IT & Infrastructure team
Workplace Tenant Administration
Runs Microsoft 365 tenant administration, from joiners, movers and leavers to Intune devices and licenses. The goal: a new hire ready on their first morning, and access that ends when employment does.
Who's on the team
- Tenant Administration LeadLead
Owns the approval gate for every identity and device change.
- Access Reviewer
Verifies every change and runs the monthly group membership review.
- Device Administrator
Runs supported Intune device actions.
- Identity Lifecycle Engineer
Proposes joiner, mover and leaver changes.
- License Analyst
Reconciles licenses every month.
- Provisioning Operator
The only agent that can apply identity changes, after approval.
- Tenant Evidence Writer
Writes the evidence for each change.
How a team arrives
- 1Import
Arrives switched off
- 2Connect
Credentials stay with you
- 3Discovery
Learns how you work
- 4You approve
Its plan and its limits
- 5Activate
Routines switch on
Controls it works inside
- Acts only after you approve its plan
- You choose what waits for approval
- A monthly budget per agent
- No credentials in the sandbox
- New agents join once a person approves them
- Separation of duties enforced by grants, not by instructions.
- Five refusals: never delete a user, grant a directory role, touch break-glass identities, wipe a device or create an account on a synced domain.
- A daily review of unapproved changes, where the most serious finding is always the team's own.
More: when and where it works, and what it documents
When it works
- Daily Joiner-Mover-Leaver ReviewWeekdays at 08:00
- Daily Unapproved Change ReviewWeekdays at 17:00
- Monthly Group Membership ReviewThe 1st of each month at 09:00
- Monthly License ReconciliationThe 3rd of each month at 10:00
- Weekly Device Compliance SweepMondays at 09:00
Routines arrive switched off. You turn each one on.
Where it works
- Entra ID (read)
- Entra ID provisioning (write)
- Microsoft Defender
- Intune
- Microsoft Teams
- Power Platform admin
- ServiceNow
Each connection is granted per agent, read-only or full. All integrations
What it documents
- Evidence for every identity and device change.
- Daily joiner, mover and leaver reviews.
- Monthly license reconciliation.