The migration is done. Now the real work begins.
ACF is not an out-of-the-box product. ACF is a flexible framework tailored for Microsoft Enterprise environments — for operational IT management and migrations. It picks up where projects leave off: migrations, carve-ins/-outs, and organisational change.
The reality after the migration
ACF addresses the problems that remain once the project closes.
Identities remain
After migrations and reorganisations, accounts are technically there — but rarely cleanly maintained.
Permissions propagate
Access rights are inherited, accumulated, and forgotten. The risk grows year after year.
Processes no longer scale manually
What was manageable by hand at 100 users becomes a treadmill at 5,000.
Ownership turns fuzzy
Who is the owner? Who reviews? Day-to-day operations let responsibility slip.
Where ACF is used
The pattern is always the same: the tech runs — but it isn't manageable. ACF is deployed when organisations …
… have one or more migrations behind them
M&A, carve-outs, tenant consolidations — the legacy stays behind.
… are running hybrid or multi-tenant setups
Running cloud and on-premises in parallel demands consistent control.
… operate large, organically grown Entra ID / AD
Historically grown structures without clear governance.
… face operational risk or audit pressure
When ISO 9001, internal audits or compliance demand answers.
… can no longer run lifecycle processes manually
Onboarding, offboarding, reviews — no longer feasible by hand.
What ACF does
Seven capability areas — each focused on what operations actually need.
User & Identity Lifecycle Management
Establish, operate, and retire identities cleanly.
Automation of the entire user lifecycle including license assignment, notifications, and control through defined processes.
After migrations or reorganisations, user accounts are often technically correct but procedurally unclear.
- Clean onboarding and offboarding
- Clear ownership
- Less or no manual rework
Synchronisation of defined attributes from an HR master data system to AD and/or Entra ID, including calculated attributes (e.g. display names, extension attributes).
Identity becomes operationally stable only once HR data is structured and consistently usable.
- Consistent identities
- Fewer special cases
- Stable foundation for automation
Control, review, deactivation and deletion of external identities including sponsor notifications.
B2B accounts are created quickly — and rarely go away on their own. A clearly registered owner is often missing.
- Reduced legacy
- Better security hygiene
- Audit confidence
Group & Permission Management
Keep structures clean without anyone chasing them by hand.
Rule-based management of dynamic groups including central rule definition and automatic membership changes.
Manually maintained groups do not scale reliably in large environments.
- Reproducible group logic
- Fewer errors
- Transparent rules
Lifecycle control for Teams, Planner, Yammer, Distribution Lists and Security Groups.
M365 objects are created by business users quickly — governance often arrives too late.
- Controlled object landscape
- Clear ownership
- Structured decommissioning
Automated management of AD groups including bulk changes, delta groups and API integration.
Hybrid environments require consistent control across cloud and on-premises.
- Less manual effort
- Clean transitions
- Less drift
Enforcement of defined owner structures, e.g. at least two owners per group.
Permissions without responsible owners are an operational risk.
- Clear accountability
- Better reviews
- Fewer forgotten groups
Automated reports and self-service actions for owners to clean up groups that are no longer needed.
Cleanup only works when responsibility is made tangible.
- Relieves IT
- Higher business participation
- Sustainable cleanup
Security-Related Automation
Catch silent failure risks early.
Automated notifications before password expiry — including sponsor involvement.
Production or rarely used accounts otherwise surface only during incidents.
- Fewer unplanned outages
- Sponsor involvement
- Early warning for critical accounts
Monitoring and notification for expiring secrets in Entra ID App Registrations.
Expired secrets translate directly into service outages.
- No surprises
- Stable API integrations
- Plannable renewal
Automated, secure provisioning of temporary credentials.
Emergency access must be fast — but controlled.
- Rapid recovery
- Controlled process
- Audit-grade trace
Compliance & Governance
Audit-ready structures without spreadsheet rituals.
Individually defined access reviews by department, owner or context — including custom reporting and long-term retention of results for audit purposes.
Standard reviews fall short in complex environments. Long-term retention of results for later audits is especially critical.
- Context-specific reviews
- Solid audit trail
- Long retention
Monitoring and control of licenses (E5, F5, Project, Visio, Copilot).
License costs creep in — transparency is often missing.
- Cost transparency
- Targeted cleanup
- Predictable license footprint
Audit-ready reports, e.g. for ISO 9001 or internal audits.
Traceability is at the heart of modern IT governance.
- Audit confidence
- Repeatable reports
- Solid evidence
Certificate & Key Management
Operate security-critical artefacts automatically.
Synchronisation of certificates from trust centres into target systems and APIs.
Certificates are security-critical — barely manageable by hand.
- Consistent distribution
- No forgotten rollovers
- Reduced outage risk
Provisioning of public keys for secure email communication.
Encryption often fails on missing operational integration.
- Working S/MIME communication
- No manual key distribution
- More stable security processes
Reporting & Transparency
Solid data for operational decisions.
Flexible, context-specific reports on identities, groups, access and usage.
Operational decisions need solid data.
- Reliable decision basis
- Repeatable analytics
- Adaptable to context
Analysis of app usage and sign-ins down to day and user level.
The foundation for chargeback models, cleanup and security analysis.
- Clear usage picture
- Basis for chargeback
- Security analysis
Migration-Related Automation
Where migration projects fail without automation.
Analysis and re-ACLing of file shares during carve-outs, mergers or cloud moves.
Permissions are one of the most critical points in file migrations.
- Clean ACL handover
- Reduced migration risk
- Predictable cutover
ACF doesn't make sure your systems run.
ACF makes sure they stay manageable.
