The right people reach the right systems, and former staff lose access when they leave. We handle joiners, movers and leavers, and keep sign-ins and admin rights tightly controlled.
New starterAccount and MFA ready for day oneManaged
LeaverSign-in blocked and sessions revokedManaged
Conditional accessSign-in from unexpected country blockedContained
Admin accountsSeparated from everyday accountsManaged
Guest usersStale guest access removedManaged
Access reviewProposed changes to approveDecision needed
Illustration · not live data
01Who it's for
Is this service right for you?
It suits organisations where account changes depend on whoever is free that day. Attackers often target accounts rather than software flaws, so getting identity right shrinks many other risks.
Built for
Businesses with 5 or more staff where accounts are created by whoever is free and rarely closed properly
Organisations that have had a compromised email account, or want to avoid one
Teams preparing for ASD Essentials or ISO/IEC 27001:2022 that need evidence of access control
Government, health and education organisations that must show who has access to sensitive information and why
You probably need it if…
You're not sure every account has MFA, or who holds admin rights
Former staff may still be able to sign in
Staff use admin accounts for everyday email and browsing
Nobody has checked guest users or files shared outside your organisation
02What's included
What you get
Joiners, movers & leavers
Onboarding new starters
We create the account, assign the right licences, groups and shared mailboxes, enrol MFA and prepare the device, so a new starter can work securely from their first morning.
Offboarding leavers
When someone leaves, we block sign-in, revoke sessions, remove access to shared data, hand over their mailbox and files, and recover licences, working from a checklist so steps aren't missed.
Role changes
When staff change roles, we remove access they no longer need as well as adding what they do, so permissions are less likely to quietly build up over the years.
Protect sign-ins
MFA and conditional access
We enforce multi-factor authentication (MFA) on user accounts and set conditional access rules in Microsoft Entra ID, such as blocking sign-ins from unexpected countries.
Microsoft Entra ID
Admin account control
Admin rights are separated from everyday accounts, limited to the people who need them and protected with stronger sign-in requirements. Emergency access accounts are set up and documented.
Review & approve
Access reviews
We review who has access to what, including guest users, shared mailboxes and file sharing, and give you a short list of changes to approve.
03In detail
User & identity management, in depth
How does identity management fit with the rest of your IT?
For organisations on Microsoft 365, identity work happens in Microsoft Entra ID (formerly Azure Active Directory), the identity system behind it. It can be part of our managed IT support plans, or run on its own if you already have IT support and want identity handled properly.
What does MFA miss, and how do we close the gaps?
MFA blocks many attacks that rely on stolen or guessed passwords, but it is no longer the whole answer. Attackers use fake sign-in pages that capture both the password and the MFA code, and flood users with approval prompts until someone accepts. We add conditional access policies that check where and how someone is signing in, make sure number matching is enforced, use phishing-resistant methods such as passkeys where your licences and devices allow, and review risky sign-in alerts.
On plans without conditional access, such as Business Standard, we apply Microsoft’s security defaults and explain what upgrading adds. For a deeper review of your Microsoft 365 security settings, see cloud and Microsoft 365 security.
How does identity work count towards ASD Essentials?
Identity services is one of the four Phase 1 domains in ASD Essentials, the Australian Signals Directorate’s (ASD) framework, and restricting administrative privileges and enforcing MFA are among the controls ASD prioritises. Today, organisations are still assessed against the Essential Eight maturity model, which sets out what each maturity level requires for both. Our identity audit shows where you stand against it.
Admin access should sit with as few people as possible, and never in their everyday account. We keep a record of who holds each admin role, and set up emergency access accounts to reduce the risk of being locked out of your own tenant.
Why do permissions build up over time?
When people change roles, new access is usually added and old access rarely removed, so a person who has worked in three teams keeps access to all three. Offboarding is the step that is easiest to miss, and an open account belonging to a former employee is a real risk. Access reviews help catch that drift, and give auditors and customers the evidence of access control they ask for.
04The process
How it works
1Step 01
Identity audit
We list every account, admin role, guest user and sign-in method in your environment and flag the risks, such as accounts without MFA or former staff who still have access.
2Step 02
Clean-up and hardening
With your approval, we remove stale accounts, enforce MFA, separate admin accounts and apply sign-in policies suited to your licences.
3Step 03
Joiner and leaver process
We agree a simple request process with your managers or HR, so every start, change and exit reaches us in time.
4Step 04
Ongoing reviews
We run access reviews on a set schedule and report what changed and what still needs a decision.
05Frameworks
How this maps to the frameworks
Useful for your auditor, board or procurement team. The mapping shows where this service supports each framework. It doesn't replace a formal assessment.
User & Identity Management: framework mapping
Control
ASD Essentials
ASD maturity model (current)
ISO/IEC 27001
NIST CSF
Multi-factor authentication
Identity services
Multi-factor authentication
A.5.17, A.8.5
Protect (PR.AA-03)
Joiner, mover and leaver process
Identity services
–Not applicable
A.5.16, A.5.18
Protect (PR.AA-01)
Admin account control
Identity services
Restrict administrative privileges
A.8.2
Protect (PR.AA-05)
Access reviews
–Not applicable
–Not applicable
A.5.15, A.5.18
Protect (PR.AA-05)
06Pricing
Pricing and how to start
Pricing
Quoted for your environment
What changes the price
Identity management can be part of a managed IT support plan, with access reviews included from the Business plan up (quarterly on Business, monthly on Secure+). The standalone price depends on user and admin account numbers, how many systems connect to your identity platform and how much clean-up is needed at the start.
What is identity and access management for a small business?
Identity and access management is the set of controls that decides who gets into your systems and what they can do once inside. For a small or medium business, it usually means managing Microsoft 365 or Google Workspace accounts, enforcing MFA, limiting admin rights and closing accounts promptly when staff leave. It is one of the most effective ways to reduce the risk of a breach.
What should happen to a user's account when they leave?
Their sign-in should be blocked on their last day, and their active sessions revoked so they can't stay signed in on a phone or home computer. Their mailbox and files should be handed to a manager, their access to shared data removed, and their licences recovered. We follow a written checklist so each step is completed and noted, not left to memory.
What is an emergency access (break-glass) account?
An emergency access account is a highly privileged cloud-only account kept for when normal admin sign-in fails, for example if a conditional access policy locks admins out. Microsoft recommends at least two, protected with strong authentication, excluded from everyday use and monitored for any sign-in. We set them up, document how they are secured and check them as part of access reviews.
Why shouldn't staff use admin accounts every day?
An admin account that reads email and browses the web gives an attacker full control the moment it is compromised. Keeping admin rights in separate accounts, used only for admin tasks, limits the damage from a phishing email or a malicious download, and makes it clear who can change what in your systems.
How often should we review who has access to what?
Review access regularly, and straight away after a restructure, a merger or the departure of someone with wide access. Reviews catch the gradual build-up of permissions as people change roles, forgotten guest users, and shared links to sensitive files. We prepare the list, and you approve what should stay.
Do you manage Google Workspace accounts as well as Microsoft 365?
Yes. In Google Workspace we enforce 2-Step Verification, keep super admin accounts separate from everyday ones, suspend leavers promptly and transfer their Drive files to a manager, and review the third-party apps staff have granted access to their accounts. The joiner, mover and leaver process is the same one we follow for Microsoft 365.
