Now taking on 4 new clients this year — white-glove onboarding, month to month.Taking on 4 new clients this year
Request a call
Our core competency: layered defense, 24/7 monitoring, and a 100% ransomware recovery record.
Cybersecurity Services
Services
Hand NetSys your application stack and a role template for each position. Before a new hire's first day, their accounts and app permissions are in place and their password vault is waiting. The day someone leaves, we take the access back. We work in Microsoft 365 and in Google Workspace.
Password and permissions management means deciding who can sign in to each business application and what they can do there, and keeping shared passwords in a managed vault instead of a spreadsheet. NetSys runs it for you. You send us your application stack and a role template for each job, such as paralegal or project manager. We build that access in Microsoft 365 or Google Workspace, and shared passwords go into Keeper. New hires start with the right access, and people who leave lose it the same day.
Most onboarding goes wrong in small places. The new hire has email on day one but can't open the shared drive, and someone ends up texting them the password for the scheduling system. Leaving goes wrong the other way: the email account gets disabled while the project app and the vendor portal keep working for months.
NetSys takes that work off your plate. We document your application stack once and agree a role template with you for each position. After that, onboarding is one email to us with the new hire's role and start date. We handle the accounts, the licenses, the app invitations and the password vault, then confirm before the start date that everything works.
A role template is a short list your managers already know: which groups and shared folders a position needs, and which apps it uses, with the permission level in each. We turn each template into groups in Microsoft Entra ID or Google Workspace, so access follows the group. Apps that support single sign-on or automatic provisioning pick it up from there. For the rest we keep a written checklist and do the steps by hand, including the shared passwords the role gets in Keeper.
These are the applications we set up and manage permissions in most often. If your team runs something else, send us the list: any app with an admin console can go on a role template.
Microsoft 365
Google Workspace
Keeper
Salesforce
HubSpot
Slack
Zoom
Microsoft Power BI
Tableau
Looker
monday.com
Asana
Trello
Jira
Smartsheet
Mailchimp
Constant Contact
Wild Apricot
MindbodyProduct names and logos are trademarks of their respective owners. They identify applications NetSys administers for clients and do not imply a partnership or endorsement.
One email, and the new hire is ready on day one.
Access follows the group, whichever suite you run.
Shared passwords in a vault, not a spreadsheet.
Access stays current after day one.
We already manage passwords and permissions for clients across the country, in many industries. Each field runs its own mix of software. Here are five common apps in each, and what access control looks like there.
Document access often has to respect ethical walls between matters. We set permissions in the practice-management and document systems by role and by matter team, and keep those exclusions intact when people join or leave.
Clio
MyCase
NetDocuments
iManage
DocuSignHIPAA expects each person's access to patient information to match their job. We map front-desk and clinical roles to the EHR and patient-messaging apps, and keep a record of who could see what.
athenahealth
Tebra
SimplePractice
ModMed
WeaveSubcontractors and owner reps come and go with each project. We give each project team its access in the project-management and drawing apps, and close outside accounts when the job ends.
Procore
Autodesk Construction Cloud
Bluebeam
BuildertrendSmartsheetStore teams turn over quickly, and point-of-sale logins get shared. PCI DSS expects every person with access to have their own login, so we set up individual accounts and manager permissions, and remove them after an employee's last shift.
Shopify
Square
Lightspeed
Clover
QuickBooksConsultants move between client engagements, and client files should stay with the client team. We set CRM and file-sharing permissions by engagement, and give contractors access that ends on a set date.
HubSpot
Notion
Harvest
PandaDoc
BoxClient records carry obligations under SEC Regulation S-P, for fiduciaries of every size. We keep each advisor's and assistant's access in the CRM and custodian portals matched to their role, and change it the day that role changes.
Redtail CRM
Wealthbox
Orion
Schwab Advisor Services
Global RelayAgencies hold client social accounts and brand files, and freelancers rotate through. We manage seats and shared workspaces in the design and social tools, and keep client logins in Keeper instead of a shared document.
