Challenges
Joiners, movers and leavers at volume
With a couple of hundred staff, someone starts, moves or leaves most weeks. Each change touches accounts, licences, devices, phones and passwords, and a leaver who can still sign in is the commonest gap in a business.
The challenge
HR tells you on Thursday that three people start on Monday, two are moving team and one left last week. Each needs a Microsoft 365 account and licence, a laptop, a phone and the right shared logins, or all of that taken away. At 200 staff this happens every week, the requests arrive by email, and nobody is quite sure last month's leaver can no longer sign in.
If it is left
Joiners spend their first week without the tools and form a view of the business; movers keep the access of the job they left; and leavers keep the access of the job they still have, which is the gap an attacker and an aggrieved ex-employee both look for. The licences nobody removed are paid for every month, the shared password the leaver knew is still in use, and the company data on their personal phone went with them. None of it is anyone's job until it is a problem.
What good looks like
One route for every change, from HR to the service desk, with a date. A joiner's account, licence, laptop, phone and password-manager access ready before day one. A mover's access changed to match the new role, nothing more. A leaver's access removed centrally the day they go, shared logins kept in the team vault, company data wiped from their devices, and their licence reclaimed. A monthly report that shows it happened.
What to do first
Before you call anyone
Make HR the trigger
Every joiner, mover and leaver goes from HR to one IT inbox or ticket, with the start or end date, the role and the manager. The same day for leavers. This one change closes most of the gaps before any technology does.
Run a leaver check now
Compare the Microsoft 365 user list with the payroll. Every account that belongs to someone no longer employed is disabled today and its licence reclaimed.
List the shared logins
The accounts package, the supplier portals, the social media, the courier account. Whoever has left still knows them. They need to go into a password manager with named access, and be changed.
Define a standard build per role
What a warehouse joiner gets and what a sales joiner gets: licence, laptop, phone, apps, shared vaults. Written once, it turns every joiner into a routine ticket.
Decide the personal-phone rule
If staff read work email on their own phones, those phones need enrolling so the company data can be wiped when they leave. If you will not enrol them, they should not have the email.
What we would do first
-
Send every change to one place
Joiners, movers and leavers go to our service desk, your users' first point of call, so each change is handled by our own team.
-
Set joiners up properly
A Microsoft 365 account with the right licence, a laptop brought under management and protected, a phone and SIM set up and enrolled, and password manager access.
-
Change access when people move
Licences, shared vaults and device policies changed to match the new role, so people have what they need and nothing they no longer use.
-
Close leavers off
Password manager access removed centrally with shared logins kept in the team vault, licences reviewed, and company data on phones locked or wiped remotely.
How we approach it
-
Agree the process and the standards
The HR-to-service-desk route, the dates and notice we need, and a standard build per role: Microsoft 365 licence, laptop image, phone, apps, Intune policies, Keeper vaults.
-
Clear the backlog
A reconciliation of Microsoft 365 against payroll, disabled accounts reclaimed, shared logins moved into Keeper team vaults with named access, and unmanaged phones enrolled or cut off from company data.
-
Joiners
Account and licence created, the laptop built to the role's image and enrolled in Intune with Defender and Huntress protection, the phone and SIM set up and enrolled, Keeper access granted, all before the start date, with a welcome note telling them who to ring.
-
Movers
Licences, group memberships, shared vaults and device policies changed to the new role on the date, so they have what the new job needs and nothing the old one did.
-
Leavers
On the day: the Microsoft 365 account disabled and sessions signed out, Keeper access removed with the team's shared passwords kept, company data wiped from phones and laptops, the mailbox and files handed to the manager, and the licence reclaimed at the next review.
The services that apply
-
Complete Managed IT
The service desk is where every joiner, mover and leaver request lands, and the managed service is what builds the laptop and keeps it current afterwards.
-
Microsoft and Azure
Accounts, licences and group memberships are created, changed and reclaimed here, and the leaver reconciliation against payroll is a licence review.
-
Mobile device management
A joiner's phone enrolled before day one and a leaver's company data wiped the day they go, whether the phone is company-owned or personal.
-
Password management
Shared logins in team vaults with named access, so a leaver loses the vault and the password stays with the business without being re-sent to everyone.
-
Mobile phones and SIM cards
The handset and SIM for a joiner, and the number kept with the business and reassigned when they leave.
-
Endpoint and identity protection
Every new device protected from day one, and the identity monitoring that notices if a disabled account is used anyway.
How you would buy it
Every hour we work falls under one of four engagement models. These are the ones that fit this situation; How we work compares all four.
-
02
Fixed price
A defined piece of work or project
Clearing the backlog, the payroll reconciliation, the vaults and the enrolment of the existing fleet, is a one-off project priced as a fixed sum before we start.
-
03
Retainer
The way most of our clients work with us
Joiners, movers and leavers are service desk work, pre-authorised within your retained hours; the hours are sized to the churn you actually have, and the monthly report shows what it costs.
Who you would work with
The service desk
Takes every change from HR, builds the joiner's kit and closes the leaver off on the day, answered within three rings.
An account manager
Agrees the standard build per role with you and reviews the churn in the monthly report.
Our engineers
Build and enrol the devices and set the policies, as Odyssey employees.
Questions people ask
How do we tell you about a new starter?
HR sends joiners, movers and leavers to our service desk with the date, the role and the manager, and our own team handles each change. A standard build per role makes each joiner a routine ticket.
What does a new starter get?
A Microsoft 365 account with the right licence, a laptop built to the role's image and brought under management and protected, a phone and SIM set up and enrolled, and password manager access, ready before day one.
What happens to shared passwords when someone leaves?
Their access is removed centrally, and the shared passwords they used stay with the business in the team vault, so nothing has to be changed and re-sent to everyone.
What happens to the company data on a leaver's phone?
We lock the phone or wipe the company data remotely, whether it is a company phone or a personal one that was enrolled, so client and business information does not leave with them.
Can you manage personal phones that staff use for work?
Yes. Android and iOS phones and tablets, company owned or personal, are enrolled through Microsoft Intune, with company data in a managed area that can be wiped without touching personal photos. A phone that is not enrolled cannot reach company data.
How quickly is a leaver closed off?
The same day, when HR tells us the same day. Account disabled and sessions signed out, password-manager access removed, company data wiped from devices, mailbox and files handed to the manager. When a leaver is closed off late, the cause is almost always late notice.
What about the licences leavers leave behind?
They are reclaimed at the next review, and the payroll reconciliation at the start finds the ones already left behind. Microsoft 365 licences for people who no longer work for you are the commonest waste we find.
Can you tell us if a disabled account is used?
Yes. Identity monitoring watches Microsoft 365 sign-ins, and a disabled or departed account that signs in is exactly the kind of event it raises.
Talk to a human about joiners, movers and leavers
Call and we answer within three rings. Or tell us what you need and we will call you back at any time.