Manage
Joiners and leavers
A new colleague starts with the access their role needs, a leaver loses it on their last day, and a tested script does both the same way every time, so nothing is forgotten.
Access on day one. Gone on the last day.
Every joiner means an account, groups, a mailbox, the project or matter folders, the business apps, a laptop and the printers. Done by hand from a checklist, it takes hours and something gets missed; done by hand at the end, a leaver’s access quietly stays. We put the firm’s roles in order first, so a new colleague gets the same access as a colleague in the same role, and then script the set-up end to end. The script shows what it would change before it changes anything. A leaver is the same list run backwards: sign-in blocked, access withdrawn, the mailbox and files handed to whoever takes over, the laptop wiped, on the day you name.
What we set up
Roles first, then the script.
Nothing is scripted before the roles make sense: a script only repeats what it finds, so the permissions are cleaned up first.
-
A role model that holds
Before anything is automated, we tidy the permissions and define who in which role may open what. A new colleague then gets the same access as a colleague in the same role, no more.
-
One request, the whole set-up
Your office tells us who starts when, in which role. From that one request the script creates the account, the groups, the mailbox, the folders and the apps, and the laptop is built from your baseline for that role.
-
The script shows before it changes
It runs as a report first and lists every change it would make. Only then does it make them, and it reports back what it did, so a failed step can’t be reported as done.
-
The laptop and the printers too
The device is set up by the same scripts as every other one in your firm, with the software and printers the role needs, so the new colleague sits down at a machine that works.
-
Leavers on the day you name
Sign-in blocked, access withdrawn, licences released, the mailbox and files handed to the person you name, the device wiped. The same list, run backwards, on the last day, not the week after.
-
Moves between teams
A colleague changing role gets the new role’s access and loses the old one, the same way, so access from a previous job doesn’t pile up.
On record
In your documentation and the monthly report.
- Every joiner and leaver, with the date and what was set up or withdrawn
- The role model: which role opens what
- Each script run and what it changed, as the script reported it
- Licences released when someone left
The same record answers the access review: who has what, and since when.
What usually goes wrong by hand.
-
The checklist with one line missed
Click after click per project folder, several admin centres, a Wi-Fi password on a sticky note. Something is always forgotten, and the new colleague finds out on day one.
-
The leaver who can still sign in
Access withdrawn when someone gets round to it, weeks later. A former colleague’s login that nobody switched off is one of the ways attackers walk in.
-
Copy from the last person
“Give her the same as him” copies whatever he had collected over the years, including rights nobody meant to give. Without a role model, access only ever grows.
Also under Manage
- Service desk Every request lands with an engineer who can fix it, and stays with them until it’s fixed.
- Devices and workstations Every laptop and workstation built the same way, kept current and watched centrally.
- Microsoft 365 Accounts, licences, Teams, SharePoint and Entra ID, administered in your own tenant.
- Printers and plotters Office printers and large-format plotters deployed straight to the devices that need them.
- Licences and vendors Microsoft licences sized to your people, and one call for every vendor your IT depends on.
- The first 30 days Access secured, what we find documented, every system on the monitoring, then a welcome review.
Questions we get
How long does it take to set up a new colleague?
At a 120-person firm we look after, setting up a new colleague took 4.5 hours of IT time. We cleaned up the permissions and the role model, then scripted the set-up: now it takes 7 minutes from the ticket. That is a fact about one firm, not a promise, and it depends on the roles being in order first.
What do we have to tell you for a joiner?
Who starts, when, in which role and which team, and who their manager is. Everything else follows from the role model. If the role doesn’t exist yet, we define it with you first.
What happens to a leaver’s mailbox and files?
They’re handed to the person you name, for as long as you need, and kept as long as your retention rules require. Nothing is deleted on the last day; access is.
Can the script get it wrong?
It can only do what it’s told, which is why it reports first and changes second. At one firm, its first live run showed that it would have reported a failed change as done. That was fixed before it ran again.
Start
Who starts at your firm next month, and who left last month?
In a first call we go through how joiners and leavers are handled today, who still has access they shouldn’t, and what a role model and a script would change.
- No first level
- No surprises
- Pilot before you buy