Roles and governance

Roles and RBAC: access that follows the job

With role-based access (RBAC) you define once which groups, licences and applications belong to a job, and everyone with that job gets that access automatically. KoppelHet does this with Joinly, which assigns roles based on department, job and location from the HR system and removes them in Microsoft Entra ID as soon as that data changes.

Last updated: 28 September 2026

Roles and RBAC at Joinly All about IAM

What it is

In many organisations access grows by copying: someone gets a colleague's permissions, and that colleague already had too many. Nobody cleans it up. The result is access nobody can explain any more.

A role is a bundle of access that belongs to a job. An authorisation matrix in Excel describes those roles. RBAC also enforces them and keeps them current.

How Joinly handles it

A role bundles Entra groups (security and Microsoft 365), Enterprise Applications with app roles, Microsoft licences and plugin applications such as Bitwarden.
Conditional roles are assigned automatically on department, job, location or any other field, also combined.
Manual roles cover exceptions. Roles and group memberships can have an end date.
Role evaluation compares who should have a role with who actually has it, and applies the difference in one click.
The claims model keeps access that another legitimate source still covers, so removing a role breaks nothing.
Existing memberships are imported first as a claim source, so you clean up in a controlled way instead of all at once.
You can attach a workflow to assigning or removing a role, for example a service desk ticket.

What KoppelHet does

Roles depend on job, department and location in the HR system. Those fields are often not as tidy as a role model needs: free text instead of a code list, or departments named differently per site. KoppelHet knows those fields per HR system and helps make them usable before the first role goes live.

Joinly

Continue at Joinly

Joinly is KoppelHet's IAM software. joinly.app shows how the product handles this, with screens, pricing and a demo.

Roles and RBAC at Joinly

Role automation

Common integrations

AFAS Profit → Microsoft Entra ID

Connect AFAS with Microsoft Entra ID

Visma Raet YouForce → Microsoft Entra ID

YouForce to Entra ID integration: Microsoft accounts and managers from Visma Raet

Workday → Microsoft Entra ID

Workday to Entra ID integration: Microsoft accounts for the Netherlands from global HR

HiBob → Active Directory

HiBob to Active Directory integration: accounts in your own network, automatically

Frequently asked questions

What is in a role?

Access items: Entra groups, Enterprise Applications with app roles, Microsoft licences and plugin applications. Whoever gets the role gets the whole bundle and loses it again when it is removed, unless another source still covers the access.

Which data is a role assigned on automatically?

On any field of the identity: department, job, location and custom fields. Conditions can be combined, for example department Care and location Utrecht.

How do you move from a manual situation to RBAC?

With role evaluation. It shows per role who should have it and who actually has it. You apply the difference role by role.

What is the difference between RBAC and ABAC?

With RBAC someone gets access through a role. With ABAC attributes such as department or location decide access. Conditional roles in Joinly combine both: attributes from HR decide who gets the role.