Data Access Concierge

The last mile to data, automated. And every permission it gives, explained.

People ask for data where they found it. The request names the data and who approves. The owner decides in one screen. Access follows on its own, and ends on the agreed date.

No ticket, no chasing: once they ask, the owner’s yes is the only manual step. A service, not new software: we set it up in your systems and run it for you.

Book a demo See the price
Illustration with a fictional company. An Alation catalog page for the order_lines table. The person has no access yet. A Request access link on the page names the data it opens and who approves, beside the table's owner and steward.
Where it starts. The way to ask sits on the page where the data was found. Demo

Every screen on this page is a demo for Halvane Industries, a fictional company. The people and data on them are made up.

The last mile to data

Finding the data is the easy part. Getting access is where people get stuck.

Someone finds the data in the catalog, then has to work out who owns it, which approval it needs and where to ask. The request passes through a ticket queue, an approver who may not own the data, and an engineer who sets up the access by hand. The person asking follows up, then follows up again. And once access is granted, nobody writes down why, and nobody removes it.

What goes unansweredWhat it costs
Who do I ask?Finding the owner means asking around. The request often lands with someone who does not own the data.
What do I ask for?People file a ticket that says “I need sales data”, then wait while an engineer works out what to give them.
Where is my request?It sits in a queue nobody owns. The only way to move it is to chase it.
Who agreed, and why?The engineer who set up the access is on record. The person who should have decided, and the reason, usually are not. An auditor finds access nobody can explain.
When does it end?Never, unless someone remembers to remove it. Access outlives the project it was for.
Two people, one request

The person asking has nothing to chase. The owner has nothing to look up.

The person asking for data

An analyst, a planner, a data scientist. They found the data in the catalog and need it this week.

  • They ask where they found it. The way to ask sits on the catalog page, next to the data.
  • They don’t have to find the owner. The request already knows who decides and what the access covers.
  • They write the reason once, in their own words, and pick how long they need it.
  • Nothing to chase. The owner hears about it the moment they ask, and gets reminders if it waits. Once the owner says yes, nobody sets up the access by hand.

The data owner who decides

The person accountable for a data set. Often a business leader, not an engineer.

  • They don’t go looking. The request comes to them by email: who is asking, why, and for how long.
  • They see what they are opening before they say yes: what the data covers, and whether the person needs all of it.
  • They don’t have to remember to remove it. Every permission has an end date, and it ends on that date without anyone acting.
  • They check who still has access once a quarter, in a review we run with them.
How it works

Your people ask, the owner decides. The rest runs itself.

It runs on Microsoft Entra, the sign-in your people already use. Each set of data people ask for becomes one request form in Entra, which Entra calls an access package. Each one has an owner who approves, a required reason and an end date. When the owner says yes, Entra puts the person in a group, and your data platforms give that group read access.

1Ask

Request access on the catalog page opens the right request in Microsoft’s My Access, with the data and the approver already filled in.

2Explain

They write why they need it, say whether they need all the data it opens, and pick how long.

3Decide

The owner gets an email from Microsoft, opens My Access and says yes or no.

4Access

Entra adds them to the right group, and your data platforms let them in. Nobody sets it up by hand.

5End

On the end date, Entra takes them out of the group. Nobody has to remember.

Every permission it gives comes with a reason, the owner’s yes and an end date.

Entra writes down each request with its reason, each yes or no, and each removal, as it happens. A request nobody answers expires, so nothing waits forever. Entra keeps that log for 30 days; to keep it longer, it goes to storage you own.

The demo, screen by screen

One request, from first click to first query

Halvane Industries is a fictional company. Thomas Hughes, a demand planner there, needs order history for a forecast. David Rodriguez owns the sales data. Six screens follow Thomas’s request from his first click to his first query. The seventh shows what the optional Data Control Tower adds.

