Roles and governance
Segregation of duties (SoD): stopping dangerous permission combinations
Segregation of duties prevents one person from holding two permissions that together allow fraud or errors, such as creating and approving invoices. KoppelHet does this with Joinly, which monitors such combinations on the access granted from the HR system in Microsoft Entra ID and applications, and holds back a new conflict before it arises.
What it is
Segregation of duties is one of the oldest internal controls. Whoever enters a payment should not approve it too. The rule is simple, carrying it out is not. Dangerous combinations build up: a team change where old access stays, a role that gains an item, an import.
In many organisations segregation of duties lives in an Excel matrix or a check after the fact. A forbidden combination can then exist for weeks before anyone notices. ISO 27001, NEN 7510 and SOX-like frameworks treat it as a standard control.
How Joinly handles it
- You define which two permissions may not go together. The rule works both ways.
- If someone gets the second side, Joinly prepares that access but does not release it.
- You choose who keeps which permission, or the conflict resolves itself when someone changes role.
- Existing access stays in place. Only new conflicts wait for a decision.
- Anyone holding both permissions is listed in a separate conflicts tab.
- A conflict can notify the manager or start an approval through a workflow.
- Every decision and change is logged: who, what and why.
What KoppelHet does
Segregation of duties is only as strong as the overview of permissions. In the intake KoppelHet maps which systems hold the critical permissions, such as the finance package or the ERP, and whether Joinly has a connector for them. If not, Joinly adds an integration or it runs through the SCIM Gateway.
Joinly
Continue at Joinly
Joinly is KoppelHet's IAM software. joinly.app shows how the product handles this, with screens, pricing and a demo.
Common integrations
AFAS Profit → Microsoft Entra ID
Connect AFAS with Microsoft Entra ID
Nmbrs → Microsoft Entra ID
Nmbrs to Entra ID integration: Microsoft accounts from the payroll records
Visma Raet YouForce → Microsoft Entra ID
YouForce to Entra ID integration: Microsoft accounts and managers from Visma Raet
Visma Raet YouForce → Omada
YouForce to Omada integration: Visma Raet as the authoritative source for identities in Omada Identity
OIVisma Raet YouForce → One Identity
YouForce to One Identity integration: employees and departments from Visma Raet in One Identity Manager
Frequently asked questions
Does anyone lose access they need?
No. Existing access stays in place. Only a new conflicting assignment waits for a decision.
What is an example of an SoD conflict?
Entering payments and approving payments. Or placing orders and confirming their receipt.
Does segregation of duties help in an audit?
Yes. Every decision is logged with who, what and why. That shows the control works, not only that it exists.
More on Identity and access management
Identity and access management: the overview
Lifecycle
Roles and governance
- Roles and RBACAccess based on job, department and location from HR.
- Segregation of duties (SoD)Stopping dangerous permission combinations before they arise.
- Access review and audit logActual next to intended access, and every change logged.
Integrations
- HR as the sourceThe HR system decides who gets an account, with which data.
- Microsoft Entra IDAccounts, groups and licences in Entra ID from HR.
- Active DirectoryOn-premises AD and hybrid Exchange through an agent without an open port.
- Application provisioningAccounts and roles in your business applications, from HR.
- SCIM and SCIM GatewayThe provisioning standard, also for applications without SCIM.
Compliance and sectors
- NIS2 and the Dutch Cyber Security ActWhat the duty of care asks of access management, and what it does not.
- IAM in educationSchool board staff, ready for the IBP standards framework.
- IAM in governmentMunicipalities, provinces and water boards, with BIO and ENSIA.
- IAM in healthcareFlexible staff, multiple contracts and NEN 7510.