Set it up, run it,
and prove it

Sign up, name the organisation and set its email domain. The setup wizard takes you through workspace, team invitations and the first directory.

Add operators, approvers and an auditor. Roles are separated: the person who approves is never the person who applies.

Entra ID (app registration), Okta (API token) or Microsoft 365 Graph. Or skip for now and run cases in manual execution mode. Every step still gets a case and an audit entry.

Paste or upload a CSV and run it as a dry run first, post CSV to the HR feed endpoint, or pull from Workday (RaaS report) or BambooHR. Each run shows what would change before anything does.

Say what each role receives (groups, licences, mailbox, applications) so a joiner case can propose a complete, verified plan.

Open a new-hire case, review the proposed plan, apply it (directly, or as guided manual steps) and mark it complete.

Open the audit log, press Verify to re-compute the hash chain, and export the entries for the case you just ran.

An event arrives from your HR feed, the portal, email or a spreadsheet. Essentriq turns it into one case: what changes, in which systems, by when.

Connect the directory and HR source, set naming rules and attribute defaults, and define which profile each role receives.

Work the queue: review the proposed plan, apply it directly, through the agent, or as guided manual steps, then mark the case complete.

Every step is written to a hash-chained audit trail with who, what, when and the evidence attached.

Approval policies route each request to the right people (manager, application owner, data steward) with delegation and escalation built in.

Build catalog items and order guides, write approval policies as readable rules, and set automation rules for the cases that never need a human.

Approvers get a brief: what is being asked, why, what it grants and what is unusual. One tap to approve, reject or ask for more.

Decisions, the policy version that routed them and any exception granted are kept with the case.

Rotations, term dates and contract end dates drive access. Essentriq models each population separately so policy can differ for each.

Mark protected data systems, define loaner-device pools and set the profiles that each population receives.

Instructors, sponsors and third parties request through the portal; the service desk fulfils from the console with the same verified plan.

Access reviews certify that protected-data and time-boxed access still belongs to people who need it, on a schedule you set.

Posture compares what policy says should exist with what the directory actually holds, and surfaces the gap.

Set review cadence, retention and cleanup rules; connect the systems whose health you want watched.

Run reconciliation, resolve drift from the command stream and clear connector errors before they become incidents.

Export reports and audit packs that reference the chained log, verifiable by anyone with the hash.

Find and read users, group membership and licences; with directory write enabled: create users, update attributes and manager, add or remove group members, assign and remove licences, disable accounts and revoke sign-in sessions.

You provide: Tenant ID, client (application) ID and a client secret for an app registration with application permissions. Reads need User.Read.All; writes use the user, group-member, licence and sign-in-session endpoints. Grant the matching application permissions in your tenant.

Account creation, suspend and unsuspend, profile updates, group membership and session revocation through the Okta Management API.

You provide: Okta org URL and an SSWS API token for a dedicated service admin (Group Admin + User Admin is enough).

Mailboxes and licences through Microsoft Graph.

You provide: Tenant ID, app ID, client secret and scopes (application permissions use /.default).

Pulls worker records into HR sync; column aliases cover the common RaaS field names.

You provide: A RaaS report URL (an Advanced report enabled as a web service and shared with the integration user) plus the integration user and password.

Pulls a custom employee report (current and former employees) into HR sync.

You provide: Company subdomain and an API key.

Accepts a CSV POST from any system, so a payroll export or script can drive lifecycle events.

You provide: Nothing external. Essentriq issues a show-once bearer token; only its hash is stored.

Mirrors cases out as records with work notes and state, and accepts inbound requests so the service desk stays the front door.

You provide: Instance URL, integration user and password, and the table to write to (default sc_request).

Creates issues for cases, keeps them in step with case state, and accepts inbound requests.

You provide: Site URL, account email, API token and a project key.

Creates and updates requests for cases, optionally from a named request template.

You provide: On-premises: a technician API key with Requests add/edit permission. Cloud: Zoho client ID, client secret and refresh token (scope SDPOnDemand.requests.ALL).

Preview. The agent protocol (heartbeat, job claim, completion) is live; the connector test waits for an agent heartbeat and cases run as guided manual steps until an agent is connected.

You provide: An agent key from Settings → Connectors (Professional and Enterprise plans); the agent runs inside your network and reaches AD over LDAPS.

Connectivity check today; Exchange Online mailbox operations need the Graph connector and are coming soon.

You provide: Endpoint URL and a credential (UPN). Basic-auth probe only.

A change in someone's relationship with the organisation: joining, moving role, leaving, returning or working as a contractor. Each event opens a case in Essentriq with a plan of the access changes it implies.

The list of concrete changes Essentriq proposes for a case (create account, add to groups, assign licence, revoke access), checked against naming rules, policy and the live directory before anyone applies it.

Executing a verified plan from the console with each step confirmed against the target system and written to the audit trail as it happens.

A small service that will run inside your network and execute approved plans against on-premises Active Directory, so Essentriq never needs inbound access. The job queue, heartbeat, claim and completion endpoints (agent protocol v1) are in the product today, in preview; until an agent is online in your network, on-prem AD cases run as guided manual steps.

A difference between what policy says an identity should have and what the directory actually shows. For example, a leaver whose mailbox is still active.

A scheduled certification where owners confirm, one by one, that the people who hold access to a system still need it. Removals become cases automatically.

Every audit entry includes a hash of the previous one. Change or delete any record and the chain breaks, so auditors can verify nothing was altered after the fact.

A live read of the estate's health: drift, stale accounts, pending reviews, connector status and the trend over time.

For operators, auditors and workspace owners.

Request access, report an issue, approve or certify.

Create a workspace and connect a first source.

Every control, where it lives, and what is not in place yet.