Illustration with a fictional company. An Alation catalog page for order_lines. Thomas has no access yet. A Request access link on the page names the sales data it opens, the 15 tables it covers and who approves.
Thomas finds the data, and the way to ask for it, on the same page. The link names the data it opens, the other tables that come with it, and who approves. Why it matters: people ask for the right data the first time, by a name they recognise. Demo
Illustration with a fictional company. Microsoft My Access request form for the sales data: what it opens and the approver are filled in. Thomas writes a reason, picks 90 days and sees the end date.
The form already knows what he is asking for and who approves. Thomas writes why he needs it and picks how long. Why it matters: every permission starts with a reason and an end date. Demo
Illustration with a fictional company. Thomas's request history in My Access: waiting for the data owner, with the date he must decide by, then access approved and the date it ends.
The request waits for the owner, with a deadline. David has until the date shown to answer. Why it matters: a request nobody answers expires, so nothing sits in a queue forever. Demo
Illustration with a fictional company. Microsoft's approval email to the data owner: who asked, their reason, the data requested, for how long, and a button to approve or deny in My Access.
David gets the request in an email from Microsoft. Who asked, why, for how long, and a link to decide. Why it matters: the person who owns the data makes the call. Demo
Illustration with a fictional company. My Access approval screen: the requester and their manager, the sales data requested, the reason, what the access opens, the owner's comment, and the request approved.
David decides on one screen. He sees who is asking, why, exactly what the access opens, and whether Thomas needs all of it. Why it matters: every yes or no is on the record, with a name and a time. Demo
Illustration with a fictional company. A Microsoft email telling Thomas his request was approved, beside a Redshift query window where the query refused before approval now returns rows.
The query that was refused now runs. Entra has put Thomas in the group, and Redshift gives him the access when he next signs in. Microsoft can also email Thomas when he is approved; that email is off unless you turn it on. Why it matters: nobody sets up access by hand, and nobody has to remember to remove it. Demo
Optional add-on · sold separately

Pairs well with the Data Control Tower. A separate Data Meaning product, sold on its own, that lists every access change and who made it, across your data platforms. The Concierge works fully without it. See the Data Control Tower

Illustration with a fictional company. Data Control Tower Access page: an access change made through a request listed beside access given by hand on the platform.
With the Data Control Tower, you also see access given outside the process. It lists every access change and who made it, so access someone gave by hand sits beside Thomas’s approved request. Why it matters: you see which access followed the process and which did not. Demo
Where it runs

It runs in your own systems. It installs no software of ours.

There is nothing of ours to install. We switch on Microsoft’s own features in your Entra tenant, written as code your team can read, and set up the permissions on each data platform. When we finish, what runs is Microsoft Entra and your own data platforms.

Role design

Up to 10 roles, worked out with your data owners. Each covers one set of data, has one owner, and carries a name people recognise, like “Sales data: orders, pricing and pipeline”. Read access only; write access stays with your engineers.

Entra access packages

One per role. Each sets who approves, who may ask and how long access lasts. It asks for a reason, and whether the person needs all of it.

Platform connections

Databricks and Redshift linked to the Entra groups, with the permissions each role needs. We test each one end to end before go-live.

Catalog request link

A Request access link on each table page in Alation that opens the right request. Alation has no request button for tables, so the link sits in a custom field on the page.

Tests

A pass-or-fail checklist we run before go-live: a request, a yes, a no, a query that works, and access that ends. Your governance lead signs it off.

Handover

A plain-language guide for your governance lead, and a week of close support after go-live.

Your identity and security teams will askThe answer
What do you install?No software. We set up access packages, groups and policies in Entra as code your team can read (Terraform or Microsoft Graph), plus a permissions script for each platform.
Who can ask for access?Only people in a group you name. That group also sets how many ID Governance licenses you need.
How fast does access arrive?Databricks documents that it picks up a new member within about 5 to 40 minutes of their next activity. Redshift applies it at their next sign-in.
How fast does it end?On the end date, Entra takes the person out of the group. Databricks follows on the same timing. Redshift drops the role at their next sign-in. Amazon does not say when an open session loses it, so we test that in your setup.
How long is history kept?Entra keeps its audit log for 30 days on P1 and P2. To keep it longer, it is exported to Azure Monitor or a storage account you own.
Does the approver approve inside the email?Microsoft does not document that. Its email links to My Access, and the owner decides there, signed in with their work account.
What it costs