Adobe Creative Cloud
Canva
Figma
Hootsuite
SemrushNonprofits, fitness studios, accounting firms and schools each run their own stack. Send us your app list and a role you hire for often, and we will show you how it maps to a template.
Send us your app listFifteen minutes with a NetSys engineer, not a salesperson, and you will know where your password and permissions management stands and what it would take to fix it. Call 845-203-3914 or request a call to discuss the scope and next steps.
An example template for a paralegal at a small law firm. It is an illustration, not a client's configuration; yours lists the apps and permission levels your team actually uses.
| Access | Example: paralegal | How NetSys sets it up |
|---|---|---|
| Identity | Microsoft 365 account and license | Created in Entra ID from the template |
| Groups | Litigation team and all-staff | Opens the team's SharePoint site and shared mailbox |
| Practice management | Clio, standard user | Account created with the role the firm set for paralegals |
| Documents | NetDocuments, litigation workspaces | Access granted by matter team |
| E-signature | DocuSign sender | Seat assigned now, removed at offboarding |
| Shared passwords | Keeper, litigation shared folder | Records visible on the first day |
Every row comes back out when the person leaves, because the same template drives the offboarding checklist.
The role template is the same in either suite. What changes is where each piece of it is built:
| Microsoft 365 | Google Workspace | |
|---|---|---|
| Directory | Microsoft Entra ID | Google Workspace directory |
| Grouping people | Security and Microsoft 365 groups; dynamic groups need Entra ID P1 | Groups, with organizational units for settings |
| Shared files | SharePoint sites and Teams, with OneDrive sharing rules | Shared drives with Manager, Content manager, Contributor, Commenter and Viewer roles |
| Admin access | Entra ID and Microsoft 365 admin roles | Prebuilt and custom admin roles |
| Sign-in rules | Conditional Access with Entra ID P1, included in Business Premium | 2-Step Verification, plus context-aware access on the editions that include it |
| Other apps | Enterprise applications with SAML or OpenID Connect sign-in | SAML apps, with automatic provisioning for supported apps |
NetSys manages both suites. Clients who run both get one template per role.
Permissions management is the ongoing work of deciding who can reach each application and file, and at what level, then keeping that current as staff come and go. For a small business that usually means groups in Microsoft 365 or Google Workspace, plus the permission level each person holds in every business app. Shared passwords belong in a password manager, where they can be handed over and changed safely.
You send us the new hire's role and start date. We create the account from the matching role template, assign the license, add the person to the right groups, send the app invitations and share the Keeper folders the role uses. Before the start date we check that every sign-in works and send first-day instructions.
A role template lists what one position needs: the groups and shared folders it opens, and each application with its permission level, including the shared passwords the role uses in Keeper. You agree it with us once. Every new hire in that role starts with the same access, and when the template changes we update everyone in the role.
Yes. In Google Workspace we manage users, groups, shared drive roles and admin roles. In Microsoft 365 we manage Entra ID groups, SharePoint and Teams access, admin roles and Conditional Access policies. Some clients run both. The role template stays the same either way; only the place it is built changes.
We deploy Keeper. Each team gets shared folders, and admins enforce the master password and two-factor rules from one console. When someone leaves, their vault is transferred to a manager under Keeper's account transfer policy, and we change the shared passwords they knew.
The same day, we block sign-in and end active sessions, then remove the person from their groups and from every app on their template. Their email and files go to the manager you name, and the licenses come back to you. Shared passwords they knew are changed in Keeper.
Yes. Many business apps offer single sign-on or automatic provisioning only on higher-priced plans, and some offer neither. For those apps we add and remove users in the app's own admin console, following the role template, and keep any shared logins in Keeper. We tell you which of your apps fall into which group before anything changes.
Yes. Password and permissions management is done remotely, so it works wherever your team is. We manage passwords and permissions for clients across the country from our Brooklyn headquarters.
Privileged access management covers administrator and service accounts, the few logins that can change settings for everyone. Password and permissions management covers the everyday access of every employee. Most businesses need both, and we run them together.
Tell us which apps your team uses and a role you hire for often. We will draft that role template with you and walk through how onboarding and offboarding would run.