and NEN 7510.