An employee left a week ago — their accounts in email, 1C, Wi-Fi and AD are still active
Centralize in AD/Entra ID, roll out an offboarding process: one checklist disables all access.
Identity and access
Active Directory and identity management
Active Directory, Entra ID, GPO, MFA, SSO, Conditional Access. One login, access control, instant revocation at offboarding.
When clients come to us
Three common scenarios and how we solve them.
Every system has its own login — users write them on sticky notes
SSO via Entra ID / ADFS / Keycloak for key business systems plus a password manager for the rest.
Admin access for 5 people, nobody knows who last touched GPO
PAM (Privileged Access Management): action logs, just-in-time access, mandatory MFA for privileged operations.
What is included
Clear boundaries: what is covered by the retainer and what is a separate project.
Included in the service
- Design and deployment of Active Directory DS (multi-site, OUs, replication)
- Entra ID (Azure AD), hybrid with AD Connect, conditional access
- Group Policy (GPO): workstation settings, logon scripts, security policies
- SSO into corporate applications: SAML, OIDC, OAuth, Kerberos
- Certificate management: ADCS, internal CA, S/MIME for email
- PowerShell automation: mass onboarding, offboarding, password rotation
- Restructuring a "legacy" AD into a clean hierarchy
Not included / separate project
- Building a custom IDaaS platform from scratch — we use proven ones (Entra ID, Keycloak, ADFS)
- Custom SSO adapters for exotic software without SAML/OIDC
- Mass smart-card issuance as a standalone project with physical logistics
What is actually included in the contract
When we sign — both sides know exactly what you pay for and what you get. These are the four planes the SLA is built on.
Coverage hours
- Business hours: Mon–Fri 08:00–20:00, L1 with guaranteed response
- On-call evenings and weekends on request
- 24/7 for critical services: mail, 1C, UNA, POS, website, VPN
- Scheduled night windows for planned work without downtime
Contact channels
- Single ticket portal with history and SLA timers
- Hotline phone for P1 incidents
- Email and Telegram bot for routine tasks
- User chat with our on-duty engineer during business hours
Priorities and response
- P1 (critical, service is down): response in 15 minutes, 24/7
- P2 (severe impact): response within 1 hour in business hours
- P3 (single-user issue): response within 4 hours
- P4 (planned work, improvement): scheduled for the coming week
Contract scope of work
- Planned maintenance: updates, backups, monitoring, patch management
- Incident management: diagnostics, recovery, postmortems
- Small projects within the retainer: up to N hours per month
- Large projects (migrations, new equipment) — separately scoped
Technologies and tools
What we work with in this area.
Active Directory DS
Entra ID (Azure AD)
AD Connect
ADCS
GPO
PowerShell
SAML / OIDC
Kerberos
Okta (when needed)
How we onboard a new client
1
Kickoff and brief
30–60 minutes online or in the office: we discuss the business, the key systems, and the incidents that hurt last year. We sign an NDA.
2
Technical audit and risk map
1–2 weeks. Equipment inventory, checks on servers, network, backups, security, 1C/UNA, licensing. The outcome is a report with a risk map and priorities.
3
Work plan and contract
We build the plan: what gets fixed right away (P1 risks), what in the first month, what in the first quarter. We lock the SLA, hours, channels, price. We sign the contract.
4
Onboarding and infrastructure handover
We take over the access via a secure password manager, deploy our monitoring, plug in the ticket system, train the employees. The previous admin (if any) hands off by the playbook.
5
Ongoing operations and reporting
Monthly report: incidents, planned work, new risks, recommendations. Quarterly review with the CEO/CFO: strategy, budgets, major changes.
Cleaning up AD for a growing company: from 50 to 300 employees
Commercial and logistics group, Moldova
Задача
AD grew chaotically, OU structure disorganized, duplicate GPOs, leavers active for 6 months, 12 admin accounts.
Решение
Reorganized OU, cleaned GPOs, configured Entra Connect for Microsoft 365 sync, deployed MFA and Conditional Access, automated onboarding/offboarding with scripts.
- 30 minutes (was 1 day)New-hire onboarding
- 3 (was 12)Admin accounts
- 0Employees with stale access
Frequently asked questions about this service
We're on a workgroup without AD — is it worth switching?
Usually makes sense from 10-15 users up. AD / Entra ID gives a single control point and security. Without AD, the team inevitably loses access control.
On-prem AD or Entra ID in the cloud?
Often both. Entra ID for cloud services (M365, SaaS), on-prem AD for file servers, 1C, local infrastructure. Entra Connect syncs them.
Can we roll out MFA gradually without shocking users?
Yes. First admins and leadership, then wave by wave per department. With Microsoft Authenticator and SMS — users adapt within a week.
What happens to AD if we move to the cloud and the server room closes?
We move AD to Azure (VM with DC) or fully to Entra ID (for pure-cloud scenarios). Migration is planned while preserving access to local resources.
Let us talk about your IT
The first meeting — 30 minutes, free, no strings attached. We will tell you whether we are the right fit and what is worth doing first.