Access lifecycle
Define joiner, mover and leaver processes and automate the steps your platforms support.
Identity & Access Management
Identity and access management (IAM) controls who can use your systems, what they can do and how that access changes as people join, move and leave. Umbrella Tech designs and implements IAM for Australian organisations, usually on Microsoft Entra ID, so accounts match real roles, administrator rights are limited and every access change can be traced.
The problem
The challenge we help you address
Accounts often outlast the people or roles they were created for. Shared credentials, excessive administrator permissions and manual onboarding make it harder to control access and demonstrate accountability.
The outcome
What the engagement should deliver
Your organisation gains a clearer access model, documented responsibilities and consistent handling of account changes. The aim is to remove unnecessary permissions while keeping legitimate work practical, with evidence you can show when someone asks who had access and why.
How we can help
Role design
Map permissions to roles, separate everyday and administrator accounts and set access review responsibilities.
Authentication
Roll out multi-factor authentication (MFA), with phishing-resistant methods for privileged users.
Privileged access
Limit standing administrator rights, using Microsoft Entra Privileged Identity Management where your licences include it.
Identity integration
Connect applications to single sign-on and automated provisioning where they support it.
An example from our work
At Santa Maria College, we built a structured offboarding request in Freshservice that looks up the leaver in Microsoft Entra ID and records their account details and group memberships on the ticket before any change is made. It shows how a leaver step can become consistent and traceable.
Frequently asked questions
Can't see your question? Ask us directly →
What is identity and access management?
IAM is the combination of identity platforms, processes and rules that decide who gets access to what. It covers accounts, authentication, roles, approvals and regular reviews, not just the software that stores identities.
When should a business use it?
Any organisation with several systems, sensitive information or changing staff roles benefits, so IAM is not only for large organisations. Common triggers are an audit finding about leavers, too many global administrators or a move to single sign-on.
What does implementation include?
Usually a review of current accounts and roles, a target access model, configuration in Microsoft Entra ID and connected applications, testing with users and documentation. Enforcement through Entra ID & Conditional Access can be included or delivered as a separate piece.
How long does a project take?
It depends on the number of applications, how clean existing account data is and how many processes need to change. Scope and timing are confirmed in discovery.
What are the main security or governance considerations?
Clear ownership of access approvals, separate administrator accounts, protected emergency access and evidence of regular access reviews. The Essential Eight treats restricting administrative privileges and MFA as core controls.
Plan the next improvement
Tell us what concerns you most about your environment and what evidence you need to show.