Identity and access management, including the part where leavers lose access
Trusted by
Identity and access management, three pillars, one operator.
Most IAM services stop at the platform. One Canadian team builds it, locks down the admin accounts, and proves access came off.
Identity platform
Directory, single sign on, MFA, and conditional access on the licences you already hold. Most Microsoft Entra ID tenants we open already carry the features nobody switched on.
Privileged access
Admin accounts vaulted, elevation granted just in time, every session recorded. That's privileged access management (PAM) rather than a stronger login, and it covers the small set of accounts that can change the environment itself.
Joiners and leavers
Provisioning, role changes, and identity governance your auditor can read. Joiner, mover, and leaver wired to the directory, so an account dies with the employment that justified it.
Does Identity and Access Management work the same way in every industry?
No. The Identity and Access Management work is the same craft in every sector, but the conditions around it are not. In financial services that means OSFI's technology and cyber risk rules; in healthcare, provincial health privacy law; and in legal, Law Society duties and solicitor-client privilege. We keep the service and change the part that bends.
Segregation of duties, provable per transaction.
OSFI B-13. Technology and cyber risk across three domains: governance, technology operations and resilience, and cyber security. It binds federally regulated institutions, and only those.
Who opened which chart, provable, because someone will ask.
PHIPA. Ontario's health privacy act, with its own definition of a custodian and its own duties for the agents acting on a custodian's behalf. Your IT provider is usually an agent.
Who can open which matter, provable after the fact.
Law Society obligations. Confidentiality and competence duties reach the technology you practise with, and the vendors who touch client information. The firm is expected to have assessed the provider, which means the provider should arrive with the answers.
Controlled-goods access has to be provable per person, per document.
ITAR and the Controlled Goods Program. Registration under the Defence Production Act is mandatory before anyone examines, possesses or transfers controlled goods in Canada. Technical data counts, so a drawing sitting on a laptop is in scope.
What do you need from Identity and Access Management?
Tell us who you are and what you're working on. A senior engineer reads your message before replying, so the first answer is a real read on scope, risk and timing, within an hour, 24/7. Nothing here is a commitment, and we'll tell you plainly if we're not the right fit.
Your request
- Service
- Identity and Access Management
What happens next
- A senior engineer replies within an hour, 24/7, never an SDR.
- We book a 30-minute call to listen, sketch options, and flag risks.
- You get a scoped statement of work within 3 business days.
Call the 24/7 line
+1 514-465-1584Identity and access management in Canada, made real.
Most identity projects buy a platform and never finish the boring half. The boring half is the control, and this is written by the engineer who'll own your directory, not by a product page.
Why credentials still decide the incident.
Credentials are still the thing attackers use most, and the 2026 data is more interesting than the headline. Credential abuse fell to 13% as the initial way in, losing the top spot for the first time in the report's nineteen years, with software flaws taking it at 31%. Count credential abuse anywhere in the attack path, though, and it turns up in 39% of breaches, more than any other vector (source: Verizon Data Breach Investigations Report, 2026). Attackers knock less often and still walk around inside using someone's login.
Finishing the identity platform you already own.
Most Canadian organisations we meet already own a capable identity platform inside their Microsoft licensing and use perhaps a third of it. Single sign on covers the six applications somebody set up and not the twenty that came later. MFA is enabled but exempted for the executives who complained. Conditional access sits at default. An SSO implementation stalls on those decisions rather than on the tooling, and an MFA deployment that ships with an exemption list isn't finished. We build on what you hold and say plainly when a licence tier genuinely needs upgrading, which is less often than a reseller will suggest.
The failure that shows up in incidents: leavers and standing privilege.
Accounts outlive employment because offboarding runs through HR and payroll while the directory sits outside that flow entirely. Admin rights get granted for one migration and never withdrawn. We connect the joiner and leaver process to the directory, vault the privileged accounts, and grant elevation just in time so nobody holds domain admin permanently. Identity governance is what keeps that state true a year later, because a review nobody signs is a spreadsheet. PIPEDA applies here too: an account that shouldn't exist is an access-control failure you'd have to explain.
Want a Senior IT Consultant's Read on Your Setup?
Tell us what you run today and what keeps breaking. A senior SMEnode engineer replies within an hour with a first read on scope, risk and timing. No sales handoff.
Request a consultHow our privileged access management and identity governance work runs.
Four steps, and step 01 is the one clients remember. Discovery on a real directory finds things nobody expects: service accounts with passwords set in 2019, shared logins for a system three teams use, accounts for contractors whose engagement ended two summers ago. We inventory identities and entitlements before recommending anything, because the shape of the problem decides whether this is a configuration job or a platform job, and those are different quotes.
Engagement phases
Phases 01 to 04
Inventory identities
Every human, service, and shared account, what it can reach, when it was last used, and whether its owner still works here.
Build the platform
Directory hygiene, single sign on across the applications that matter, MFA without the exemption list, and conditional access rules that survive contact with users.
Contain privilege
Admin accounts into a vault, elevation granted just in time and recorded, and standing domain admin reduced to nobody.
Close the loop
Joiner, mover, and leaver wired to the directory, plus access reviews that produce a signed record rather than an unread spreadsheet.
Identity and access management questions, answered straight.
Answers first, including when not to start. An architect takes the call, not a salesperson.
Where this work connects.
These disciplines share the same senior team and tend to land together. Follow the thread to the next one.
- SecurityVulnerability ManagementCanadian vulnerability management that ranks by real exploitation, then tracks every finding to closed.
- SecurityManaged Security Services (MSSP)A Canadian managed security service provider that agrees what it can do at 3am before go-live.
- SecurityPenetration TestingCanadian penetration testing services with written scope, reproducible findings, and a retest after you fix.
