Lifecycle
Managing contractors and temporary access with an end date
You manage contractors and temporary access by giving every account without an employment contract an owner and a mandatory end date, so access expires by itself. KoppelHet does this with Joinly, which follows contractors from the HR system or creates them separately, and closes their accounts in Microsoft Entra ID and Active Directory on the end date.
What it is
The accounts that do not come from HR stay around the longest: last year's contractor, a supplier's guest account, a service account without an owner. Nobody sees them leave, because there is no termination date.
NIS2 asks for least privilege and lifecycle management, including for accounts without an employment contract. An account without an owner or end date is a common audit finding.
How Joinly handles it
- If an external is in HR, for example as a contractor contract, Joinly follows that contract including its end date.
- If not, you create them in Joinly with a minimal dataset and a dedicated external role.
- An end date is mandatory. On that date the account is disabled, sessions are revoked and licences are released.
- A reminder goes out beforehand. Extension is possible with the manager's approval.
- Guest accounts in Entra ID follow the same lifecycle, with an end date and a filter for externals.
- Service accounts and shared mailboxes get an owner and a reason on which they end.
- Externals are in the same audit log as employees.
What KoppelHet does
Whether contractors are in the HR system differs per organisation and per HR system. In the intake KoppelHet maps how AFAS, YouForce or your HR system records contractors and temporary contracts. That decides which externals come from HR and which you create in Joinly yourself.
Joinly
Continue at Joinly
Joinly is KoppelHet's IAM software. joinly.app shows how the product handles this, with screens, pricing and a demo.
Contractors, temporary staff and service accounts at Joinly (in Dutch)
Common integrations
Frequently asked questions
Do contractors have to be in the HR system?
No. If they are not, you create them directly in Joinly, next to the employees from HR.
What happens on the end date?
The account is deactivated, sessions are revoked and licences are released. A reminder goes out beforehand, so an extension can be requested in time.
Can a manager approve temporary access?
Yes. Temporary access and temporary roles can be granted with a manager's approval, with a fixed end date.
More on Identity and access management
Identity and access management: the overview
Lifecycle
- Joiners, movers and leaversAccounts, permissions and licences that follow employment.
- OffboardingAccess closed on the termination date, including mailbox, licences and laptop.
- Contractors and temporary accessContractors, interns, guest accounts and service accounts with an end date.
Roles and governance
Integrations
- HR as the sourceThe HR system decides who gets an account, with which data.
- Microsoft Entra IDAccounts, groups and licences in Entra ID from HR.
- Active DirectoryOn-premises AD and hybrid Exchange through an agent without an open port.
- Application provisioningAccounts and roles in your business applications, from HR.
- SCIM and SCIM GatewayThe provisioning standard, also for applications without SCIM.
Compliance and sectors
- NIS2 and the Dutch Cyber Security ActWhat the duty of care asks of access management, and what it does not.
- IAM in educationSchool board staff, ready for the IBP standards framework.
- IAM in governmentMunicipalities, provinces and water boards, with BIO and ENSIA.
- IAM in healthcareFlexible staff, multiple contracts and NEN 7510.