dataSMC
01Services

Identity & access

The right people. The right permissions. Nothing more.

Every system your business runs on starts with the same question: who is this, and what should they be able to do? We make sure the answer is right on the day someone joins, every day they work, and the day they leave — across email, finance, customer data and everything in between.

  1. HR recordJoiners, movers, leavers
  2. IdentityOne per person
  3. Email
  4. Finance
  5. Customer data
  6. Files
  7. Unknown requestRefused
One source decides who exists.The HR record creates, changes and ends each identity; every application follows it. A request nobody can vouch for is refused at the door.

01.1Without it

What usually goes wrong.

  • Accounts outlive the people.Leavers keep their logins until someone remembers to close them, and contractors outstay their projects.
  • Shared logins hide who did what.One account for a till, a team or a supplier means nobody can say who made a change, or undo it cleanly.
  • Permissions only ever grow.People change roles and collect access along the way. Nobody takes it back, because nobody knows what can safely go.

01.2What it covers

Four parts of one job.

  • Identity lifecycleJoiners, movers and leavers, driven by one source of truth.
  • Authentication & MFAStrong sign-in, fitted to the risk of each system and the people who use it.
  • Access policyRoles and rules that say who gets what, and why.
  • ProvisioningAccounts created, changed and removed automatically across your applications.

Works with what you already run

  • Microsoft Entra ID
  • Okta
  • Google Workspace
  • JumpCloud
  • Your HR system, as the source

Where it hands over

01.3How it runs

Four steps, then it keeps running.

Scoped and priced before it starts: a fixed fee for the first phase, then a monthly fee for what carries on. Stop after the first phase and you keep everything.

  1. 01Map who has whatEvery account in every system that matters, set against the people and roles that should own it.
  2. 02Make one record the sourceUsually the HR system: joiners, movers and leavers follow it automatically, everywhere.
  3. 03Strengthen the front doorMulti-factor sign-in where it counts, single sign-on where it helps, and no shared accounts left.
  4. 04Review, briefly and oftenA short, regular review of the systems that would hurt most, with a named owner for each.

After the first phaseTypically 4–8 weeks

  • A register of every account, with its owner and the reason it exists.
  • Joiners, movers and leavers driven from the HR record.
  • Multi-factor sign-in on every system that matters.
  • Shared accounts retired, or owned and logged.

Then, every month

  • A short access review each quarter, with the owner of each critical system.
  • New applications joined to the same sign-in and lifecycle.
  • Unusual sign-ins and permission changes looked into.

What we need from you

  • A contact in HR, and read access to the HR system.
  • Admin access to your identity platform and key applications.
  • An hour with the owner of each critical system.

01.4What you get

What is different afterwards.

  • Joiners productive on day one.The accounts a role needs are ready before the first morning, without a stream of tickets.
  • Leavers locked out the same hour.Access ends when the job does, in every system, without anyone having to remember.
  • Access you can explain.Ask who can see customer data and the answer takes minutes, with a reason beside every name.

01.5Where it matters most

Where it carries the most weight.

A case · FinanceEvery login verified. No adviser slowed down.Phishing-resistant sign-in, from managed devices only.A field note · 24 Sept 2026Your network trusts everything that’s plugged into it.4 min read

01.6Straight answers

What people ask about it.