Entra identity and admin roles
- Join
- Account and role
- Change
- Groups and access
- Share
- Guest and owner
- Leave
- Sign-in and sessions
Microsoft 365 administration · New Jersey
Microsoft 365 management for medical practices.
HealthDesk IT helps practices already using Microsoft 365 manage user access, Entra ID, Intune, mailboxes and shared resources as staff and devices change.
For an existing Microsoft 365 environment. Exact work depends on licensing, configuration, contracts and agreed scope. Migration projects and individual support issues have separate paths below.
Illustrative workflowAccess lifecycle desk
JOIN
New provider startsIdentity, license, mailbox, groups, device, and owner
MOVE
Role or location changesAccess, shared resources, device rules, and exceptions
SHARE
Team access changesMailbox, Teams, SharePoint, OneDrive, and guest paths
LEAVE
Staff member departsBlock access, preserve required content, reassign, and close
One change recordrequest → approval → action → validation → owner
Access Lifecycle Desk
Follow staff changes across Microsoft 365.
A staff change can affect identity, mail, collaboration and device access. Review the connected controls together and record who approves the result.
JOIN
Prepare access
Confirm role, start date, license, mailbox, groups, device path, shared resources, and approver before access is issued.
CHANGE
Adjust the role
Review what should be added, retained, or removed when a person changes location, duties, schedule, or device.
SHARE
Control collaboration
Keep mailboxes, Teams, SharePoint, OneDrive, guest access, and ownership aligned with the current business need.
LEAVE
Close the path
Block sign-in, review sessions and devices, preserve required content, reassign ownership, and document exceptions.
License, mail and collaboration
- Join
- License and mailbox
- Change
- Shared resources
- Share
- Permissions and links
- Leave
- Content and reassignment
Intune and device path
- Join
- Enrollment intent
- Change
- Policy and exception
- Share
- Access condition
- Leave
- Retire or preserve
The record is the handoff.Request, decision, affected controls, action, validation, exception, owner, and review date stay connected.
First review output
Start with a tenant operating record.
Identify the current setup, missing information, licensing dependencies and decision owners before approving changes.
A tenant review is not permission to change production. Discovery, approval, implementation, and validation remain distinct steps.
01
Administrator and identity map
Administrators, privileged roles, stale users, emergency access, MFA, groups and escalation owners.
02
License and service inventory
Assigned and unused licenses, feature dependencies, mailbox types and questions for Microsoft or your reseller.
03
Mail and collaboration ownership
Shared mailboxes, Teams, SharePoint, OneDrive, distribution, guests and content owners.
04
Device and Intune status
Device enrollment, platform limits, assigned policies and exceptions. Intune status is separate from regulatory compliance.
05
Prioritized change register
Access risks, support issues, licensing questions and staged changes, with approvers, validation checks and review dates.
Ongoing administration
Keep everyday administration traceable.
Keep Microsoft 365 administration and its records current. Wider infrastructure and recurring practice operations stay with the managed IT service.
People eventsJoiners, role and location changes, temporary access, departures, admin transitions, and content reassignment.
Shared resourcesMailbox access, distribution lists, Teams membership, SharePoint owners, guests and external sharing.
Device eventsDevice enrollment, replacement, retirement, policy assignments, exceptions and mobile access.
Tenant changesLicense changes, approved identity settings, service notices, vendor escalation, and documentation updates.
Shared responsibility
Name who approves each change.
HealthDesk manages only the agreed practice-side scope. Microsoft, licensing partners, practice leadership, and other specialists retain their own authority.
Owner
Owns or controls
Working boundary
Practice leadership
Business need, staff roles, approved access, risk decisions, exceptions, budget, data handling, and operational acceptance.
Decision authority
HealthDesk IT
Agreed discovery, tenant documentation, practice-side administration, staged changes, validation evidence, and vendor coordination.
Scoped administration
Microsoft or licensing partner
Platform availability, product behavior, service limits, licensing terms, vendor-controlled remediation, and contracted support.
