New starters can get to work on day one because all their access is already in place
User lifecycle management
A fixed procedure for creating, changing and deactivating your staff's user accounts. Every step is documented, automated and traceable.
Your Benefits
When someone leaves, we deactivate all their access centrally and promptly. No forgotten accounts are left open, which reduces the risk considerably
For audits, you can show who had access to which systems and when
If you wish, the process can run automatically from your HR system
Service scope
A documented procedure for new starters: create the account, assign groups, set up MFA, provide hardware
A documented procedure for leavers: back up data, hand over the mailbox, deactivate the account
Role templates for typical positions
Each quarter we review all active accounts so that no orphaned accounts remain
Optional: automation via an integration with your HR system (Personio, BambooHR or custom)
Requirements and exclusions
→ Prerequisites
- Zitadel is set up as the IdP (NDS-ID-ZITADEL)
- Roles and permissions in the connected applications are defined
- A maintenance contract, if you need a guaranteed response time
✗ Not included
- HR consulting (job descriptions, contracts) is not included
- Migrating existing users from Active Directory or another IdP is a project (NDS-PRJ-MIG)
- Custom workflows for complex approval chains are developed as a consulting service
- Training your HR department is provided separately as NDS-PRJ-SCHUL
Related Services
Zitadel identity provider
One account for all your applications. We run Zitadel as an identity provider ourselves, based on the OIDC standard and with MFA mandatory from the start.
MFA rollout and maintenance
Every member of staff signs in with a second factor (multi-factor authentication, MFA) using a TOTP app, a FIDO2 security key or a passkey. Zitadel enforces this centrally.
Does this fit your business?
In 30 minutes we work out whether this service suits you. Free and without obligation.