How should construction access be managed? A construction company should give each employee, subcontractor, vendor, and guest the minimum access needed for a defined purpose and period. Access should be approved, assigned to a named person, reviewed during the relationship, and removed promptly when the work ends.

The process should cover Microsoft 365 as well as Procore, Bluebeam, Autodesk, AutoCAD, Vista Viewpoint, Sage HCM, hh2, HCSS, Revit, SketchUp, Trimble, ServiceTitan, BuildingConnected, and any other system the company uses.

Build access around roles

Start with common roles rather than deciding every request from scratch. Examples may include estimator, project manager, superintendent, accounting, payroll, executive, service technician, subcontractor, and external consultant.

For each role, document:

• Standard applications
• Typical permission level
• Who approves access
• Whether financial or employee information is involved
• Whether a company-managed device is required
• When access should be reviewed

Role templates speed up onboarding while leaving room for justified exceptions.

Use named accounts

Every user should have an individual account. Shared logins make it difficult to remove one person’s access, apply multi-factor authentication, or determine who viewed or changed information.

If a job site uses a shared device, employees should still sign in with named accounts when the application supports it.

Administrative privileges should be limited and separated from ordinary work.

Create an approval process

An access request should identify:

• The person receiving access
• The company they work for
• The project or business reason
• The specific system or location
• The permission level
• The approving owner
• The expected end date

Avoid requests such as “give them the same access as Alex.” That may reproduce old exceptions or excessive permissions.

Manage external access separately

Subcontractors and consultants may need plans, schedules, photos, bids, or collaboration spaces. They generally should not receive broad access to internal company information.

Use project-specific permissions, guest accounts, expiring links, or vendor features designed for external collaboration. Review how Procore, BuildingConnected, Autodesk, Microsoft Teams, SharePoint, Bluebeam, or another selected platform handles guests and external users.

Do not move sensitive project information into an unapproved personal file-sharing service for convenience.

Connect onboarding and offboarding

Onboarding should not be complete until the employee has working access and understands where information belongs.

Offboarding should include:

• Disable company accounts at the agreed time
• Revoke active sessions
• Recover computers, phones, tablets, keys, and access cards
• Transfer owned files and responsibilities
• Remove access to construction applications
• Change shared secrets that cannot yet be eliminated
• Review email forwarding and delegated access
• Inform relevant vendors and project owners

Temporary access should have an end date whenever possible.

Review access throughout the project

People change roles. Projects move from bidding to active construction and then closeout. Permissions that were appropriate six months ago may no longer be necessary.

Review:

• Guests and subcontractors
• Administrator accounts
• Financial and payroll access
• Inactive users
• Shared mailboxes and forwarding
• Project sites approaching closeout
• Accounts that do not use multi-factor authentication

The review should have a business owner who can decide whether access is still needed.

Frequently asked questions

When should subcontractor access expire?

Set expiration according to the work and contract. Review access at project milestones and remove it when the business need ends.

Who should approve access?

The system or information owner should approve the business need. IT should apply the access securely and consistently.

Is deleting an account always the right first step?

Not always. The company may need to preserve files, email, records, or audit information. Follow a documented offboarding and retention process before permanent deletion.

Learn More

SisAdmin helps construction companies standardize onboarding, offboarding, Microsoft 365 access, device management, and regular account reviews. Clear access rules protect information and make it easier for employees and partners to get the resources they actually need.