Call
Talk to an expert

Managed IT

User & Identity Management

The right people reach the right systems, and former staff lose access when they leave. We handle joiners, movers and leavers, and keep sign-ins and admin rights tightly controlled.

Ask about User & Identity Management
Your identity platformSample view
  • New starterAccount and MFA ready for day oneManaged
  • LeaverSign-in blocked and sessions revokedManaged
  • Conditional accessSign-in from unexpected country blockedContained
  • Admin accountsSeparated from everyday accountsManaged
  • Guest usersStale guest access removedManaged
  • Access reviewProposed changes to approveDecision needed
Illustration · not live data

In short

User and identity management controls who can sign in to your systems and what each person can reach, from a new starter's first day to the hour they leave. Catharsis, a Sydney cyber security company, runs onboarding, offboarding, multi-factor authentication, admin access and regular access reviews for you.

01Who it's for

Is user and identity management right for you?

It suits organisations where account changes depend on whoever is free that day. Attackers often target accounts rather than software flaws, so getting identity right shrinks many other risks.

Built for

  • Businesses with 5 or more staff where accounts are created by whoever is free and rarely closed properly
  • Organisations that have had a compromised email account, or want to avoid one
  • Teams preparing for ASD Essentials or ISO/IEC 27001:2022 that need evidence of access control
  • Government, health and education organisations that must show who has access to sensitive information and why

You probably need it if…

  • You're not sure every account has MFA, or who holds admin rights
  • Former staff may still be able to sign in
  • Staff use admin accounts for everyday email and browsing
  • Nobody has checked guest users or files shared outside your organisation

02What's included

What user and identity management includes

Joiners, movers & leavers

Onboarding new starters

We create the account, assign the right licences, groups and shared mailboxes, enrol MFA and prepare the device, so a new starter can work securely from their first morning.

Offboarding leavers

When someone leaves, we block sign-in, revoke sessions, remove access to shared data, hand over their mailbox and files, and recover licences, working from a checklist so steps aren't missed.

Role changes

When staff change roles, we remove access they no longer need as well as adding what they do, so permissions are less likely to quietly build up over the years.

Protect sign-ins

MFA and conditional access

We enforce multi-factor authentication (MFA) on user accounts and set conditional access rules in Microsoft Entra ID, such as blocking sign-ins from unexpected countries.

  • Microsoft Entra ID

Admin account control

Admin rights are separated from everyday accounts, limited to the people who need them and protected with stronger sign-in requirements. Emergency access accounts are set up and documented.

Review & approve

Access reviews

We review who has access to what, including guest users, shared mailboxes and file sharing, and give you a short list of changes to approve.

03Related work

User and identity management in practice

Real engagements, anonymised because our clients are under NDA. The full write-ups, with results, are on our work page.

  • Australian small business · client under NDA

    Business email compromise investigation

    An investigation and clean-up after an attacker took over a Microsoft 365 mailbox, hid a forwarding rule and emailed everyone in the user's contacts.

    • Root cause and timeline established from logs and email evidence
    • The attacker's hidden forwarding rule found and removed

See all our work

04In detail

User & identity management, in depth

How does identity management fit with the rest of your IT?

For organisations on Microsoft 365, identity work happens in Microsoft Entra ID (formerly Azure Active Directory), the identity system behind it. It can be part of our managed IT support plans, or run on its own if you already have IT support and want identity handled properly.

What does MFA miss, and how do we close the gaps?

MFA blocks many attacks that rely on stolen or guessed passwords, but it is no longer the whole answer. Attackers use fake sign-in pages that capture both the password and the MFA code, and flood users with approval prompts until someone accepts. We add conditional access policies that check where and how someone is signing in, make sure number matching is enforced, use phishing-resistant methods such as passkeys where your licences and devices allow, and review risky sign-in alerts.

On plans without conditional access, such as Business Standard, we apply Microsoft’s security defaults and explain what upgrading adds. For a deeper review of your Microsoft 365 security settings, see cloud and Microsoft 365 security.

How does identity work count towards ASD Essentials?

Identity services is one of the four Phase 1 domains in ASD Essentials, the Australian Signals Directorate’s (ASD) framework, and restricting administrative privileges and enforcing MFA are among the controls ASD prioritises. Today, organisations are still assessed against the Essential Eight maturity model, which sets out what each maturity level requires for both. Our identity audit shows where you stand against it.