A fixed price to set up, and a capped monthly service

Setup

Designed, built, handed over

$28,405.50 one time
  • About 5 weeks, then 1 week of close support after go-live
  • Up to 10 roles, designed with your data owners
  • One Databricks metastore and one Redshift cluster, with Redshift signing in through Entra
  • The request forms in Entra, the permissions on each platform and the catalog links, all tested end to end before go-live
Year one

Service subscription

$1,250 a month from go-live
  • Up to 10 hours a month
  • Up to 2 role or dataset changes a month: a new role, a schema added, a new approver
  • A quarterly access review with your data owners
  • Fixes when access does not arrive or does not end
  • A monthly health check and a one-page summary
Every year after

Renewal

$15,000 a year
  • The same service, with the same 10-hour monthly cap
  • Role and dataset changes, quarterly reviews, fixes, health checks and the monthly summary

Work beyond the cap is $126 an hour, agreed with you before it starts. It is a service subscription, not a license: no Data Meaning software runs in your tenant. Not included: your Microsoft Entra licenses (P1 or P2, plus ID Governance) and the Data Control Tower, which is priced separately.

Is it a fit

What you need, and when it is not for you

You need

  • Microsoft Entra ID P1 or P2 in your tenant
  • Microsoft Entra ID Governance licenses for everyone allowed to ask, not only those who do. Naming a group of requesters keeps the count down
  • Databricks with Unity Catalog, identity-federated workspaces and automatic identity management, which is on by default for accounts created after August 1, 2025
  • Amazon Redshift provisioned clusters that sign people in through Entra, or can be set up to
  • Alation as your data catalog, for the Request access link on each table
  • A named owner for each set of data, and a short list of what people ask for most

It is not for you if

  • Your people do not sign in with Microsoft Entra. Every step runs on it
  • You cannot license ID Governance for everyone who should be able to ask
  • Your Redshift is Serverless, or people only query it in Query Editor v2. Ask us first: Entra’s direct sign-in is not confirmed there, so we would use AWS IAM Identity Center, quoted separately
  • You want masking or row-level filters. It gives and removes access; it does not change what that access shows
  • You want to find the access people already hold. That is what the Data Control Tower does
Questions

What leaders ask us first

We already have a data catalog.
Keep it. Your catalog is where people find data; this closes the gap between finding it and using it. We add a Request access link to each table it covers, and leave the rest of the catalog as it is.
Do we need the Data Control Tower too?
No. Data Access Concierge works on its own. The Data Control Tower is the optional companion: it reads your platforms’ own records every day and lists every access change with who made it, including access someone gave by hand.
Why pay for licenses for people who never ask?
That is Microsoft’s rule: ID Governance licenses must cover everyone who can ask, not only those who do. So we let a named group ask, rather than every employee, which keeps the count to the people who need it.
What if the data owner never answers?
The request expires after the time you set, for example 14 days, and Microsoft sends reminders before it does. Nobody gets access, and the person can ask again.
One request can open a lot of data. Does the owner know?
Yes. Each request is named for what it opens, its description lists the data, and the person asking must say whether they need all of it. The email shows the name; the full list and the answer are on the screen where the owner decides.
Why a monthly service? Just set it up.
Roles change, datasets are added and owners move on. The service makes those changes, runs the quarterly access review with your owners, fixes access that does not arrive or does not end, and reports each month. It is capped at 10 hours a month, so the cost is known.

Close the last mile on the data your people ask for most.

We’ll walk you through one request in a demo, from first click to first query. Then we’ll pick the data your people wait on most, and start there.

Book a demo

Data Meaning is an independent consultancy. Microsoft Entra, Amazon Redshift, AWS, Databricks and Alation are trademarks of their respective owners.