Blog
Articles
Insights on Entra ID, ABAC, license management, and IT service desk automation.
Just-in-Time Privileged Access for Mid-Market IT
Just in time access explained: how mid-market Microsoft shops can cut standing privilege risk with PIM, without a full PAM platform rollout.
Break Glass Accounts in Entra ID: Setup and Monitoring
Break glass account best practices for Entra ID: how to set up emergency access accounts correctly and monitor them without creating a hidden risk.
Service Account Governance in Entra ID and AD
Service account governance in Entra ID and Active Directory: why non-human identities need the same rules as people, and how to bring them under control.
Guest User Lifecycle in Entra ID: A Practical Guide
Guest user lifecycle in Entra ID is often unmanaged. Learn how to give external collaborators access that expires when the collaboration ends.
Contractor Temporary Access That Expires Automatically
Contractor temporary access is often forgotten, not revoked. Learn how to give contractors and temps time-bound access that expires on its own.
How to Prove Least Privilege to an Auditor
Prove least privilege to an auditor with real evidence: lifecycle logs, timely revocation, and access reviews across Entra ID and on-prem AD.
NIS2 Netherlands Mid-Market: What IT Teams Must Know
What the Dutch Cyberbeveiligingswet (NIS2 implementation) means for NIS2 Netherlands mid-market IT teams, and how access control fits into getting ready.
NIS2 Access Control Checklist for IT Teams
A practical NIS2 access control checklist for essential and important entities: what Article 21 expects, and how to make access reproducible and auditable.
Birthright Access Done Right in Entra ID and AD
What birthright access should and shouldn't include, and how to keep it accurate in Entra ID and on-prem AD as people move roles.
Segregation of Duties Access: Mid-Market Basics
Segregation of duties access explained for mid-market IT: what toxic combinations are, how to find them, and how to enforce SoD without a full IGA suite.
Standing Access Revocation: Closing the Revoke Gap
Standing access revocation is slower than access creation in most Microsoft shops. Learn why the revoke gap forms and how automated lifecycle closes it.
Least Privilege Without Friction: A Practical Guide
Least privilege without friction is possible: combine birthright access with fast self-service to secure your Microsoft tenant without slowing people down.
Access Review Fatigue: Keep Recertification Meaningful
Access review fatigue turns recertification into rubber-stamping. Learn why it happens and how to design reviews people actually take seriously.
Access Recertification Campaigns That Actually Get Done
Access recertification campaigns explained: how to run recurring access reviews with reminders and follow-up that mid-market IT teams can sustain.
Entra Group Naming Convention: A Structure That Scales
A good Entra group naming convention lets people and automation reason about access at a glance. Learn the structure, prefixes, and rules that hold up.
Dormant Groups in Entra ID: Find and Retire Them Safely
Dormant groups Entra ID: how to find empty, unused, and forgotten groups cluttering your directory, and retire them safely without breaking access.
Group Sprawl Cleanup in Entra ID: A Safe Playbook
A practical, staged plan for group sprawl cleanup in Entra ID: how it happens, how to find the mess safely, and how to keep it from coming back.
Role Explosion: Why Static RBAC Breaks Past 200 Employees
Role explosion access control hits most companies between 200 and 300 employees. Learn why static roles multiply out of control and how attributes fix it.
EA Renewal License True-Up: A Practical Checklist
Prepare for your EA renewal license true-up with real usage data so you don't lock in three years of unused Microsoft 365 seats.
The True Cost of a Forgotten License
The cost of unused licenses compounds fast. See how one forgotten E5 seat becomes a real annual budget line, and how to catch it early.
A First Day Without Waiting: What Breaks Between HR and IT
Why new hires sit waiting for access on day one. The real problem is the handoff between HR and IT, not the technology. How to close that gap for good.
Quarterly License Review: A Lightweight Cadence
A quarterly license review beats a panic audit at renewal. Learn how to build a lightweight, repeatable cadence for Microsoft 365 license spend.
License Follows Role: Automating Entitlements
Learn how to make license follows role a working policy, so Microsoft 365 entitlements track a person's actual role as they join, move, and leave.
Maintaining Automated Access Management in Entra ID After Go-Live
Turning on attribute-driven access is one thing, keeping it correct for years is another. How to maintain an automated access model so it does not drift over time.
E5 to E3 Downgrade: Rightsizing Microsoft Licenses
An E5 to E3 downgrade can cut Microsoft 365 license cost sharply. Learn how to find over-licensed users and rightsize with real usage data.
Microsoft 365 price increase 2026: what to do now
The Microsoft 365 price increase 2026 makes every unused seat more expensive. Here is a practical plan to clean up before your renewal lands.
Password Resets and Account Status: The Hidden Time Sink
Password resets and account status tickets quietly drain service desk time. Where the volume comes from, what to fix at the source, and what to keep manual.
Orphaned Accounts: A Top Offboarding Risk
Orphaned accounts and standing access are a leading breach vector. Learn why offboarding leaves accounts behind and how automated leaver flows close the gap.
Leaver Access Cutoff: Revoke Refresh Tokens Fast
Disabling a leaver's account isn't enough. Learn why revoking refresh tokens and sessions on the last working day is essential for a real access cutoff.
Pre-Provisioning New Hires: Scheduling Joiner Actions
How to pre-provision new hires by scheduling joiner actions ahead of the start date, so accounts, access, licenses, and devices are ready in advance.
Day One Access for New Hires: How to Automate It
How to give a new hire day one access automatically: pre-provisioning, attribute-derived groups, and license and device readiness before the start date.
The Mover Process: Automating Access Recompute
Why the mover process is the hardest JML event, and how attribute-driven access recompute safely adds new access and removes old access with a grace period.
Joiner Mover Leaver Automation in Entra ID
Joiner mover leaver automation in Entra ID without enterprise IGA cost: how mid-market Microsoft shops keep access correct through every HR change.
Group mining: do not start your ABAC model from zero
Your tenant is full of groups someone once made by hand. Group mining reads those patterns and proposes which group belongs to which attribute, so you do not have to spend months figuring out where to start.
Joiner-Mover-Leaver with your HR system: standard or custom?
Automating JML from your HR system sounds like one button, but it sits at two levels. What ServiceChanger does as standard at the group and role level, and what creating and deleting accounts from HR is as custom work.
Scaling your service desk without hiring: when extra capacity makes sense
Sometimes you need extra service desk capacity, temporarily or for the long run, but a permanent hire does not fit. Here is how a remote service desk works as an extension of your own team, in your own ticket system and on your own processes.