IT service & identity
Shipped · v1.3.2Identity Lifecycle
Joiners, movers and leavers — provisioned automatically.
Your MIS already knows who joined, moved and left. Keystone turns that into the right accounts, groups and licences across Microsoft Entra, Google Workspace and on-prem Active Directory — and tells you every time reality and the directory disagree. The job a dedicated provisioning tool does, built into the platform that already holds your people.
What Salamander and Ruler do — built in
Accounts that keep themselves honest.
Reconciliation dashboard
Audits your staff roster against Entra, Google and on-prem AD and flags the gaps that matter: leaver still enabled, joiner without an account, dormant logins, missing MFA, orphaned mailboxes, a licence still burning on someone who left.
Automated joiner-mover-leaver
Pre-provision a new starter's account, groups and licence by a configurable lead time; update membership when someone changes school; off-board a leaver in staged, reversible windows — disable, hide from the address list, archive — until you choose to lock it.
Safe by default
Every action runs as a dry-run first, with per-school and per-minute caps and a global kill-switch. Source-of-authority rules mean it never overwrites accounts owned by Entra Connect. You approve before anything is written.
Specification — everything else included
10 items · as of v1.3.2
No "coming soon" — every line below is in the product today. Tick it against your requirements spec.
- On-prem Active Directory agent — provisions AD accounts, groups, mailboxes and home directories in-network
- Inbound SCIM 2.0 server — be a SCIM target for Entra-driven provisioning
- Deterministic UPN / email / display-name mapping with automatic collision handling (j.smith → j.smith2)
- Group and licence assignment + removal across Entra and Google
- Mailbox lifecycle — hide from the address list, archive, on-prem Exchange support
- Staff photo sync from your MIS through to Entra and Google
- Mover reconciliation on a change of school or role
- Undo history and a validation dashboard for every action
- Per-school, per-person-type and per-directory enable / disable matrix
- Throttle-aware batching that respects Graph 429 / Retry-After
See it running
Real screens from the live demo.
Click any screen to view it full size, or try it live at staging.alresfordmat.uk. Module docs on the docs site.
Replaces Salamander / Ruler
The provisioning tool, without the second vendor.
Dedicated MIS-to-AD provisioning tools sit outside your operations stack and charge their own licence. Identity Lifecycle does the same joiner-mover-leaver automation — on the same platform that already holds your people, your SCR and your helpdesk, so there's nothing to sync between them.
See Identity Lifecycle running today.
Click around the live demo at staging.alresfordmat.uk — real product, synthetic data, no sign-up. Or get a 7-day private instance seeded with your academy structure.