Automated Joiner-Mover-Leaver Playbook with Paycom HRIS and Entra ID

Overview

This document provides a step-by-step walkthrough for configuring and using Joiner–Mover–Leaver (JML) Playbooks in BalkanID with Paycom HRIS as the source of employee lifecycle data and Microsoft Entra ID as the downstream identity platform.

It covers the full setup flow from integrating Paycom data, to configuring an orchestration workflow, and finally executing playbook actions that automatically create, route, approve, and fulfill access requests based on defined policies.

While this guide is written for Paycom HRIS and Entra ID, the same lifecycle automation concepts apply to other HR systems and connected applications supported by BalkanID.

This guide is intentionally written to support multiple Paycom deployment patterns. Publicly available integration references indicate that Paycom access may be delivered through direct API access, partner-managed connectivity, scheduled data exchange, or tenant-specific onboarding integrations depending on the environment. Validate the exact access model available in your Paycom tenant before production rollout.

What Are JML Playbooks?

JML Playbooks in BalkanID automate identity and access workflows triggered by employee lifecycle events such as:

• Joiner: A new employee starts or reaches a hire-ready onboarding state.

• Mover: An employee changes role, department, manager, title, location, or employment type.

• Leaver: An employee exits the organization or is marked inactive or terminated.

Playbooks can automatically:

• Create access requests.

• Route requests for approval or auto-approval based on policy.

• Trigger provisioning and deprovisioning workflows.

• Maintain an auditable record of lifecycle actions within the BalkanID tenant.

Playbooks can be triggered in near real time through an event-driven workflow or run on a scheduled basis when Paycom data is retrieved through polling or file-based exchange.

Pre-requisites

Before you begin, ensure the following are in place:

• An active BalkanID tenant.

• Administrative access to the relevant Paycom integration or data exchange configuration for your tenant.

• Global Administrator or appropriately delegated administrator access in Microsoft Entra ID.

• An active orchestration layer such as n8n, an internal middleware service, or another workflow automation platform.

• A confirmed method to retrieve employee lifecycle data from Paycom, such as API access, scheduled export, or an approved third-party connector.

• Agreed attribute mappings for employee ID, legal name, preferred name, work email, manager, department, title, employment type, location, hire date, and termination date.

BalkanID recommends using a dedicated service account for Entra ID integrations instead of a personal administrator account. The same principle should be applied to any middleware credentials used to retrieve Paycom data or invoke BalkanID APIs.

Integration Setup

1. Configure HRIS - Paycom Integration

1. Log in to your BalkanID tenant.

2. Navigate to Configure → Integrations.

3. Click Add Integration.

4. Select the integration path your organization uses for Paycom data ingestion, such as a supported connector, managed integration layer, or custom employee data import flow.

5. Provide a description and assign an owner for the integration.

6. Configure authentication according to the access model approved for your environment. This may be direct API credentials, middleware credentials, or partner-managed connectivity.

7. Complete any optional configuration required for employee data retrieval, field mapping, or sync behavior.

8. Save the integration and verify that employee data is available in BalkanID. A healthy integration should show a connected state and retrievable employee records before lifecycle automation is enabled.

2. Configure Microsoft Entra ID Integration

BalkanID recommends using a dedicated service account for Entra ID integrations instead of a personal user account.

Follow the official setup guide here:

• Microsoft Entra ID Integration Setup

This integration enables BalkanID to evaluate identity attributes, roles, and group memberships required for provisioning and deprovisioning decisions.

3. Confirm Identity Mapping Inputs

Before enabling JML automation, validate that the following values can be consistently sourced from Paycom or its integration layer:

• Employee unique identifier.

• Legal and preferred names.

• Start date and employment status.

• Department, title, manager, and location.

• Termination or separation effective date.

Inconsistent status values are one of the fastest ways to create false Joiner, Mover, or Leaver triggers. Normalize status values in the orchestration layer before events are sent to BalkanID.

