Identity & access
Identity is the new perimeter. Our team builds and repairs directories, single sign-on, multi-factor authentication and privileged access, from on-premises Active Directory to cloud identity providers.
Our team has built and repaired directories and sign-in for organizations of very different sizes, including a hybrid environment for the offices of one of South Korea's largest companies. We design who gets access, how they prove who they are and how that access ends, across on-premises directories, cloud identity providers and single sign-on.
Delivery starts with an inventory of accounts, groups and administrator rights, then moves in stages: multi-factor sign-in, removal of shared and stale accounts, privileged access and logging. The order follows risk, not product features. "MFA and Passkeys for Businesses" explains the sign-in controls, and "Zero Trust for Mid-Size Firms" shows how identity becomes the base of the larger design.
What we do
- Single sign-on across business applications with SAML and OIDC
- MFA rollout with conditional access policies
- Active Directory clean-up, migration and hybrid identity
- Privileged access management and admin account separation
- Passkey and security-key deployment
- Custom two-factor authentication for in-house software
- Joiner, mover and leaver workflows
- Access reviews and audit-ready reports
We build on open standards (SAML, OIDC, OAuth 2.0, FIDO2 and WebAuthn) so access can move between vendors without a rebuild. When a product does not fit, we write the custom two-factor flow. Our team has worked with virtually every identity system.
Identity ties together our Managed IT, Cybersecurity and Cloud Management services. A joiner, mover and leaver process, enforced MFA and reviewed admin rights remove a large share of the risks we see in assessments.
Leading platforms we work with
- Okta
- Microsoft Entra ID
- Ping Identity
- CyberArk
- Microsoft Active Directory
- SailPoint
- Cisco Duo
- Keycloak
- Yubico (YubiKey)
- 1Password
Platforms and practices
- SAML
- OpenID Connect (OIDC)
- OAuth 2.0
- LDAP
- RADIUS
- Single sign-on
- Custom two-factor authentication
- Auth0
- Google Cloud Identity
- FreeIPA
- Passkeys (WebAuthn)
- Every identity system: directories, SSO, MFA and privileged access
References
- Okta: Leader, 2025 Gartner MQ for Access Management
- Microsoft: Leader, Gartner MQ for Access Management (Nov 2025)
- Ping Identity: Leader, 2025 Gartner MQ for Access Management, 9th consecutive year (vendor press release, Nov 18, 2025)
- CyberArk: Leader, 2025 Gartner MQ for Privileged Access Management, 7th consecutive time (vendor release, Oct 2025)
Sources last checked .
Product names are trademarks of their owners and are listed to describe our experience; they do not imply endorsement or partnership.
How we use Identity & access for clients
Frequently asked questions
Direct answers to the questions we hear most. Something else on your mind?
Send us a messageCan you work with our current identity provider, such as Microsoft Entra ID or Okta?
Yes. We have experience with both, and with Ping Identity, CyberArk, Auth0, LDAP and FreeIPA. We usually improve what you already have before suggesting a change.
Can you connect older systems that only speak LDAP or RADIUS?
Yes. Our team works with LDAP and RADIUS for network devices, Wi-Fi and legacy applications.
Which MFA methods do you recommend?
Phishing-resistant methods first: passkeys (WebAuthn/FIDO2) and hardware security keys, because they cannot be handed to a fake login page. Authenticator-app prompts with number matching are the next choice, and SMS codes are the last resort where nothing else is possible. We apply the strongest method to administrators and email first.
What is conditional access?
Policies that decide whether to allow, challenge or block a sign-in depending on the user, the device, the location and the risk. For example, require a managed device for finance systems, or block sign-ins from countries where you have no staff. It strengthens MFA, but needs testing so you do not lock out your own administrators.
How do you handle joiners, movers and leavers?
We connect access to a single source of truth, usually HR, so a new hire gets a defined role's access, a transfer changes it, and a leaver loses all of it on the same day. Where automatic provisioning is not available, we use a checklist with a named owner. Orphaned accounts after departures are among the most common findings in access reviews.
What is privileged access management and do small firms need it?
It is control over administrator accounts: separate admin identities, approval or time limits for elevated rights, and recorded sessions. A small firm does not need a large product; separate admin accounts with MFA, no daily use of admin rights and a break-glass account stored safely deliver most of the benefit.