Let your HR or payroll system run access.
Frost Eagle is a small identity team that automates how small and medium businesses in Australia and New Zealand set people up, move them and switch them off, straight from their HR or payroll system. It runs on Microsoft Entra ID Governance, an add-on to the Microsoft licences many businesses already have.
Where it usually goes wrong
In a lot of growing businesses, starters and leavers are handled by one or two people in IT, or by the managed service provider, working from emails and tickets. These are the places it tends to slip.
A new starter's first week
Someone starts on Monday and their account turns up on Wednesday, or it's there but half their apps aren't. They spend the week asking for access instead of getting on with the job.
Setting people up
The quickest way to set someone up is to copy a colleague with a similar job. The catch is that they get everything that colleague has picked up over the years as well, including things they shouldn't have.
When someone leaves
If HR doesn't tell IT, or tells them late, the account stays active. It's surprisingly common for a former employee's email and apps to keep working for weeks.
When someone asks
Auditors, insurers and larger clients want to know who can get into what, and who signed off on it. Pulling that together from old tickets and inboxes can take days.
The frustrating part is that your HR or payroll system usually has all of this already: who's starting, who's moving, who's leaving, and on what date. It just isn't connected to anything that grants access. We connect it, and automate everything that follows.
What gets automated
Once your HR or payroll data drives access, every step of a person's time with you is automated. Nobody has to remember to do any of it.
Before they start
Their account is created from the payroll record, with their role, site and manager worked out. The manager hears who is coming, and a ticket goes out for the laptop.
First day
The account switches on for their start date, the manager gets a one-time code to sign them in, and everything their role needs is already there.
Changing roles
A new title or site in payroll adds the new access and removes the old after a short handover. Anyone with manual work to do is told.
Leaving
On their last day access is removed and the account is switched off, with the mailbox kept for whoever takes over. Urgent exits run on demand.
All along
Extra access is requested and approved with an expiry date, reviewed regularly, and recorded, so the audit answer is always ready.
Getting your HR and payroll data in
Everything above starts with your people data. Where your HR or payroll system doesn't connect straight to Entra ID, or the data needs shaping first, we bring in an HR integration platform we've run in production, licensed through a partner.
It sits between your HR or payroll system and Entra ID and hands over a complete, consistent record every time. If your system already connects cleanly, you won't need it.
- Connects to your HR or payroll system
- Including HR and payroll systems that Entra ID has no built-in connector for.
- One clean copy of your people data
- Kept current, with a history of every change for when audit asks.
- Turns payroll data into roles and sites
- Job titles grouped into roles, location codes matched to real places.
- Handles the awkward cases
- Late starters, late terminations and rehires still get the right treatment.
How we run a project
Four stages, and you can stop after any of them. Open a stage for the detail.
1Readiness reviewA short report, a recommended design and a fixed quote.
We look at the four things that decide how big the job is: your HR and payroll data, your Active Directory if you still have one, your Microsoft 365 and Entra ID setup including licensing, and how people are set up and removed today. Most of the risk sits in that data, so that's where we spend the most time. You can stop here and keep the report.
2DesignA signed-off design, so scope and price are settled.
Together we decide what drives access, what people get automatically and what they ask for, when accounts are switched on and off, and how it connects to your other systems. Every decision is written down in plain language, along with the options we didn't take and why.
3Build and switch onJoiners, movers and leavers running automatically.
We build it alongside your current process and test it against your real HR and payroll data, not tidy samples. Nothing changes for your people until it's ready, and then we switch it on a group at a time so any surprises stay small.
4HandoverSomething your team can run without us.
Your IT team, or your managed service provider, gets clear documentation and a walk-through of how it all fits together. If you'd like us on call afterwards, we can agree that separately.
Recent work
With the names left out. The articles on this site come out of the same work.
Industrial business, Australia and New Zealand
Payroll-driven provisioning into Active Directory and Entra ID, automated joiners, movers and leavers, rule-based access, and ServiceNow integration.
Australian financial institution
Identity governance and privileged access designed together, from HR-driven provisioning through to BeyondTrust.
A university and a healthcare distributor
Privileged access management with BeyondTrust.
Who you'll work with
Lauren Battaglia
COO
Lauren leads Frost Eagle's operations and delivery, navigating the complexities of client environments so projects run smoothly from the first conversation to handover. She keeps scope, people and timelines aligned, making sure the technical work fits how each business actually operates.
David Gbuzue
CTO
David is an identity and security architect focused on making access simple, automatic and easy to defend. Specialising in Microsoft Entra ID Governance, HR-driven provisioning and privileged access, he designs and builds the systems that turn HR and payroll data into the right access, cutting manual effort and audit risk for the businesses he works with.
Start with a conversation
Tell us roughly how many people you have, which HR or payroll system you use, whether you still run Active Directory, and what's prompting you to look at this now.