How should construction firms give site staff and subcontractors access, and take it away again?

Why are joiners and leavers harder in construction?

A contractor has joiners and leavers every week. Site staff move between projects, agency labour comes and goes with the programme, and subcontractors need drawings and RAMS for one package, then nothing. The person who knows someone has left is usually on site, not in the office telling IT.

The result is access that never goes away: a subcontractor still in last year's tender folder, an ex-site manager's phone still syncing email, a shared "site1@" login half the workforce knows.

Think of it like the CSCS card check at the site gate. Nobody gets on site without showing a card that matches their role, and the card has an expiry date. Digital access should work the same way: the right level for the job, checked at the start, and an end date built in.

Which type of access does each person need?

Most construction firms need four types of access, not one. Microsoft's UK list prices below are per user per month, on an annual commitment paid yearly, excluding VAT, as shown on Microsoft's website in September 2026.

The Frontline plans are designed for people who work mainly on phones and tablets rather than at a desk, and they can sit in the same Microsoft 365 tenant as your Business Premium users. Check with your Microsoft partner that each person fits the Frontline use case before you buy.

Guest access is almost always right for subcontractors. Microsoft bills guests by monthly active users, and the first 50,000 a month are free (Microsoft Learn). The subcontractor signs in with their own company's account, so when their employee leaves, their own IT removes that login.

Agency workers are the grey area. If someone works for you for months and needs your email address, give them a proper account on the right licence, with an end date recorded on day one.

How do you give subcontractors access without losing control?

Set up one SharePoint site or Team per project, and invite subcontractors only to that one. Keep commercial folders, such as tender pricing and valuations, in a separate site that guests never see.

Then use the controls Microsoft 365 already includes:

Guest expiry. SharePoint can expire guest access automatically after a set number of days, with the person who shared it able to extend it (Microsoft Learn). Setting 90 days means a subcontractor who finished in spring doesn't still have the drawings in autumn.

MFA for guests. Business Premium includes conditional access (rules that control who can sign in, and how), so you can require guests to use multi-factor authentication, a second check when they sign in, before they reach your data.

Limit sharing by domain. Allow sharing only with your approved subcontractors' domains, so nobody accidentally shares a drawing register with a personal Gmail address.

A named sponsor. Every guest should have a project manager responsible for them. When the package finishes, the PM removes them.

Automated access reviews, which ask a manager each quarter to confirm every guest still needs access, need Microsoft Entra ID P2 or ID Governance, which Business Premium doesn't include. For most contractors, guest expiry plus a quarterly check of the guest list is enough.

How should shared site tablets work?

Shared tablets in the site cabin are normal. Shared logins shouldn't be: you can't enforce MFA or see who did what.

Intune supports shared device mode for Android and iOS/iPadOS devices. Each person signs in once at the start of their shift and gets single sign-on to Teams and other supported apps. At the end, one sign-out removes their account and data from the device, ready for the next person (Microsoft Learn). Each worker needs their own account, and an F1 or F3 licence is the cheap way to do that. Microsoft advises against kiosk-style shared logins precisely because they don't allow user auditing or MFA.

What should happen on someone's last day?

The aim is simple: when someone leaves, their access leaves with them, that day. Build it as a checklist the office runs the moment a leaver is confirmed.

1. Block sign-in and sign them out of all sessions. A sign-in can stay valid for up to an hour after a password reset, so ending sessions matters (Microsoft Learn).
2. Remove their MFA methods and any company apps on personal phones.
3. Wipe company data from company devices, or selectively wipe company apps on personal phones, through Intune. The device has to be online for the wipe to happen.
4. Keep the email. Convert the mailbox to a shared mailbox and move their OneDrive files to the project's SharePoint site, then remove the licence. Our article on cutting Microsoft 365 licence costs covers the detail.
5. Collect the kit and deal with the mobile. Get the phone and tablet back, and keep the business number on your account so customers and suppliers can still reach the site.
6. Change anything shared. Gate codes, site WiFi keys, plant hire portal logins and any shared passwords they knew.

Movers need the same thinking. When a site manager moves from one project to the next, remove their access to the old project's commercial folders, rather than letting access build up job after job.

Worked example: licensing a 120-person contractor

Example (an illustration with Microsoft's UK list prices, not a quote): a 120-person contractor has 40 office and management staff, 30 site supervisors, 50 operatives who need Teams and site forms, and about 25 subcontractor firms using project sites.

Matching the licence to the job saves about £1,006 a month, around £12,070 a year on list prices. More importantly, every person has their own account with MFA, and each shared tablet shows who used it. The trade-off: F3 and F1 users don't get desktop Office apps, so anyone who writes reports on a laptop belongs on Business Premium.

What we see

Cyber Essentials requires user accounts to be removed or disabled when they're no longer needed, so a clear joiners and leavers process is part of certification, not just good housekeeping. For a Central Scotland building firm of about 160 staff, Indigo rolled out Microsoft Intune across its devices, and the firm has since achieved Cyber Essentials Plus. Getting every device and account under central management is what makes a same-day leaver process possible.

How Indigo does this. Indigo Unified Communications is a Microsoft Solutions Partner for Modern Work with 100+ Microsoft 365 migrations completed. We set up project sites, guest access, Intune and shared device mode, and our Glasgow service desk runs joiner and leaver requests alongside everything else: 1,854 tickets in September 2026, with a 13-minute average first response. Our Platinum package includes Microsoft 365 Business Premium. IT support for construction →

What to do next

1. Export your user and guest lists from Microsoft 365 and mark everyone who has left or finished their package.
2. Group your people into office, site supervisor, operative and subcontractor, and check each has the right licence type.
3. Turn on SharePoint guest expiry and require MFA for guests.
4. Replace shared site logins with individual accounts and Intune shared device mode.
5. Write a one-page leaver checklist the office runs the same day, and read our construction guide chapter on Microsoft 365 for how to structure project sites.