Pro: IAM Processes, Change and Implementation
Baseline → Advanced → Pro
Pro is the top of three tiers. Baseline shows where you stand against recognised standards. Advanced fixes the low-friction gaps and assesses every feature in your license. Pro takes on what needs people to change: the high-friction controls and features, the joiner, mover and leaver process, and the training that makes the new way of working stick.
There is a ceiling on what configuration alone can achieve. You can tighten every policy in Entra ID and still have leavers with live accounts, because the leaver process runs through an email to a shared mailbox. You can enforce passwordless or phishing-resistant authentication on everything and still end up with workarounds, because nobody helped the people involved change how they work.
Pro is for companies that have hit that ceiling, or expect to. It is process work and people work, delivered by the same person who did the technical review, so nothing is lost in the hand-over between them.
What Pro adds to Advanced
- Everything in Advanced. The Baseline Entra ID review, the external access controls for Teams, SharePoint and OneDrive, the assessment of every feature in your license plan, the sequenced roadmap, and hands-on implementation of the low-friction controls.
- High-friction controls and features, chosen from the roadmap. The items that need many users or whole processes to change (see how Advanced defines low and high friction), such as MFA for all B2B guests, access reviews with named reviewers, privileged access approval and the features that replace manual work. They are picked from the Advanced roadmap at scope selection, agreed in writing, and priced from that list.
- One process, joiner, mover and leaver, across your core systems. Which systems are in scope is decided from the analysis: those that still need connecting come first, and systems that are already integrated are checked rather than rebuilt. Typically three to five. The list is agreed in writing before the work starts. Other systems get a documented manual step, and further systems are quoted separately.
- Your core IAM system landscape, mapped and documented. Which system is authoritative for what, how an identity travels between them, and where the chain breaks. You get a landscape map and a decisions log. I build only what the joiner, mover and leaver process needs.
- Training and change management for the new way of working. The people whose jobs change learn the new processes and features, and the changes to their roles are made explicit, so the new setup is used rather than worked around.
What you have at the end
- A landscape map and a decisions log for the systems in scope.
- Joiner, mover and leaver, built and tested. Each system on the agreed list is tested end to end with a test joiner, mover and leaver, and the test evidence is kept.
- A named owner for each process on your side, with the process documented.
- The agreed high-friction controls and features switched on and checked against the written list from scope selection.
- Training for the affected roles. The number of sessions is agreed at scope selection, plus a one-page quick guide per process.
Pro is done when every item on the agreed list is delivered and signed off in writing.
IAM core processes
An IAM core process is one of the handful of routines that decide who holds access in your company. Pro takes on one of them end to end: joiner, mover and leaver, including onboarding the systems that are not yet connected and the awkward populations: external guests, project members, and consultants who were supposed to leave two years ago. Other core processes can be part of the scope when they are chosen from the roadmap as high-friction items. The usual candidates:
- Access review and recertification. Turning an annual spreadsheet exercise nobody trusts into a control that produces its own evidence.
- Privileged access request and approval. Privilege tiering based on real criteria rather than job title, with just-in-time elevation instead of standing admin rights.
- Application onboarding. A decision path that lets a system owner answer their own authentication and authorisation questions, so security is not a queue.
The process is mapped as it runs today, agreed as it should run, and then built: the workflow, the approvals, the automation where automation is worth it, and the evidence trail underneath. The point of doing one process properly rather than several badly is that a finished process keeps working after I leave.
Your core IAM system landscape
Identity in a mid-market company is rarely in one place. Entra ID holds the cloud, an on-premises Active Directory holds what has not moved yet, the HR system believes it owns the truth about employees, and two or three business applications keep their own user lists because that was easier at the time.
Pro establishes which system is authoritative for what, how an identity travels between them, and where that chain breaks. You get a landscape map and a decisions log, with each decision written down with its cost and its consequence, so it can be defended later. Where a gap blocks the joiner, mover and leaver process for a system in scope, it gets the plumbing it needs: federation, provisioning, SCIM or conditional access. Gaps outside that scope are documented and left for a later project.
Training and change management
Changing a process changes jobs. When a leaver is handled by a workflow instead of an email, when approvals move into a new tool, or when a new feature replaces a manual step, the people involved need to know what is different, why, and what is now expected of them. Most failed changes are not technical failures: the control is switched on, and people work around it.
Training in Pro is therefore change management. The new processes and features are walked through with the people who use them, the changes to their roles and responsibilities are made explicit, and the hand-over leaves a named owner for each process. It is built on your own review findings and your own systems, not on a generic slide deck. Broad security awareness for all staff is not the focus.
Gain a competitive advantage
IT security can be so much more than a cost. The initiatives in Pro can be used in marketing and positioning, it can be part of a business optimization process where lead-time, automation degree and obviously security posture is improved. Moreover, it can show up outside the IT department: in a customer security questionnaire, in an insurance renewal, in a tender you would otherwise not qualify for. Here are some of the advantages:
- Change management and training. People who understand the new processes and features use them, which cuts workarounds, errors and support requests, and shows customers and partners a controlled way of working.
