Solutions · Leavers and helpdesk tasks
Leavers, starters and resets, each one an approved change.
The everyday admin jobs that need a safety net, done in the client’s tenant with a dry run, an approval, an audit record and a way back where Microsoft allows one.
30 days of everything in Automate on up to 3 tenants, from your first connected tenant. No card. Then choose the plan that fits.
- Offboard a leaver as one approved change
- Reset a password, shown once
- Set up a new starter like a colleague
Why this is hard today
Offboarding a leaver is a dozen steps in four admin centres, and missing one leaves an account signed in or a mailbox unclaimed. Resets and device wipes are quick to do and hard to undo, and the record of who did what is usually a ticket note.
How ConfigCheckup solves it
Leavers in one change
Block sign-in, sign out everywhere, remove MFA methods, turn the mailbox into a shared one with an auto-reply or forward, give the manager the mailbox and OneDrive, and take back groups and licences.Starters like a colleague
Give a new starter the groups and directly assigned licences of someone in the same role. The account must already exist.Password resets, shown once
A one-time password made in the run and shown once to the approver, never stored, emailed or logged. Accounts with a directory role always need two approvers.Devices and sign-out
Retire a device, or wipe it with two approvers who each type its name, never from Teams or Slack, at most 5 an hour. Sign someone out everywhere in one step.
Ask
From the client’s People and leavers or Devices page: a Technician, Admin or Owner asks for the change.
Check the dry run
It lists exactly what will change for that person or device, and says when something cannot be undone.
Approve
Approved by one or two people, your choice per client; some higher-risk changes always need two. With two, at least one is not the person who raised it.
Every job is dry-run before anyone approves
- What is set now, and after
- Whether it can be undone
A change’s dry run and details: what is set now and after, how risky it is and whether it can be rolled back. Every leaver, reset and device change shows the same. Demo workspace.
Check it yourself
- Why a password is shown once and never stored. Check it: Why a password is shown once and never stored.
- A one-time access pass is offered only for an account an approved change created, within 7 days, and shown once.
- The Technician role can ask for resets, retires and wipes and approve device actions, with no access to billing or settings.
- Which of these changes can be undone, and which always need two people. Check it: Which of these changes can be undone, and which always need two people.
What it can’t see
Said plainly, so you know what you are buying.
- It does not create user accounts or groups, or manage mailbox delegation; do those in Microsoft 365, Lighthouse or CIPP.
- Resets are one account at a time; there are no bulk password resets.
- A password reset, signing out everywhere and a device retire or wipe cannot be undone, and the dry run says so.
It reads settings and activity records, never content, with permissions your client’s admin grants. Every permission and role, and why
Questions
- Can a reset be approved from my phone?
- Where the workspace owner allows it for a client, a reset can be approved from Teams or Slack. The password is still only shown in the console, once. A wipe is never approved from chat.
- Does the manager see the leaver’s files?
- The offboarding gives the manager access to the leaver’s OneDrive, using the one file permission the automation app holds. ConfigCheckup itself never opens a file.
Plans: Leavers, starters, resets and device actions with Automate and above.
What each plan includesSee it on your own tenants.
The findings and figures come from your client’s own tenant, not from averages.
30 days of everything in Automate on up to 3 tenants, from your first connected tenant. No card. Then choose the plan that fits.