The brief from a growing branch network
The client was a small to mid-sized business with teams working across Umhlanga and other South African locations, including managers, admin staff and field teams who all needed access to the same set of business apps. As the number of users grew, so did the admin work. Passwords were being shared in ways that made handovers messy, and access reviews took too long whenever someone changed role or left the business.
The brief was simple enough on paper: make access easier for staff, but tighter for management. They wanted one place to manage passwords, cleaner permissions by branch and role, and a process that could work for a team spread between offices and remote staff. They also needed it to be practical for people who are not technical, because if a system is awkward, staff will find workarounds.
What had to work in the real world
The main constraint was that the business could not pause operations while the access cleanup happened. People were using a mix of old and new systems, and some accounts were linked to shared logins that had to be moved carefully. There was also a need to support staff working from home, from branch offices and on mobile connections, so the setup had to be dependable on the kind of internet links many South African teams actually use.
We also had to keep the rollout neat for compliance and internal audit purposes. That meant clear permission mapping, traceable admin changes and a structure that made quarterly access reviews easier, not harder. With load-shedding, people often log in from different devices and times of day, so the process had to be simple enough that it would still get used consistently.
- Mixed user group: branch managers, office staff and remote users
- Need for role-based access and branch-level control
- Existing password habits that needed to be replaced without confusion
- Low tolerance for downtime during working hours
How we set up the access structure
We started with an initial security review to map the client’s current access points, shared passwords and admin accounts. From there, we designed a vault structure that separated branch access from company-wide tools, so each team could reach what they needed without seeing everything. This made it easier to apply the principle of least privilege without creating extra admin steps.
Next came SSO configuration for the key applications used by the business, followed by permission mapping for staff roles and branch groups. We aligned access by department and location, then cleaned up the old shared login habits by migrating passwords into managed vaults. The rollout included user onboarding training, admin training and a clear offboarding process so leavers could be removed quickly and properly.
- Initial Security Review completed first
- SSO configured for core applications
- Branch and role permissions mapped before rollout
- Password migration handled in stages to reduce disruption
- Quarterly access review process set up for ongoing control
Timeline and rollout in weeks
The project ran over four weeks from the first review to the point where the admin team could manage access comfortably on their own. Week one covered the security review and planning. Week two focused on vault structure design, permission mapping and SSO setup. Week three was used for password migration and staff onboarding sessions. Week four covered admin handover, offboarding workflow checks and a final access review dry run.
Because the client had more than one branch and a mix of user confidence levels, we kept the rollout paced and practical. We used short training sessions rather than one long workshop, and that worked better for actual uptake. People kept using the system after the first week, which is usually the real test.
What changed for the team
After the rollout, branch permissions were far easier to manage. Managers could see who had access to what, and the admin team no longer had to chase down old passwords every time someone changed role. The quarterly access review process also became much quicker, because the information was already organised by branch and permission level.
The business also saw less friction for staff. Logins were simpler, support requests dropped and new starters could be brought onto the system with less back-and-forth. For a multi branch team, that kind of control saves time every week, not just once a year. It also reduced the risk of someone keeping access longer than they should, which is where small admin gaps often turn into bigger problems.
- Cleaner branch-level access control
- Faster quarterly reviews
- Less password sharing across teams
- Quicker onboarding and offboarding
- Better visibility for admins and managers
What we would do again
If we were doing the same project again for another Umhlanga branch group or a business with a similar footprint in Johannesburg, Pretoria, Durban or Gqeberha, we would keep the same approach. Start with a proper review, map the permissions before changing accounts, then train users in small groups so the handover lands well. That order matters. Skip it and you usually end up fixing the same issue twice.
We would also keep the offboarding process tightly linked to the access review cycle. In a small business, staff changes can happen quickly, and a clean leaver process is one of the easiest ways to avoid access drift. A good setup should be easy to live with, not just secure on day one. That is where practical structure beats a fancy one every time.
Key facts
| Project | Umhlanga Branch Group |
|---|---|
| Client type | Multi-branch small business team |
| Location | Umhlanga, KwaZulu-Natal |
| Scope | Password management, SSO and access reviews |
| Timeline | 4 weeks |
| Support model | Remote onboarding and ongoing team support |
