When this company moved its IT to Advisory, it handed us three platforms built by other teams: an Apple device management tool, a Windows environment in the middle of a migration, and Okta. Access requests ran through a separate ticketing system whose contract was about to end. As a company in a regulated industry, it needed every access decision to be approved, auditable and reviewed by security and privacy when required.
Our first audit, in July 2025, found:
- An aging fleet: 33 Macs needed replacement urgently, and 22 more had reached end of life.
- Devices out of contact: 57 computers and 18 mobile devices had not checked in with management in more than 30 days.
- Endpoint protection gaps: 40 active Macs had no working endpoint protection agent.
- No third-party patching: neither Mac nor Windows had central management of app updates.
- Identity gaps: 149 Okta applications, 88 of them with no automated account setup or removal, and 7 users with super administrator rights.
One review across three platforms
We reviewed the Apple, Windows and identity platforms together and presented the results in a single review. Each finding was ranked P1 to P3, so leadership could see what mattered first.
A modern Windows standard
We rebuilt the Windows environment to a modern standard:
- Apps repackaged for reliable deployment, with automated third-party patching.
- Update rings, Autopilot with pre-provisioning, BitLocker hardening and compliance baselines.
- Remote monitoring with automatic fixes for devices that stop checking in.
- Application control.
[CONFIRM: which Okta audit recommendations were implemented, for example removing extra super admins or requiring MFA for password resets]
Governed access, before the deadline
We replaced the expiring access-request system with Okta Identity Governance before the contract ran out:
- Multi-step approval sequences that reproduce the company’s existing rules, including cybersecurity and privacy review where required.
- Time-limited access to production cloud environments.
- A fallback route for apps that are not integrated with Okta.
- A full communications pack and a test group drawn from several departments.
The new process went live company-wide in September 2025, about a month after the build kicked off, and the old system was shut down. We then rolled out Admin By Request to remove standing local admin rights.
Right-sizing as ongoing service
Optimization continued as part of ongoing service:
- A 2026 Google Workspace audit led to more than 500 dormant, suspended accounts being archived. That cleanup helped the company renew its licenses at a lower rate.
- Ahead of the Apple device management renewal, we cut enrolled devices from 278 to 115, so the renewal could be quoted at the company’s real usage.
- Most recently, we extended the governance model to AI: an approval flow for AI use cases built in Okta Identity Governance, with guardrails for protected health information.
- Legacy access-request system retired about a month after the build began. Every app access request now runs through a governed, auditable approval flow.
- 500+ dormant accounts archived, helping the company renew its licenses at a lower rate.
- Device management enrollments cut from 278 to 115 before renewal.
- [$X saved across license renewals]
- [CONFIRM: number of access requests processed through the new approval flow since launch]