Managed lane internal-it-hygiene-lane · revised 12 October 2026
Managed lane
Know who still has access and what renews, every month: a managed IT hygiene lane
For one tenant and up to five apps: monthly leaver and stale-account checks, a renewals calendar kept true and one bounded extra item a month. Proposed GBP 570 a month.
An enquiry starts a fit and scope conversation, not a contract, payment or reserved place. No logins, personal data or account invitations initially.
What the lane takes off your plate
Staff accounts, admin rights, seats and renewals drift every month. A one-off review is out of date within weeks, and nobody owns the monthly check, so a leaver's login or a lapsed renewal is found by accident.
Who it’s for: Owner or IT lead of a firm of 10 to 250 people, with nobody who owns access reviews and renewals as a monthly job.
Usually starts when: A customer, insurer or auditor keeps asking who has access and what you have in place, and the answers come from memory.
The result: For one tenant and up to five apps, each month you receive up to three checks and a summary: leavers with live access, stale and over-privileged accounts, and renewals due in 90 days with an owner and a backup. Each check starts once its baseline exists, and the first three months' items build the baselines. Up to one bounded extra item a month is delivered and accepted from a listed set, and you or your admin make every change.
What stays true, and what we do about it
No response-time guarantee is published for this new service. Timing and monthly capacity are agreed in writing before it starts.
Hours are agreed in writing before the lane starts. At launch it is not staffed round the clock and runs on the monthly cycle in the proposal.
What must remain true
- Each check holds from the month its baseline exists; the first three months' items build the baselines in order
- No person who left more than the agreed grace days ago has an active account, seat or token in a covered system, unless a named exception exists
- Every admin role holder is named and approved by the owner, or listed for a decision
- Accounts without MFA, stale accounts, shared mailboxes and forwards each have an owner or are listed as having none
- Every renewal due in the next 90 days has an owner and a backup, and a reminder is tested for one item each month
- When the seat check is chosen as the month's item, unused seats are listed with the cost worked out from your own invoice lines
What we watch
- The monthly staff list with five fields
- Read-only exports or a read-only role for the directory and each app
- Invoices and renewal emails you send
When something happens
Scroll the table sideways to read it all.
| When | What we do |
|---|---|
| A leaver still has access beyond the agreed days. | We put them first in the summary with the evidence row and offer the change-list job. Linked job: Leaver removal change list |
| A new admin role holder appears outside the approved list. | We put it first in the summary and ask who approved it. |
| A renewal falls due in under 30 days without a confirmed reminder. | We list it first in the summary for the owner and backup you named. |
| A seat renewal is coming and unused seats are likely. | We offer the seat check as the month's item. Linked job: Unused software seats |
We do on our own
- Read exports and compare them with last month
- Prepare reports, summaries and drafts
- Offer a listed job as a next step
We ask you first
- Disabling, deleting or changing any account, role, licence, MFA or access setting
- Revoking any app grant
- Reading mailbox or file content, or HR data beyond the five staff-list fields
- Sending anything to staff or to a departing person; we write only to the owner you name
- Holding admin credentials between runs
- Deciding that someone should or should not have access
We escalate to you when
- Unexplained admin changes appear; we list them first and make no judgement about a break-in
- The same leaver or finding is open three months running
- An export stops arriving or changes shape
How you know it held. Each month the summary reports, with unknowns kept: leavers with live access at report time, accounts with no owner, share of accounts with MFA, count of stale accounts against last month, renewals missed, seats unused worked from invoices when the seat check was chosen, and the share of findings closed. It also reports how many findings a second automated reviewer re-checked and the false-finding rate.
What the lane is made of
Each extra item has agreed acceptance checks and an accept-or-revise decision. One a month is a ceiling, not a completion guarantee. The arrangement continues only under agreed renewal terms.
Check every month for leavers who still have access to your named apps Standing service Included
Each month we compare your staff list with your directory and up to five apps and send a list of leavers who still have an active account, seat or token, with the evidence row for each.
Every month, for the named directory and up to 5 apps
The same standing service you can buy on its own at its listed price.
Review every month which accounts are stale, admin or missing MFA in your tenant Standing service Included
Each month we list accounts with no recent sign-in or MFA (two-step sign-in), admin roles, guests, and mailboxes or forwards with no owner, from read-only exports, with a decision column.
Every month, for the named tenant
The same standing service you can buy on its own at its listed price.
