Your identities sit across Microsoft Entra ID, on-premises Active Directory and stand-alone systems, some in the cloud and some not. There is probably shadow IT on top. When an auditor, a client or your own board asks who has access to what, the answer currently lives in six spreadsheets and one person’s head.

That is the problem I work on: making access grant and revoke itself, and making it provable when someone asks.

What you end up with

One authoritative view of who has access to what, and access that grants and revokes itself.

• The manual admin burden goes away. Joiners, movers and leavers are handled by the system instead of by e-mail and goodwill.
• Onboarding and offboarding get faster. The request, the approval and the provisioning become one flow instead of three handovers.
• License spend becomes defensible. A role-to-system access matrix shows what each role actually needs, which is also what you actually have to pay for.
• Least privilege becomes provable. When someone asks you to demonstrate it, the answer is a report rather than a week of spreadsheet work.

Why this is worth doing now

The perimeter is gone. A firewall and antivirus used to be the boundary. The workforce is mobile, the services are cloud, and the devices multiply. Identity is what is left to control, and it is the one control that spans on-premises and cloud at the same time.

Regulators ask for evidence, not intent. GDPR, NIS2, DORA and PCI DSS all expect you to show who had access to what, when, and on whose approval. Access reviews, audit logs and least privilege are how that question gets answered without a fire drill.

Not every identity is a person any more. Service principals, managed identities, API integrations and AI agents all hold permissions, and they rarely appear in the offboarding process. An AI assistant inherits exactly what its user could already reach, which makes an untidy access model suddenly searchable.

It pays for itself in the daily work. Single sign-on, self-service password reset and automated provisioning cut support tickets and waiting time. The secure path and the fast path should be the same path.

Services on the IAM track

Most engagements start with an IAM workshop that produces a vision and a roadmap. From there I design the target system landscape and its governance, run a gap analysis against where you are today, and turn the difference into a prioritised portfolio of initiatives with cost, benefit and a time plan. You are equally welcome to cherry-pick: each of the five areas below stands on its own. If you want a fast baseline first, start with an Entra ID security review.

1. Strategy, architecture and roadmap

• Facilitate IAM vision workshops and align the technical goals with the organisational ones.
• Map the IAM system landscape and governance as it is today, then design the target state.
• Turn the gap into a prioritised initiative portfolio with business cases, cost-benefit assessments and an implementation roadmap.
• Run vendor selection for IGA and PAM tooling: requirements, screening, evaluation criteria, demos and a recommendation you can defend.

2. The identity lifecycle: joiner, mover, leaver

• Design and automate the full lifecycle for employees, guests, service principals, managed identities, AI agents and devices.
• Drive it from the authoritative sources you already have, such as HR, ERP and ticketing, rather than from a parallel spreadsheet.
• Give users self-service and a seamless sign-in, so the secure route is also the quick one.
• Automate inside Microsoft Entra ID, or inside the IGA platform you already run.

3. Privileged access: PIM and PAM

• Tier privileged roles across Active Directory and Entra ID, so an administrator account is scoped to what it actually administers.
• Replace standing admin rights with time-bound, approved elevation, including four-eyes approval where the risk warrants it.
• Build a PAM strategy on an access matrix mapping roles to systems and privilege levels, and derive the security controls, segregation-of-duties requirements and license estimates from it.
• Monitor, alert on and report privileged use, so misuse is visible rather than inferred.

4. Access reviews, governance and audit evidence

• Design and implement recurring access reviews for employees, guests and resources, triggered automatically instead of chased by e-mail.
• Put role-based access control and entitlement management in place in a form a system owner can actually operate.
• Prepare control attestations documenting how each control is designed and whether it is operating.
• Maintain end-to-end traceability from an audit finding to the implemented control, which is the evidence trail an auditor asks for and most organisations cannot produce.

5. Application onboarding and federation

• Onboard applications to Entra ID single sign-on, including user provisioning rather than sign-on alone.
• Federate with SAML, OpenID Connect, OAuth 2.0 and SCIM, including just-in-time provisioning and B2B collaboration with an external identity provider.
• Set Conditional Access, MFA, passwordless sign-in and self-service password reset to match the risk rather than the default.

Worth a conversation?

Thirty minutes, no charge and no obligation. Tell me where your access model hurts and I will tell you what I would look at first. If it is not worth doing, I will say so.

No pitch. No pressure. Just a conversation. Or send a message instead.