Admin access should sit with as few people as possible, and never in their everyday account. We keep a record of who holds each admin role, and set up emergency access accounts to reduce the risk of being locked out of your own tenant.

Why do permissions build up over time?

When people change roles, new access is usually added and old access rarely removed, so a person who has worked in three teams keeps access to all three. Offboarding is the step that is easiest to miss, and an open account belonging to a former employee is a real risk. Access reviews help catch that drift, and give auditors and customers the evidence of access control they ask for.

05The process

How user and identity management works

  1. Identity audit

    We list every account, admin role, guest user and sign-in method in your environment and flag the risks, such as accounts without MFA or former staff who still have access.

  2. Clean-up and hardening

    With your approval, we remove stale accounts, enforce MFA, separate admin accounts and apply sign-in policies suited to your licences.

  3. Joiner and leaver process

    We agree a simple request process with your managers or HR, so every start, change and exit reaches us in time.

  4. Ongoing reviews

    We run access reviews on a set schedule and report what changed and what still needs a decision.

06Frameworks

How this maps to the frameworks

Useful for your auditor, board or procurement team. The mapping shows where this service supports each framework. It doesn't replace a formal assessment.

User & Identity Management: framework mapping
ControlASD EssentialsASD maturity model (current)ISO/IEC 27001NIST CSF
Multi-factor authenticationIdentity servicesMulti-factor authenticationA.5.17, A.8.5Protect (PR.AA-03)
Joiner, mover and leaver processIdentity servicesNot applicableA.5.16, A.5.18Protect (PR.AA-01)
Admin account controlIdentity servicesRestrict administrative privilegesA.8.2Protect (PR.AA-05)
Access reviewsNot applicableNot applicableA.5.15, A.5.18Protect (PR.AA-05)

07Pricing

Pricing and how to start

Pricing

Quoted for your environment

What changes the price

Identity management can be part of a managed IT support plan, with access reviews included from the Business plan up (quarterly on Business, monthly on Secure+). The standalone price depends on user and admin account numbers, how many systems connect to your identity platform and how much clean-up is needed at the start.

  • Onboarding and offboarding for every covered user
  • MFA enforcement and conditional access management
  • Admin account separation and control
  • Scheduled access reviews with a written summary
Get a quoteSee Managed IT plans

08FAQ

User & identity management, answered.

Can't see your question? Ask a specialist and get a straight answer.

Ask a specialist
What is identity and access management for a small business?

Identity and access management is the set of controls that decides who gets into your systems and what they can do once inside. For a small or medium business, it usually means managing Microsoft 365 or Google Workspace accounts, enforcing MFA, limiting admin rights and closing accounts promptly when staff leave. It is one of the most effective ways to reduce the risk of a breach.

What should happen to a user's account when they leave?

Their sign-in should be blocked on their last day, and their active sessions revoked so they can't stay signed in on a phone or home computer. Their mailbox and files should be handed to a manager, their access to shared data removed, and their licences recovered. We follow a written checklist so each step is completed and noted, not left to memory.

What is an emergency access (break-glass) account?

An emergency access account is a highly privileged cloud-only account kept for when normal admin sign-in fails, for example if a conditional access policy locks admins out. Microsoft recommends at least two, protected with strong authentication, excluded from everyday use and monitored for any sign-in. We set them up, document how they are secured and check them as part of access reviews.

Why shouldn't staff use admin accounts every day?

An admin account that reads email and browses the web gives an attacker full control the moment it is compromised. Keeping admin rights in separate accounts, used only for admin tasks, limits the damage from a phishing email or a malicious download, and makes it clear who can change what in your systems.

How often should we review who has access to what?

Review access regularly, and straight away after a restructure, a merger or the departure of someone with wide access. Reviews catch the gradual build-up of permissions as people change roles, forgotten guest users, and shared links to sensitive files. We prepare the list, and you approve what should stay.

Do you manage Google Workspace accounts as well as Microsoft 365?

Yes. In Google Workspace we enforce 2-Step Verification, keep super admin accounts separate from everyday ones, suspend leavers promptly and transfer their Drive files to a manager, and review the third-party apps staff have granted access to their accounts. The joiner, mover and leaver process is the same one we follow for Microsoft 365.

Talk to our team

Talk to us about user & identity management.

No obligation. You talk to the people who do the work.