Keep your renewals calendar true every month, with an owner and a tested reminder Standing service Included
Each month we update your renewals register from the new invoices and emails you send, check owners and backups are still on your staff list, test one reminder and list renewals due in 90 days.
Every month, for up to 60 renewals
The same standing service you can buy on its own at its listed price.
Find people who have left but still have an account or seat in your apps Job Included
A list of people who have left but still have an active account, seat or token in each app you name, with the export row behind every entry, and unlisted accounts shown apart.
Once, as the first month's item, unless you already hold a baseline
Gives the monthly leavers check its baseline.
Put your renewals on one calendar with an owner and a reminder that reached them Job Included
Up to 60 renewals (domains, certificates, software, warranties, contract end dates) on one calendar, each with a source, owner and backup, and one tested reminder. Unknown dates are listed.
Once, as the second month's item, unless you already hold a register
Builds the register the monthly renewals check keeps true.
See stale accounts, admins and missing MFA across Microsoft 365 or Google Workspace Job Included
One report for your Microsoft 365 or Google Workspace account: no recent sign-in, no MFA (two-step sign-in), admin roles, guests, and mailboxes or forwards with no owner, each with its evidence row.
Once, as the third month's item, unless you already hold a baseline
Builds the baseline the monthly accounts review compares against. Within the GBP 300 allowance.
Find software seats nobody uses and work out what they cost from your invoices Job Optional
Per-app tables of seats that are unused, duplicated or held by leavers, with each cost worked out from the invoice line shown beside it and the renewal date.
As a month's item, for example before a renewal
Within the GBP 300 allowance.
One device register matching your device list and finance list, with owners checked Job Optional
One register of devices that matches your device-management list and your finance asset list, with every owner checked against the staff directory and unmatched items listed.
As a month's item, for example each quarter
Within the GBP 300 allowance.
Write down every joiner, mover and leaver step, and test it on a dummy account Job Optional
A written runbook of every system and step for people joining, moving and leaving, with an owner for each step, checked end to end by your admin on a dummy account.
A separately quoted item at its listed price of GBP 395, above the monthly allowance
Built first where no runbook exists.
Get a leaver access-removal change list and dry-run script that your admin runs Job Optional
For leavers you name, a line-by-line change list and a script that prints what it would do and changes nothing until your admin runs it live on each account.
A separately quoted item at its listed price of GBP 395, above the monthly allowance
The change list and dry-run script your admin runs.
Keep your domain, DNS and mail records from silently breaking, month after month Standing service Optional
We check your domain's public records, expiry dates and certificate against an agreed baseline, tell you what changed, and prepare a correction that restores any drifted record.
Bought separately
Covers web domains and DNS in more depth.
Keep one Linux server patched and reviewed, month after month Standing service Optional
Each month one Linux server has its automatic updates checked, the rest applied in a window you approve after a snapshot, its services, disk, certificates and logins checked, and a short report.
Bought separately
For a Linux server, which this lane does not cover.
How an engagement works
One tenant, up to 5 apps, one active item at a time and at most one agreed item a month, worth up to GBP 300 at its listed one-off price. One is a ceiling, not a guaranteed completion or a fixed turnaround. Timing, the monthly test day and capacity are confirmed in writing; none is promised on this page.
How it starts
You send the platform, the apps and your response to the proposed monthly price, without logins or personal data.
We confirm fit, the read-only route, who receives the reports and who makes changes.
We agree the monthly scope, the test day, the first items, the price, the payment terms and the cancellation terms in writing.
Each month we send the reports whose baseline exists, deliver the chosen item and send the summary.
Who decides what
You or your admin choose items, accept them and make every change in your own systems. We approve nothing on your behalf.
Handover
Each item arrives as a report or file with its evidence. Unfinished items are handed back with notes if the arrangement ends.
Sharing your product safely. Initial contact uses the platform name, the app list and your head count. No logins, personal data or account invitations. Private files follow only after a secure route and written terms.
What is included, and what is not
- The monthly reports whose baseline exists
- Each accepted extra item with its evidence
- A monthly summary with the measures below
- A running list of open findings and their owners
Included
- One tenant on Microsoft 365 or Google Workspace and up to 5 named apps
- Up to 250 people and a staff list limited to five fields
- The monthly leavers check, tenant accounts review and renewals check, each starting once its baseline exists
- Where no baseline exists, the first three months' items build them in order (leavers, renewals register, tenant accounts report)
- Up to one bounded item a month, one active at a time, worth no more than GBP 300 at its listed one-off price; a larger item is quoted separately
- A written monthly summary of what was found, closed and left open
Not included
- Disabling accounts, removing roles or revoking apps: your admin does that
- 24/7 cover, alert response or incident response
- A response-time promise or a certification
- Mailbox, file or HR data beyond the five staff-list fields
- Items above GBP 300 at their listed price: those are quoted separately
What you get to see
The customer deliverable is the running result and its evidence, not a pull request. The pull request stays an internal record.
