Burton and South Derbyshire College puts staff provisioning in HR's hands with ADManager Plus

Business challenges

• A fragile, decade-old provisioning tool: Staff accounts were created with an in-house tool built roughly ten years earlier, supplemented by VBScript. It was difficult to maintain and offered no structure around templates, rules, or delegation.
• Script-driven student lifecycle: Student account creation and offboarding depended entirely on separate scripts reading CSV exports from the college's management information system, EBS, with no orchestration or consistency between steps.
• Unscoped help desk access to Active Directory: The help desk had been given direct access to Active Directory Users and Computers for tasks such as password resets, with little controlled delegation and no meaningful audit trail.

The problem

A further education college lives with a constant flow of staff joiners, movers, and leavers alongside a large student population that turns over every academic year. At BSDC, the tooling behind that lifecycle had not kept pace. Staff provisioning ran through a legacy user creation tool written in-house about a decade earlier, patched together with VBScript. It worked, but it was fragile, hard to maintain, and gave the IT team no way to express templates, rules, or delegation.

Student accounts were handled separately again, by scripts that read CSV exports generated from the college's EBS management information system, both for creating accounts at enrolment and for disabling them on withdrawal. And because the help desk needed to reset passwords for staff and students, its staff had been granted broad, direct access to Active Directory Users and Computers, far more than the task required and with no scoped boundaries or record of what had been done.

The solution

ADManager Plus was already part of BSDC's ManageEngine deployment when the IT team set out to formalise its identity management processes. Rather than procure new tooling, the team chose to maximise what it already owned, working with ManageEngine's Customer Success team through a structured health check and utilisation review in August 2026 to validate the deployment and shape its configuration.

The primary use case is staff account provisioning, and it now sits with HR rather than IT. The college's HR team, known internally as PMP, logs in to ADManager Plus with its own credentials and provisions new starters through a dedicated creation template. Behind that template sit approximately 50 creation rules that determine Microsoft 365 licence assignments (A1 or A3), group memberships, and department-based configuration, all triggered automatically according to the contract type and department HR selects. The IT team has been removed from the day-to-day mechanics of staff provisioning, which now happens directly and safely in HR's hands.

Help desk access has been rebuilt on the same principle. The broad Active Directory Users and Computers permissions have been replaced with a scoped, delegated ADManager Plus account that limits the help desk to the tasks it needs, primarily password resets for staff and students. Risk has been reduced without removing capability, and the IT team has confidence that delegated actions stay within defined boundaries.

For learners, the college has configured ADManager Plus automations to handle withdrawals. When a withdrawal is processed during the academic year, a CSV export is generated and the automation picks it up to disable the relevant account, cutting manual effort and bringing consistency to offboarding. Event-driven automations and orchestration templates extend the same approach to other lifecycle steps, such as moving staff from a "pending" status to active once HR enablement is complete, reducing the number of manual touchpoints in standard account tasks.

Because ADManager Plus is integrated with Microsoft 365, licence assignments and group memberships are managed inside the same provisioning workflow rather than as a separate step afterwards.

ADManager Plus has significantly matured BSDC's approach to identity management, replacing a decade-old legacy tool with a structured, template-driven, delegated provisioning framework used daily by both IT and HR. For a team managing a constant flow of staff changes alongside a large student population, the product has reduced manual effort, introduced consistent processes, and given the college far tighter control over delegated access.

About ADManager Plus

ADManager Plus is an identity governance and administration (IGA) solution that simplifies identity management, ensures security, and improves compliance. With ADManager Plus, manage the user life cycle from provisioning to deprovisioning, run access certification campaigns, orchestrate identity management across enterprise applications, and protect data on your enterprise platforms with regular backups. Use over 200 reports to gain valuable insights into identities and their access rights. Improve the efficiency of your IGA operations with workflows, automations, and role-based access control policies. ADManager Plus' Android and iOS applications help with on-the-go AD and Azure AD management. For more information about ADManager Plus, visit https://www.manageengine.com/products/ad-manager/.