Field guide
Identity lifecycle
Practical onboarding, access governance, and offboarding for lean IT teams that still need reliable controls.
Automating new-hire onboarding in a one-person IT shop
How I replaced a manual, error-prone new-hire checklist with a web form and a PowerShell provisioning script, plus the gotchas that made me keep a human in the loop.
The onboarding intake form that ended the email tag
The manager-facing form and 5-second approval gate that replaced my new-hire email threads: the fields, the validation that matters, and what it caught.
Microsoft 365 onboarding: licenses, mailbox timing, Teams
Directory sync runs every 30 minutes and a new mailbox is not instant. How I sequence sync, licensing, and mailbox checks so day-one access actually works.
HR-driven provisioning: hires and exits as data, not email
IT is always the last to know. How I wired hires and departures to the HR system with a 20-line export diff, and why the trigger beats any script.
Account provisioning in systems never built for you
The badge system, the time clock, the vendor portals: a 3-tier approach to account provisioning beyond AD, and why I only automate the top two systems.
Role-based access without an IGA platform
A 7-stage request, approval, mapping, enforcement, and reconciliation loop gave my small IT shop consistent role access without claiming full IGA coverage.
Designing an access matrix PowerShell can enforce
A useful PowerShell access matrix needs 8 required fields, stable role IDs, synthetic test fixtures, and preflight validation before directory changes.
Reconciling group membership without lockouts
Safe Active Directory reconciliation separates adds from removals, protects critical groups, previews every change, and requires exact approval before changes.
Automating offboarding in a one-person IT shop
Onboarding gets the attention. The account you forget to disable is the real risk. Here's my one-person-shop offboarding flow, and the 3 steps I keep manual.
Revoke access everywhere: the offboarding ghost hunt
Disabling the account is step one. Here are the 7 places a user's access hides, the inventory that finds them, and the stale-login report that catches misses.
When to delete a former employee's account (and how)
A disabled account should not sit forever. My 90-day grace period, the pre-delete checklist, and the retention questions to answer before anything is gone.