- Request. Your request, as we understood it
- Agreed checks. The agreed checks that define done
- Test results. Test results against each check
- Independent review. An independent review and what it found
- Known limits. What it does not cover
- Acceptance. Your accept or change request
How we know it’s done
Agreed with you before work starts. Each check produces evidence you keep.
Each month the leavers report, the accounts report and the renewals update whose baseline exists are delivered for the named scope, each with the evidence reference for every finding.
Evidence: The monthly reports compared with the list of covered systems and the baselines in place.
Each month after the accounts baseline exists, the admin role holders listed match your console line for line. Each month, a 20% sample of findings, at least 10, matches the live console.
Evidence: The console list and your marked sample.
Each month no more than one extra item was delivered or started, and its listed one-off price is no more than GBP 300.
Evidence: The monthly summary naming the item and its listed price.
No account, role, seat or setting has been changed by us.
Evidence: Your own audit logs for the month.
Sign-off. You read each report, accept or send back each extra item and read the monthly summary.
If it fails. A blocker is raised with a substitute item, revised timing or a stop. Work that does not meet its checks is not claimed as delivered. Billing for incomplete work is agreed before starting.
When it fits, and when we stop
It fits when
- A named admin who receives the reports and makes every change
- HR can share the five staff-list fields each month
- You run the exports yourself, or create a read-only role that can see every item to be checked
- A named owner and a backup for each renewal
We stop and tell you if
- The agreed items regularly exceed one a month or GBP 300 of listed jobs, so we agree a different scope
- You will not create a read-only role or run exports
- You need round-the-clock cover or someone to make the changes for you
What could go wrong
The lane reads files and writes reports and drafts. We change nothing in your systems, so ending it leaves everything as it is and you keep every report.
Scroll the table sideways to read it all.
| Risk | How we handle it |
|---|---|
| The allowance is read as unlimited help. | The proposal states one bounded item a month worth up to GBP 300 at its listed price; larger or extra work is quoted. |
| A report is read as monitoring or an audit. | It says plainly that there is no 24/7 cover, no response time, no incident response and no assurance. |
| A finding leads to a wrong disable that stops real work. | Findings are questions with evidence, and your admin confirms every change. |
| Exports carry text meant to steer a language model. | Export text is treated as data only, the run has no send or change tools, and inputs and outputs are logged. |
A separate automated reviewer checks every report and draft against its agreed test before it is sent. No person on our side reviews unless your proposal names one. Your named IT admin decides what to do with each finding.
Stays with a person
- You or your admin decide what to do with every finding
- You accept each extra item
- You make every change in your own systems
Access we would need
- A read-only role that you create and can remove, or exports that you run
- Never a role that can change anything, and no admin credentials held by us between runs
Questions
Is this managed IT support?
No. It reviews access, accounts and renewals every month from exports. We do not fix problems, answer staff, make changes or give round-the-clock cover.
Can I buy the parts separately?
Yes. Every service and job listed is available on its own. The proposed lane price is the sum of the three monthly services plus the allowance, so it adds one arrangement with a test day and monthly capacity confirmed in writing, not a discount.
Do you need admin access?
No. A read-only role you create and can remove, or exports you run.
What if I need more than one extra item a month?
Extra items are quoted separately, or we agree a different scope.
Start a conversation
Send us
- The platform, the apps to cover and a rough head count
- The last time anyone reviewed access
- Your response to the proposed monthly price
Later, once you agree
- A read-only role you create or monthly exports you run
- The monthly staff list with five fields
- Invoices and renewal emails each month
- A company-controlled secure route agreed before any file is sent
- The agreement that names the model provider, its country and how long it keeps data, settled before any real personal data is shared
You keep every account, every admin right and every renewal. We work from exports or a read-only role that you create and can remove, and we hold no admin credentials between runs. Your admin makes every change in your own systems.
Email fallback: open your mail app
If website submission is unavailable, review and send the fallback email yourself. An email fallback is not a website receipt. Or write to hello@syntheticindustry.ai with “internal-it-hygiene-lane” as the subject.