- Automated identity and access management. Automated provisioning, deprovisioning and access management streamlines onboarding and offboarding for employees, contractors and partners, and removes the manual step where mistakes happen.
- Evidence you can show. Documented processes with named owners, a decisions log and test evidence for the leaver process answer the identity and access questions in a customer security questionnaire, an insurance renewal or a tender.
How the engagement runs
1. Initial scope alignment. A 30-minute conversation, no charge and no obligation: introductions and your overall requirement.
2. Kickoff meeting. We go through what is actually in scope and what is not, and from there start scoping the engagement itself.
3. Baseline and Advanced come first, even where you think they are already optimal. Process design and change management need a foundation I have verified myself to ensure a high quality outcome. If I ran a Baseline or Advanced for you in the last 12 months, that work is credited: I check what has changed since, and you do not pay for it twice.
4. Scope selection. Together we decide what is in scope: which systems, and which high-friction controls and features from the Advanced roadmap. Systems that still need connecting come first, and systems that are already integrated are checked rather than rebuilt. Both lists are agreed in writing, and the price follows from them. This is a decision made on the review findings, ideally not on a preference.
5. Current state, desired state, roadmap. A workshop with the people who actually run the process today, not only the people who own it on paper. The output is a mapped current state, an agreed desired state, and the sequence between them with cost and benefit attached, so a CEO can approve it.
6. Build and implement. The workflows, approvals, automation and integrations that the desired state needs, and the high-friction controls and features agreed in scope, built in your systems and tested with your people.
7. Training, change management and hand-over. The people whose jobs changed are walked through the new processes and features, and their changed roles and responsibilities are made explicit. The hand-over leaves each process documented and owned by a named person on your side.
When, and what this is not
Pro is a project with an end, not a retainer. It typically takes one to three months, depending on how many systems are in scope, how many of them still need connecting and how many high-friction items are chosen. The duration is agreed after the scope conversation. Baseline and Advanced are part of Pro, and any earlier work of mine is credited. It is the longest of the three tiers by a wide margin, and the only one where the calendar depends as much on your organisation’s availability as on mine.
What Pro needs from you. A named owner on your side who can make decisions. Time with the people who run today’s process and the owners of each system in scope. The access I need to those systems to build and test. Pro cannot start without them, and delays on your side move the calendar.
Pro is not a managed service and not an outsourced security function. The aim is the opposite: to leave behind processes your own people run, and a documented reason for every design decision, so the work survives my departure.
Not included, in Pro or any other tier:
- License purchases and third-party fees. I tell you which license unlocks a control and what it would cost. Buying it, and any vendor fees, is yours.
- Changes inside other vendors’ applications. If an application lacks the support a connection needs, that is for its vendor. I document it and the system gets a manual step.
- Certification or audit attestation. The work maps to recognised standards but does not certify you against them.
- Work that needs its own project team. For example replacing the HR system or redesigning the network.
- Systems outside the agreed list. They get a documented manual step, or are quoted separately.
- High-friction items not agreed at scope selection. They are not added along the way without a new written agreement.
Frequently asked questions
A rough test: if your problem is that controls are switched off, Advanced fixes it. If your problem is that controls keep drifting back off, or that access is granted correctly and then never removed, the cause is a process and Advanced will not hold. That is what the scope conversation is for, and I would rather sell you Advanced that works than Pro that you did not need.
No. Pro does not sell generic awareness courses. The training is change management for the processes and features that were changed: it walks the people who use them through what is different, what is now expected of them in their changed roles, and where to go when something does not work. If you already have an e-learning platform, it keeps covering the annual baseline.
Often more relevant, not less. A platform that was bought and half-configured is a common finding, and it means the license is already paid for. I have worked with Omada, Saviynt, ServiceNow and Microsoft Entra ID Governance, including comparing them against each other on security controls and license cost before a client committed.
That is the design constraint, not an afterthought. Every process is handed over documented and owned by a named person on your side, and anything automated is built in your own systems and repositories rather than mine. Where the work involves code or configuration as code, you keep it. A consultant who leaves behind something only they can operate has failed the engagement.
It depends on how many systems are in scope, how many of them still need connecting, and which high-friction controls and features are chosen from the roadmap. The 30-minute scope alignment is not enough time for a number: it tells me what scope to expect and what to ask next. After the kickoff meeting, or a short questionnaire filled out in advance, I quote a fixed lump sum, or we agree a time and material contract when the scope does not fit a lump sum. Baseline and Advanced are included in the quote, and any earlier work of mine is credited. The system list and the chosen roadmap items are agreed in writing before the work starts.
Book a 30-minute conversation
Thirty minutes, no charge, no obligation. If Pro is more than you need, I will say which tier is the right one.