Job it-joiner-mover-leaver-runbook-tested-on-a-dummy-account · revised 12 October 2026
Write down every joiner, mover and leaver step, and test it on a dummy account
A written runbook of every system and step for people joining, moving and leaving, with an owner for each step, checked end to end by your admin on a dummy account.
You might be seeing
- Nobody can list every system a leaver had an account in
- Leaver steps are done from memory and differ each time
No passwords, keys, card details or admin invites needed to start.
What usually happened
Access is granted system by system over the years, so the list of places a person can log in exists only in the admin's head. When someone leaves, steps are missed and nobody can prove the process works until it fails.
Who it’s for: Founder, office manager or the one person who does IT, who has to answer what the leaver process is.
Usually starts when: A leaver was found with live access, or an insurer, customer or auditor asked what your leaver process is.
The result: You receive a runbook covering every listed system for joiners, movers and leavers, with an owner for each system and a short check that shows it worked. Your admin runs a dummy joiner and a dummy leaver using only the runbook. A read-only check afterwards shows the dummy has no access in any listed system.
Check whether this job fits
Answer these without sending files, logins or personal data. Nothing is submitted unless you choose to contact us.
Checks you can run yourself
Count the places a leaver could log in
List the last five people who left and, for each, every system you remember them using. Compare the lists.
Look for: Systems that appear for one person and not another. Those are the places that get missed.
What you get
- The system inventory
- The runbook
- The role-to-access table
- The dry-run record
Included
- Up to 10 systems and 3 roles, listed from your own exports and notes
- A system inventory with an owner for each system
- Runbook steps for joiner, mover and leaver, each with a check that it worked and how to undo it
- A role-to-access table
- A dry run by your admin on a dummy joiner and a dummy leaver
Not included
- Running offboarding for live staff
- Changing any real account or role
- HR records beyond a staff list
- Exit or employment paperwork
- Buying identity software
How we know it’s done
Agreed with you before work starts. Each check produces evidence you keep.
A dummy leaver processed by your admin using only the runbook shows no access in all the listed systems, confirmed by a read-only check of each.
Evidence: The per-system check results from your admin.
A dummy joiner created using only the runbook has exactly the access the role-to-access table gives its role, and no more.
Evidence: The created access listed against the table.
Every listed system has one named owner and a check that your admin ran during the dry run.
Evidence: The inventory with owner and check columns filled.
Your admin completes both dummy runs without asking us to explain a step.
Evidence: Your admin's notes and the count of questions asked.
Sign-off. Your named IT admin runs the acceptance tests, reads every failure and signs off in writing. The result describes items like the sample, not every future item. Payment follows sign-off.
If it fails. If a test is not met, you do not pay for this fixed scope. We hand over what we found and agree whether to stop or re-quote; no surprise work.
When it fits, and when we stop
It fits when
- A named person can create a test account in each listed system
- You can list the systems staff use, or give exports that show them
- You use at least five systems, where a one-page checklist is not enough
- Staff list fields stay limited to name, work email, start date, leave date and manager
We stop and tell you if
- No one in the business has admin rights to create a test account
- You want us to run offboarding for live staff
- You use fewer than five systems, where a one-page checklist is enough
What could go wrong
We change nothing. Your admin creates and removes the dummy accounts only. Our copies of your files are deleted when the job ends.
Scroll the table sideways to read it all.
| Risk | How we handle it |
|---|---|
| A system is missing from the inventory, so a leaver keeps access to it. | The inventory comes from exports and invoices, not memory, and the report lists systems with no export as not covered. |
| The dummy account test passes but a real leaver differs. | The runbook says what the dummy did not test, and your admin reruns it after any new system is added. |
| A step disables something staff still need. | We change nothing. Your admin approves each step and runs it, and each step says how to undo it. |
A separate automated reviewer checks every output against the agreed test before hand-over. No person on our side reviews unless your agreement names one. Your named IT admin approves what is used.
How we deliver
We arrange the work and independent review, then show you the result against the agreed checks. You keep authority over your systems.
- Agree the systems, roles, owners and what each check must show
- Build the inventory from your exports and fill gaps with questions to you
- Draft joiner, mover and leaver steps with an owner and a check each
- Your admin runs a dummy joiner and leaver using only the runbook
- Your admin runs the read-only check; we fix every step it exposes
- Separate automated review, then hand over the runbook and record
This is a one-off job, not emergency cover or a subscription. We confirm eligibility, the total price, a start window and a delivery date before you accept, and an enquiry creates no charge or booking. Work starts only after agreed inputs, secure access and any needed permissions are in place.
Need to keep it working?
Discuss a monthly check that finds leavers who still have access.
Ongoing work is separately scoped and quoted: no monitoring, response-time guarantee or automatic subscription is included in this job.
Explore an ongoing managed lane, or mention the responsibility you need in your enquiry.
What you can check
This is a new service. We have not delivered this job for a client yet.
Other ways to get this done
- Microsoft Entra Lifecycle Workflows automate leaver steps, but need an Entra ID Governance subscription that Microsoft 365 Business Premium does not include. learn.microsoft.com
- Write a one-page checklist by hand from the last person who left: every system you had to touch, in order. It works for a handful of systems.
Questions
Will you remove my leavers' access?
No. Your admin makes every change. We write the runbook and test it on a dummy account.
Do you need admin logins?
No. We work from exports your admin runs and from the dummy account results your admin reports.
Is this a Microsoft feature?
No. Microsoft's automated leaver tooling needs a licence many small tenants do not have, so this runbook is manual.
Send an enquiry
Send us
- The systems staff use, as a plain list
- Which of them you have admin rights in
- How a leaver is handled today, in a few sentences
Later, once you agree
- User-list exports you run yourself, with passwords never included
- A named admin who creates and removes the dummy accounts
- The three roles and what each needs access to
- The agreement that names the model provider, its country and how long it keeps data, settled before any real personal data is shared
You keep every account and every admin right. We work from lists and exports that you run, and we hold no credentials between runs. Your admin makes every change, on a dummy account only.
Email fallback: open your mail app
If website submission is unavailable, review and send the fallback email yourself. An email fallback is not a website receipt. Or write to hello@syntheticindustry.ai with “it-joiner-mover-leaver-runbook-tested-on-a-dummy-account” as the subject.