Access granted with approval and removed the day the person leaves
I design roles and permissions in your ERP, help you choose an identity platform and connect single sign-on to your applications.
36questions on roles, joiners, leavers and sign-in, in 8 minutes
One account per person, roles by function and a single sign-on
Identity and access management (IAM) administers users, roles and permissions across all systems: who gets in, to what and with whose approval, and when access is removed.
Single sign-on (SSO) lets people log into every application with one account. Disabling it removes access to everything at once.
Signs your company needs one
- Access is created on verbal request
- People who have left keep active users
- Each system has its own password
- Too many users are administrators
- Department permissions are set by hand in each system
- An audit asks for the access matrix and there is none
IAM: who it is for and when it does not fit
A good fit for
- Companies where a departing employee keeps access to the ERP or email
- IT teams that create users on request, with no profile per job role
- Organisations with external audits that ask to review who has access to what
Not a fit when
- There are few applications and few users: Odoo groups and two-factor authentication are enough
- HR does not report joiners and leavers on time; the problem lies in that notice
- The key applications do not support single sign-on or any standard protocol
The cost of staying as you are
Leavers’ accounts
An active user belonging to someone who has left is an open door to company information.
Accumulated permissions
People who change jobs gain permissions without losing old ones and end up with access nobody would approve together.
Audit findings
Without a matrix or periodic review, every audit finds the same issues and asks you to rebuild the evidence.
How I assess IAM in four steps
Roles come from job positions, not from people. Leavers are closed the same day HR reports them.
I inventory applications and accounts
Which applications the company uses, who administers them and who has access today.
I design roles
Function-based roles in the ERP and main applications, with an access matrix.
I organise joiners and leavers
A procedure with deadlines, with HR as the source of people.
I help you choose and connect
Identity platform, single sign-on and multi-factor authentication across your applications.
What your company provides for the identity and access management project
List of applications and accounts
Which systems the company uses and who has a user in each.
Org chart and job roles
Current job roles and what each does, to derive the access roles.
Joiner and leaver notice
An agreement with HR on when and through which channel each change arrives.
Existing directory
Admin access to Google Workspace, Microsoft 365 or whichever directory you already have.
Assessment, selection and integration
Roles and permissions in the ERP
Department permission design, removal of critical access and an access matrix.
Platform selection
Requirements and comparison of identity platforms based on your applications and email.
Sign-on integration
Connecting SSO to your ERP and applications, and removal coordinated with HR.
Diego Muñoz
I do not implement corporate identity platforms. I design roles and department permissions in the ERP, remove critical access, help you choose the identity platform (Entra ID, Okta, Keycloak or another) and connect single sign-on to your ERP and applications.
I assess, choose with you and integrate
Take the assessmentMarket options
Identity platforms differ in the protocols they support, automatic account provisioning and cost per user.
Odoo users and access rights
Odoo controls access with groups and record rules, and supports login through OAuth or LDAP. It connects to an identity platform so the corporate account also opens the ERP.
Other platforms I assess
- Microsoft Entra ID
- Okta
- Keycloak (código abierto)
- Google Workspace
- Ping Identity
Selection criteria
- Applications that must join single sign-on
- The directory you already pay for with corporate email
- Connection to your HR system
- Multi-factor authentication and access logs
- Cost per user and who administers it
IAM: limits and alternatives
Corporate identity platforms
I do not implement Entra ID or Okta end to end. I design roles, choose with you and connect sign-in to the ERP and your applications.
Older applications
Those without SAML or OpenID Connect keep their own users; they are controlled through periodic access reviews.
Third-party access
Vendors and external consultants need their own onboarding circuit with an expiry date.
Which other systems it connects to
Human capital management
Hiring and leaving in HR grant and remove access.
See the systemGovernance, risk and compliance
Access matrix and reviews as control evidence.
See the systemEnterprise resource planning
Function-based roles and removal of critical permissions.
See the systemIT service management
Access requests with approval and a record.
See the systemObservability and monitoring
Alerts on unusual logins and access logs.
See the system36 questions and 8 minutes to see where to start
This assessment measures how access for your staff, contractors and external users is created, assigned, reviewed and removed in the ERP and other applications. The questions describe observable facts, such as how long a leaver's account takes to close or who approves a new access.
Scored dimensions
- Joiner, mover and leaver. It looks at how access is created, adjusted and removed when a person joins, changes role or leaves the operation.
- Identity source and roles. It looks at whether there is an official list per person type, employee, contractor or external, and whether permissions are assigned by documented role.
- Directory and single sign-on. It looks at whether accounts live in a central directory, whether applications use that account for sign-in and whether the application inventory is known.
- Measured leavers and privileges. It looks at whether the time to remove access after exit is measured and how many users hold administrator privileges.
- Access owners and administrators. It looks at who authorizes access to each system and whether access administration depends on a single person.
- Authentication, review and segregation. It looks at the use of shared accounts, multifactor authentication requirements, periodic access review and control of incompatible duties.
What you receive
When you finish, you receive your level in six identity and access dimensions and the gaps in priority order, with the first action for each.
18 scored questions and 13 context questions (type of operation, size, current system). Context questions are not scored: they let us read the result against similar operations.
Free of charge. Only Diego Muñoz sees your answers.
Before you start
Not as a corporate project. I design roles and permissions in the ERP, help you choose the platform and connect single sign-on to your ERP and applications; the vendor or your IT team configures the platform.
Yes. Those suites include a directory that many applications accept for single sign-on. Sometimes the first step is making better use of what you already pay for.
By matching the staff list against each system’s active users and removing leavers’ accounts. Then function-based roles and multi-factor authentication on email.
The online assessment and the 30-minute review with Diego are free and carry no commitment.
Only Diego Muñoz sees them, to prepare the review. They are not shared with third parties or used for bulk mailings.
Review your IAM case with Diego in 30 minutes
Diego Muñoz replies in person, on Lima time. If you have taken the assessment, he comes with your answers already read.
WhatsApp +51 919 488 260 · damunoz@dmunozgroup.com