Platform and contract
Compliance, legal, or clinical owner
Formal risk analysis, legal conclusions, policy approval, regulatory interpretation, retention decisions, and clinical workflow authority.
Specialist decision
Microsoft 365 features, a Microsoft BAA, MFA, Conditional Access, or an Intune device status do not by themselves establish HIPAA compliance. Applicability and required safeguards depend on the practice's facts, policies, configuration, contracts, and risk analysis.
Change safety
Make sensitive changes in stages.
Protect administrator access, confirm licensing and recovery options, then validate the agreed result. Changes to identity, mail and devices can interrupt practice work.
01Observe and documentRead the current state, dependencies, affected users, licenses, owners, and exceptions before changing production.
02Define approval and rollbackName the decision owner, timing, expected result, communication path, access safeguard, and recovery choice.
03Test where the feature allowsUse supported report-only, pilot, limited-assignment, or staged methods when they fit the change and license.
04Apply the bounded changeTouch only the approved identities, groups, mailboxes, sites, policies, devices, or administrators in scope.
05Validate and hand offConfirm the agreed user and administrator result, record exceptions, communicate ownership, and set the next review date.
Use the owner that matches the need
Find the right support for your situation.
Use the service that matches the decision or work you need.
Existing tenant management
User access, licenses, mailboxes, collaboration and devices in an existing environment.
Migration and cutover
Move email, files or users into Microsoft 365 through a planned project.
IT support
Resolve an individual Outlook, password, sign-in, sync or workstation issue.
Managed IT services
Coordinate recurring support across the wider practice environment.
Healthcare cybersecurity
Review preventive controls across identity, email, devices and remote access.
Compliance support
Review risk-analysis questions, safeguard evidence and specialist decisions.
Prepare before the review Work through the Microsoft 365 security checklist, save the healthcare phishing response guide, and use the HIPAA email setup guide to identify administrator, MFA, mailbox, encryption, and response decisions that need an owner.
Microsoft 365 management questions
Microsoft 365 management questions.
Is this page for a new Microsoft 365 migration?
No. This page is primarily for a tenant already in use. A new email, file, or identity move belongs to the cloud migration service.
Can HealthDesk help with an inherited or undocumented tenant?
Yes, within an agreed scope. The first review can organize administrators, identities, licenses, mailboxes, collaboration, device status, open risks, and ownership questions.
Do you work with Entra ID and Intune?
Yes. Work can include identity, MFA, administrator roles, Conditional Access questions, enrollment, and device-policy administration when supported by the tenant, license, platform, and scope.
Is Intune compliance the same as HIPAA compliance?
No. Intune compliance means a managed device meets configured organizational rules. It is not a legal or regulatory conclusion and does not replace a fact-specific risk analysis.
Can this be a one-time cleanup?
Yes. We can scope a one-time cleanup or ongoing administration. If the work belongs with migration, managed IT, routine support or another specialist, we will identify that owner.
What should we send in the first request?
Share the broad concern, number of users or locations, tenant history, affected Microsoft 365 areas, timing, and the decision still open. Do not send PHI, passwords, tenant IDs, admin links, screenshots, or configuration exports.
Primary platform sources
How these sources limit the claims
Microsoft documents that Conditional Access capabilities and risk features vary by license, and that Intune device compliance evaluates configured device rules. HHS describes technical safeguards as technology together with policies and procedures. These sources do not endorse HealthDesk, prove a particular practice compliant, or replace Microsoft licensing terms, legal advice, or a formal risk analysis.
Microsoft 365 tenant management review
Discuss your Microsoft 365 needs.
Tell us about your Microsoft 365 environment, approximate users or devices, timing and the issue that needs an owner. We will confirm fit and the next step.
- Call: 732-362-4949
- Useful context: approximate users and locations, tenant history, affected services, current vendors, licensing questions, and timing
- Do not send: PHI, passwords, tenant IDs, admin links, screenshots, configuration exports, or access keys