Problem
Access tends to grow over time. People keep permissions from old roles, leavers are not removed promptly, and admin accounts are shared. Customer-facing services add another layer: many user types, each needing different access, often built differently in every application.
Outcomes
- Single sign-on and multi-factor authentication for staff.
- Access based on role, granted and removed through a defined process.
- Privileged access controlled and recorded.
- Regular access reviews with named reviewers.
- Customer and multi-role services with clear, tested permission models.
Scope
In scope
- Identity strategy and architecture.
- Single sign-on and multi-factor authentication.
- Role-based access design.
- Joiner, mover and leaver processes.
- Privileged access management.
- Customer identity and multi-role permission design.
- Access reviews.
Not included
- HR system implementation. We integrate with your HR system as the source of joiner and leaver events.
Approach
Discovery
We find who has access to what today.
Delivery Planning
We design roles based on what people need to do, and agree how access will be reviewed.
Build and Test
We set up single sign-on and multi-factor authentication, and connect joiner, mover and leaver events to access changes.
Operational Readiness, Hypercare and Closure
We set up regular access reviews and hand over the role model, the sign-in configuration and the access review process. We close the work with your sign-off.
Deliverables
Technologies
Controls
Frequently Asked Questions
We use Microsoft 365. Do we already have what we need?
You may have more than you use. We often start by switching on and configuring features you already pay for.
How do you handle services with many user types?
We design a role and permission model for the service, test it for each user type, and document who can do what.
What is privileged access management?
Extra controls on the most powerful accounts, such as time-limited access and recording of admin activity.
How often should access be reviewed?
It depends on risk. Privileged access is often reviewed monthly or quarterly, standard access less often.
Not sure who has access to what?
A Technical Audit reviews your identity and access arrangements in 10 to 15 working days and gives you a prioritised remediation plan. It does not include penetration testing unless separately contracted.