Event Delivery Pattern: Paycom ↔ Workflow Layer

To enable JML automation, Paycom lifecycle changes must be made available to the workflow layer that invokes BalkanID playbooks. Available integration references indicate this can be implemented through direct API retrieval, scheduled synchronization, or connector-based delivery depending on the Paycom environment.

Use one of the following validated patterns in your environment:

• API polling pattern: The workflow queries Paycom for new or changed employee records at a defined interval.

• Scheduled export pattern: The workflow processes a recurring employee data extract and identifies lifecycle deltas.

• Connector pattern: A third-party HRIS connector synchronizes Paycom data to the orchestration layer or a unified HRIS API service.

• Tenant-specific event pattern: A Paycom-enabled event delivery mechanism posts changes to your middleware endpoint where supported. This should only be documented as implemented after tenant confirmation.

The workflow layer should normalize all incoming changes into lifecycle trigger classes before invoking BalkanID:

• Joiner event.

• Mover event.

• Leaver event.

It should also:

• Suppress duplicate events.

• Preserve the source employee identifier.

• Log outbound payloads and responses for auditability.

• Enforce field-level mapping and validation before a playbook is triggered.

Workflow Setup

1. Import the BalkanID JML workflow package into n8n or build an equivalent workflow in your preferred orchestration platform.

2. Create a BalkanID API key from Account → API Keys and store it securely in the workflow platform.

3. Configure the credentials required to retrieve Paycom employee data using the access model approved in your environment.

4. Initialize workflow variables for BalkanID tenant identifiers, API base URLs, employee identifier mapping, and environment-specific routing rules.

5. Build lifecycle detection logic for Joiner, Mover, and Leaver events using normalized Paycom attributes.

6. Add retry handling, idempotency controls, and exception logging before activating the workflow.

7. Activate the workflow only after test records have been successfully processed end to end.

Treat the workflow layer as the control point for attribute normalization, duplicate suppression, and conditional routing. This keeps BalkanID playbook logic focused on governance decisions rather than source-system cleanup.

Playbooks in Action

Joiner Playbook Flow

The Joiner playbook automates identity creation and access provisioning when a new employee joins the organization.

1. A new employee record is created in Paycom or reaches the configured onboarding-ready state.

2. The workflow layer retrieves or receives the lifecycle change and classifies it as a Joiner event.

3. The Joiner playbook is triggered in BalkanID.

4. A user account is created in Entra ID on or before the employee start date according to policy.

5. BalkanID evaluates birthright access using attributes such as title, department, manager, employment type, and location.

6. BalkanID generates access grant requests.

7. Requests are auto-approved via policy or routed for manual approval.

8. Approved access is provisioned in Entra ID and any connected downstream systems.

9. Audit evidence is retained in BalkanID.

If your implementation requires writing values back to Paycom, such as generated work email addresses or lifecycle annotations, they can be an optional tenant-specific extension.

Mover Playbook Flow

The Mover playbook manages access changes when employee attributes change in Paycom.

1. One or more governed attributes such as department, title, manager, location, or employment type are updated in Paycom.

2. The workflow layer detects the change and classifies it as a Mover event.

3. The Mover playbook is triggered in BalkanID.

4. BalkanID recalculates required access based on the updated employee profile.

5. Access grant and revoke requests are generated.

6. Requests are auto-approved by policy or routed for manual approval.

7. Approved changes are provisioned in Entra ID and connected systems.

Leaver Playbook Flow

The Leaver playbook ensures timely deprovisioning when an employee is terminated, separated, or marked inactive.

1. An employee is marked terminated, inactive, or separated in Paycom.

2. The workflow layer classifies the change as a Leaver event and invokes BalkanID.

3. BalkanID generates access revoke requests.

4. Requests are auto-approved through policy or routed for manual approval.

5. Upon approval, the user is disabled, suspended, or otherwise blocked in Entra ID according to the organization’s offboarding policy.

6. Downstream access is removed and the action trail is retained for audit review.

Align the trigger condition with the business event that should start offboarding, such as termination entered, separation approved, or employment status inactive. That decision belongs in policy design and should be tested carefully before production activation.