Blog
Articles
Insights on Entra ID, ABAC, license management, and IT service desk automation.
Entra Group Naming Convention: A Structure That Scales
A good Entra group naming convention lets people and automation reason about access at a glance. Learn the structure, prefixes, and rules that hold up.
Dormant Groups in Entra ID: Find and Retire Them Safely
Dormant groups Entra ID: how to find empty, unused, and forgotten groups cluttering your directory, and retire them safely without breaking access.
Group Sprawl Cleanup in Entra ID: A Safe Playbook
A practical, staged plan for group sprawl cleanup in Entra ID: how it happens, how to find the mess safely, and how to keep it from coming back.
Role Explosion: Why Static RBAC Breaks Past 200 Employees
Role explosion access control hits most companies between 200 and 300 employees. Learn why static roles multiply out of control and how attributes fix it.
EA Renewal License True-Up: A Practical Checklist
Prepare for your EA renewal license true-up with real usage data so you don't lock in three years of unused Microsoft 365 seats.
The True Cost of a Forgotten License
The cost of unused licenses compounds fast. See how one forgotten E5 seat becomes a real annual budget line, and how to catch it early.
A First Day Without Waiting: What Breaks Between HR and IT
Why new hires sit waiting for access on day one. The real problem is the handoff between HR and IT, not the technology. How to close that gap for good.
Quarterly License Review: A Lightweight Cadence
A quarterly license review beats a panic audit at renewal. Learn how to build a lightweight, repeatable cadence for Microsoft 365 license spend.
License Follows Role: Automating Entitlements
Learn how to make license follows role a working policy, so Microsoft 365 entitlements track a person's actual role as they join, move, and leave.
Maintaining Automated Access Management in Entra ID After Go-Live
Turning on attribute-driven access is one thing, keeping it correct for years is another. How to maintain an automated access model so it does not drift over time.
E5 to E3 Downgrade: Rightsizing Microsoft Licenses
An E5 to E3 downgrade can cut Microsoft 365 license cost sharply. Learn how to find over-licensed users and rightsize with real usage data.
Microsoft 365 price increase 2026: what to do now
The Microsoft 365 price increase 2026 makes every unused seat more expensive. Here is a practical plan to clean up before your renewal lands.
Password Resets and Account Status: The Hidden Time Sink
Password resets and account status tickets quietly drain service desk time. Where the volume comes from, what to fix at the source, and what to keep manual.
Orphaned Accounts: A Top Offboarding Risk
Orphaned accounts and standing access are a leading breach vector. Learn why offboarding leaves accounts behind and how automated leaver flows close the gap.
Leaver Access Cutoff: Revoke Refresh Tokens Fast
Disabling a leaver's account isn't enough. Learn why revoking refresh tokens and sessions on the last working day is essential for a real access cutoff.
Pre-Provisioning New Hires: Scheduling Joiner Actions
How to pre-provision new hires by scheduling joiner actions ahead of the start date, so accounts, access, licenses, and devices are ready in advance.
Day One Access for New Hires: How to Automate It
How to give a new hire day one access automatically: pre-provisioning, attribute-derived groups, and license and device readiness before the start date.
The Mover Process: Automating Access Recompute
Why the mover process is the hardest JML event, and how attribute-driven access recompute safely adds new access and removes old access with a grace period.
Joiner Mover Leaver Automation in Entra ID
Joiner mover leaver automation in Entra ID without enterprise IGA cost: how mid-market Microsoft shops keep access correct through every HR change.
Group mining: do not start your ABAC model from zero
Your tenant is full of groups someone once made by hand. Group mining reads those patterns and proposes which group belongs to which attribute, so you do not have to spend months figuring out where to start.
Joiner-Mover-Leaver with your HR system: standard or custom?
Automating JML from your HR system sounds like one button, but it sits at two levels. What ServiceChanger does as standard at the group and role level, and what creating and deleting accounts from HR is as custom work.
Scaling your service desk without hiring: when extra capacity makes sense
Sometimes you need extra service desk capacity, temporarily or for the long run, but a permanent hire does not fit. Here is how a remote service desk works as an extension of your own team, in your own ticket system and on your own processes.
ITSM maturity assessment: where does your service desk stand?
A practical maturity model for your service desk, from reactive to rule-driven. Find out where you stand, recognize the next level, and see how to move up a step.
Zero-Touch Apple Deployment with Intune & DEP
With Apple Automated Device Enrollment and Microsoft Intune, a Mac or iPhone gets itself ready out of the box. Here is how zero-touch onboarding works in a Microsoft environment.
Dynamic groups, an IGA platform, or ServiceChanger: when to choose what
You can manage access in Microsoft with native Entra dynamic groups, a full IGA platform, or a rules layer like ServiceChanger. Here are the three approaches, their limits, and when each fits.
ITIL request fulfilment without the ticket: a Microsoft approach
In ITIL, request fulfilment handles standard service requests. Many of those are about access. Here is how to map request fulfilment to attribute-driven assignment in Entra ID.
Scale your service desk without growing headcount
Ticket volume grows faster than budget. Here is how to absorb the growth by automating repetitive identity and license work, instead of adding a pair of hands every time.
Shift-left on the service desk: what to automate first
Shift-left means moving work to the earliest, cheapest point in the chain. Here is how to apply that to a Microsoft service desk: move repeatable access and license work to self-service and rules.
Reclaim unused Microsoft 365 licenses with Entra sign-in activity
Assigned licenses tell you nothing about usage. The real sign-in activity in Entra ID shows you licenses nobody uses. Here is how to build a 90-day policy and a business case around it.
Access governance and the audit trail as evidence for NIS2 and ISO 27001
How attribute-driven access governance produces reproducible least privilege and a who-had-what-when audit trail that auditors can use as evidence for NIS2 and ISO 27001. Evidence, not certification.
Find inactive users in Entra by last sign-in (and what it saves)
The signInActivity field in Entra ID lets you find accounts that have not signed in for months. Here is how the query works, what to watch for (P1, 24-hour delay), and what it saves in licenses.
Entra ID vs Active Directory in 2026
Active Directory still runs in many places while Entra ID is becoming the standard. The state of play in 2026: what to do with your AD, when to move, what to keep hybrid.
RBAC vs ABAC: when to pick which
RBAC is simple and works up to a certain size. ABAC scales better but needs more setup. This is the practical decision point: when do you move from RBAC to ABAC?
Automate the service desk: stop handling access requests by hand
Access requests are a large share of service desk work and almost all of it is manual. Here is how to automate group membership in the Microsoft environment with rules, instead of per ticket.
Self-service access portals: the business case
A self-service access portal cuts tickets, lead time, and manager frustration. Real numbers and what you need to have in place for it to work.
IT offboarding checklist: what you can automate
The 15 steps of a complete IT offboarding in Microsoft Entra ID. Which you should automate, which you keep manual, and why the order matters.