User & Device Management in Rwanda

What is user and device management, and who needs it

It’s a recurring service that handles the steady stream of identity and device changes in a growing organisation. HR or managers send requests; we carry them out against agreed checklists, confirm and record them. Alongside that, we watch device compliance and licence use. It suits organisations without a dedicated IT administrator, and those whose IT person spends most of their week on account changes.

The problem it solves

Without a routine, account and device administration happens differently each time. One starter gets the right access and another waits a week. A leaver’s account stays active for a month. Laptops quietly stop updating. Licences pile up for people who left. None of this is dramatic, but together it creates security gaps, wasted spend and frustrated staff. A defined routine makes every change consistent, fast and traceable.

Joiners, movers and leavers

Joiners. Account and licence by role, groups and team membership, a configured laptop, and multi-factor authentication set up with the person on their first day.

Movers. Access from the new role added and access from the old role removed in the same step, so permissions don’t pile up over years.

Leavers. Sign-in blocked and sessions ended on the last day, work data removed from personal phones, devices collected and reset, mailbox and files handed to a manager, and the licence reclaimed.

Contractors and temporary staff. Accounts with an end date set at creation.

What we watch each week

• Device compliance: devices that missed updates, lost encryption or haven’t checked in.
• Sign-in alerts for accounts without multi-factor authentication or with risky activity, where your licence provides them.
• Licence use: unassigned, unused or mismatched licences.
• Admin roles: anyone who gained administrator rights since the last review.

Findings are fixed directly where they’re within the agreed scope, or raised with you where they need a decision.

Most of the value comes from consistency rather than any single task. When every leaver is handled the same way on the same day, you can answer an auditor, a funder or a former employee’s question about access with a record, not a guess. When every starter in a role gets the same setup, support requests drop because there are fewer one-off configurations to troubleshoot.

What the work involves

1. Agree checklists for each role and the request route from HR and managers.
2. Take stock: accounts, licences, devices and admin roles, and clean up what’s out of date.
3. Run the routine: requests handled within agreed times, with weekly compliance review.
4. Report monthly on changes, compliance and licence use.
5. Review quarterly with you, adjusting checklists and policies as the organisation changes.

What’s included and what’s not

Typical timelines and what drives cost

The initial stock-take and clean-up typically takes two to three days. After that, the service is a recurring fee driven by user and device count, how often staff join and leave, the number of sites, agreed response times and whether device collection and setup on site are included.

Equipment typically used

The Microsoft 365, Entra and Intune admin centres, Autopilot for new laptops, and compliance and licence reports from those tools. A simple request form or ticketing route for HR and managers, so every change is requested and recorded the same way.

Common mistakes we see

Leavers’ accounts disabled weeks late, or never. Starters waiting days for access. Movers keeping every permission they ever had. Licences paid for people who left a year ago. Compliance reports generated but never read. And no record of who asked for which change.