Nobody knows who has access to what.
Group memberships have grown over the years and are nested up to four levels deep. On top of that, the file server has individual permissions that were never documented.
Clear permissions, properly documented
Who may access what?And can you prove it?
In most environments that have grown over the years, nobody can fully answer this question. That is rarely due to poor work. Over time, staff changes, projects and exceptions leave behind permissions that nobody ever removed. We clean this up, vendor-independent and traceable, and document it so you can present it to an auditor.
What it typically looks like
Former employees still have access.
The AD account has been disabled, but access to the industry software, the supplier portal and the shared mailbox is still there.
Onboarding takes days and is different every time.
Nobody has written down what a sales employee actually needs. So a colleague's rights are copied, including everything they have accumulated over the years.
Recertification doesn't happen.
Or it happens once a year using an Excel list with 400 rows of cryptic group names that department heads sign off without reading.
MFA is in place, but it has gaps.
There are exceptions for “management”, for legacy applications and for field staff. Each of these exceptions is an open door.
The auditor asks, and things get hectic.
NIS2, ISO 27001, TISAX and GxP require documented access control. But you can only prove what has been recorded in a structured way.
Four building blocks
Permission analysis
We record the current state: who has access where, by which route, since when and approved by whom. You receive a report that ranks the risks by urgency, not an Excel sheet with 8,000 rows.
Permission concept
We work with roles instead of individual cases. We define which function in the company needs which access and map this technically. Everything else builds on this concept, because automating without a concept only automates the mess.
Entra ID, Conditional Access, Intune
Instead of blanket approval, Conditional Access decides based on the person, location, device and risk assessment. We harden the Microsoft platform and close the exceptions that allow MFA to be bypassed.
Processes and tooling
We turn joiners and leavers into a defined process, set up a recertification that business departments can actually carry out and, where it pays off, introduce an IAM tool for automation. We know the common solutions on the market and choose based on your environment. Partner commissions play no part in this.
How a project works
- 01
Intro call (20 minutes)
We listen and tell you openly whether we are a good fit for you.
- 02
Assessment
We take stock of the current setup and deliver a written report with prioritised measures. The assessment has a fixed price that is credited towards the follow-up project.
- 03
Concept
We develop the role model, the target state and an implementation plan with an effort estimate.
- 04
Implementation
We implement in stages, coordinated with the business department and documented as we go.
- 05
Handover
The documentation belongs to you, so you could replace us with another provider at any time.
We mean that last point: we deliberately build things so that you are not dependent on us. A provider that has to rely on dependency doesn't have a good offering.
What it costs
| Hourly rate Identity & Access Management | €140 / h |
| Consulting and project management | €165 / h |
| Security Assessment (permission analysis, Entra configuration, NIS2 gap analysis) | from €6,900 |
Typical project size: a permissions project for 100 to 250 users costs around €15,000, including the review, concept and implementation.
The biggest factor is the state of your documentation: where it is clear who may do what and why, the review goes quickly. It also matters how many systems are connected and whether a tool is needed in the end. After the assessment, the price is fixed, and we credit the cost of the assessment.
The price depends mainly on the number of systems and business departments, the state of the documentation and whether a tool is introduced. The cost of the assessment is credited towards a follow-up project.
Why us
We bring ten years of project management in the pharmaceutical industry, at automotive suppliers, in manufacturing and in banking. This includes permission projects, changes of IT provider, the introduction and replacement of tools, and restructuring.
Logistics, international · 10,000+ users
Replacement of the existing IAM setup and introduction of a new solution together with a contracted service provider. We advised, managed the project, implemented and set up the processes between the end client and the provider.
Result: The help desk works faster because the service staff were given extended permissions. In addition, identity processes were automated and the HR master data was cleaned up as the data basis.
Industrial supplier, international · 2,000 users
Introduction of an IAM solution at an internationally active, family-owned industrial supplier. This included reorganising the file shares and a password reset that users can carry out themselves.
Result: Support has been relieved: users reset their own passwords, and password tickets have dropped from almost 300 to 10 per week.
In many German federal states, consulting projects of this kind fall into the funded categories, typically with 50% of the consulting fee. Our project steps match what the programmes fund: current-state analysis, target concept, software selection and support during implementation.
The order is what matters: first get the quote, then submit the application, wait for the approval notice and only then commission the work. Anyone who starts earlier loses the entitlement. In practice, this is the most common and most expensive mistake.
More on funded IT consultingFAQ
Frequently asked questions
Do you work with a specific IAM tool?
No. We know the common solutions on the market and choose based on your environment. We are not tied to any vendor and receive no commissions. Often you don't need a tool at first, but a concept.
Do we need an IAM tool at all?
Rarely below about 150 users. Up to that size, you can achieve a great deal with Entra ID, clean groups and defined processes. A tool only automates what is already in order. It does not create order by itself.
How long does a permissions project take?
The assessment takes two to three weeks including the report, and the concept four to eight weeks depending on size. Implementation runs in stages over several months so that operations can continue.
We already have MFA. Isn't that enough?
No, because MFA protects the sign-in and does not govern permissions. If an account has too many rights, MFA doesn't change that. It only secures access to those overly broad rights better.
What does this have to do with NIS2?
NIS2 requires access control that you can prove. Without a documented role model and traceable assignment, that proof is not possible. This makes permission management a compliance issue.
Do you also take over operations afterwards?
Yes, if you want us to. But it is not a requirement, because we build things so that your internal IT can carry on by itself.
Identity & Access Management
Let's talk about your permissions
Describe your situation to us in 20 minutes. We tell you openly whether and how we can help, and also if we are not the right people for it.