Directory clean-up
Dormant accounts, empty and duplicate groups, passwords set never to expire and service accounts holding admin rights. Every account we find either gets an owner or goes on the list for closure.
Service · System administration
Active Directory and Entra ID
A logistics warehouse in the hinterland of Koper runs three shifts. Alongside permanent staff it relies on agency workers who rotate every few weeks, drivers who confirm collections on tablets, and a customs broker with access to the import paperwork folder. Over ten years the directory has grown with no plan at all. A group called “Skladisce2” carries rights nobody can explain, twenty accounts have not signed in for six months, and the terminals at the loading bays stay logged in under one account shared by the whole shift. When someone asks who changed a shipment record, there is no answer. This service puts the directory in order and ties it to HR changes. Rights belong to the job, not the individual; temporary accounts carry an expiry date; shared logins give way to quick personal sign-ins; and every sign-in from outside asks for a second factor. We work with Entra ID and Microsoft 365 on their own, with on-premises Active Directory, and with hybrid set-ups. Which one you have, we confirm on the first video call.
Rights by job
not by individual
Temporary accounts
with a built-in expiry
Personal sign-in
even on shared terminals
Emergency access account
stored safely and tested
Scope of the service
First we tidy up what has piled up, then we set rules so the mess does not creep back. The scope depends on the size of the directory and whether an on-premises server is involved.
Groups per job
Warehouse operative, shift lead, customs clerk, accountant. Each job gets a group with precisely defined access, and individuals inherit their rights from it.
Temporary and external users
Agency staff, students and outside partners such as a customs broker get accounts with an end date, or guest access that their manager re-confirms periodically.
Shared terminals
At loading bays or on the shop floor, each person signs in with their own badge or FIDO2 key in seconds. The pace stays the same, and a trail of who did what appears.
Multi-factor sign-in
Microsoft Authenticator, passkeys or hardware keys, introduced department by department with one-page instructions and a grace period so nobody is locked out.
Conditional Access
Company data available only from managed devices, sign-ins blocked from countries where you do no business, and stricter rules for admin roles.
Hybrid environments
Syncing on-premises Active Directory to Entra ID through Entra Connect, slimming down Group Policy, protecting domain controllers and mapping out which services move to the cloud over time.
How the work runs
Changes are phased in. Each new rule applies to a small pilot group first and only then to everyone.
01
Export and review
We pull out accounts, groups, roles and licences and produce a risk list: dormant accounts, excess rights, admins with no second factor.
02
Job model
With management we define the jobs, the access each needs and who signs it off.
03
Joiner and leaver routine
We agree who tells us about a new starter or a departure, and in what form. Every such message to helpme@apply.si becomes a ticket.
04
Regular attestation
Each quarter, managers confirm their teams' rights; anything unconfirmed is withdrawn.
What if no administrator can sign in? A badly configured Conditional Access policy or an outage of the multi-factor service can lock every admin out at once. We therefore create an emergency access account that is excluded from the usual policies, protected by two hardware keys kept in separate places, and monitored so that any sign-in triggers an alert. Once a year we test it together with you.
Your questions answered
No. Smaller firms often run on Entra ID and Microsoft 365 alone and manage their PCs with Intune. If you keep a local Active Directory for older software or a file server, we connect it to Entra ID and keep it for as long as it is needed.
We use FIDO2 hardware keys or badges the worker carries, or Windows Hello on a shared device. No personal phone is required, and a key costs little per person.
Conditional Access and Intune come with certain plans, Microsoft 365 Business Premium among them, but not with the entry-level ones. We check who needs which licence and propose the cheapest mix that works. You buy the licences from your usual supplier.
A controller has to be able to show who can access personal data and how that access is protected. A job-based rights overview, personal accounts and sign-in logs are among the technical and organisational measures GDPR expects. We do not give legal advice, but we do produce the technical evidence.
We lock the account on the last day, turn the mailbox into a shared one or hand it to the manager, move OneDrive files to a team folder and free up the licence. How long the data is kept is your decision, in line with your own retention rules.
More services in this area
Service
PC clean-up and malware removal
A crawling PC, bogus virus alerts or a mailbox someone else seems to control: we trace the cause remotely, clean up and remove whatever let the trouble in
Service
Server management
Windows and Linux servers with a named owner, a maintenance calendar and backups we actually restore every month
Service
Virtualisation
Physical servers become virtual machines on two or more hosts, with replication, backups kept off the host and a rehearsed failover
Let us sort out your directory
How many users do you have, do you use temporary or agency workers, and is there an on-premises server? We will reply with a proposed first step.
When we work
Weekdays 9:00-17:00 CET, answers the same or next working day
Weekdays 9:00-17:00 CET, answers the same or next working day
Calls
Video meetings, Teams and Meet both welcome
Video meetings, Teams and Meet both welcome
Enquiry received
An engineer will write back no later than the following working day. Faults that leave your staff unable to work are always looked at first.
- Questions first. If something is missing before we can estimate, we email you or set up a brief video chat.
- A written quote. It spells out the work, a euro figure excluding VAT and a sensible start date. No fine print, no surprise line items down the road.
- You choose. It lands in your mailbox. Read it at your own pace, query anything that seems vague, and only then make up your mind.