Identity & Security

Microsoft 365 identity, standards, and automation

IT Director · National food brokerage

I designed the identity and administration standards behind a shared Microsoft 365 environment spanning a cloud-only Entra ID tenant and a separate local Active Directory domain. The documented design covered users, groups, administrative roles, applications, external identities, and licensing across Exchange Online, Teams, SharePoint, OneDrive, and Power Platform, and gave migrations, security reviews, and automation a common reference.

Naming and identity standards

I defined shared naming and user-attribute conventions across directory objects, computers, servers, and networks. Standardized regional values in user records drove dynamic groups, licensing, policy targeting, distribution lists, and printer assignment, and acquisition playbooks carried the conventions into inherited environments. The standards documented exceptions in inherited systems and older conventions.

• Devices: region, device type, and BIOS serial number for automatic naming at enrollment.
• Servers: business region and role; details such as OS version stayed in asset records.
• Groups: distinct conventions for on-premises, cloud, user, device, manual, and dynamic groups.
• Addressing: regional address blocks and purpose-based network segments.

PowerShell administration and reviews

I wrote an internal library using Microsoft Graph PowerShell, Exchange Online PowerShell, and SharePoint PnP for recurring administration and monthly reviews, with parameters, error handling, and structured logs. It covered:

• License usage, unused entitlements, mailbox capacity, and forwarding.
• SharePoint and OneDrive inventories, sharing, site collections, and hub sites.
• Audit searches, message tracing, application permissions, and identity checks.
• Teams, Intune, and security-configuration reporting.

Serverless Microsoft 365 usage reporting

I moved a monthly activity report from an on-premises scheduled task into an Azure Automation PowerShell runbook that gathered email, Teams, SharePoint, and OneDrive usage through Microsoft Graph for Client Services and Reconciliation staff. A system-assigned managed identity replaced stored application credentials, an Exchange application access policy restricted sending to the intended mailbox, and Automation variables held sender and recipient configuration. The report no longer depended on a maintained server.

Employee lifecycle and service catalog automation

IT Director · National food brokerage

I connected HR submissions to account setup, licensing, access, and equipment requests. Structured Freshservice forms, a Power Apps front end in Teams, Power Automate, and directory groups reduced provisioning from hours to minutes while retaining IT verification and approval.

Onboarding and the service catalog

HR supplied the employee's role, manager, start date, and regional information through the onboarding app. Automation created linked Freshservice tickets for account creation and individual tasks such as equipment and role-specific software. Standardized attributes and group membership then drove license assignment, dynamic distribution lists, Conditional Access scoping, and printer targeting.

Catalog items covered devices, account changes, groups, mailbox access, distribution lists, software, phone licensing, and policy exceptions, including a time-limited Conditional Access exception for international travel. Forms captured what each request needed before it reached a technician.

Offboarding

Documented departure procedures covered session revocation, licensing, group membership, mailbox delegation, OneDrive preservation, equipment return, and account deletion on the agreed schedule. Ordered and scheduled termination actions ran through the operations agent with explicit confirmation before changes, and staff reviewed each request and handled exceptions.

Centralized HRIS integration

The next stage was to replace inputs from separate regional HR platforms with one HRIS employee record feeding identity automation. I owned the attribute standards, SCIM configuration, acceptance-test plan, and vendor handoff package. The integration reached user acceptance testing before my departure; the existing lifecycle workflows were already operating in production.

Keeping the target attribute format consistent meant changing the HR source would not require rebuilding downstream access, license, or device rules. A related CRM notification flow remained a design for the subsequent rollout.

Identity, endpoint, and email security

IT Director · National food brokerage

I designed and operated security controls across identity, Windows endpoints, email, and business applications at a national food brokerage.

Identity and privileged access

I designed access around group and role membership, with department attributes driving dynamic groups and licensing. Entra administrative units gave regional IT scoped rights, including access to local-admin passwords for their own devices. I built Conditional Access policies for MFA, geographic access, known-bad sources, and sign-in and user risk, with time-limited exceptions for approved travel.

I built a cross-system view of access across Entra ID, the local RDS domain, and infrastructure tools with their own administrator accounts. I configured PIM, separated everyday and privileged identities, and documented emergency-access procedures. Windows LAPS managed local administrator credentials, and Admin by Request handled temporary elevation for approved work. That made privileged access reviewable across both directory services and the tools outside them.

Endpoint and email protection

I implemented Microsoft Defender across endpoints, Active Directory, and cloud applications alongside the existing endpoint-protection tooling, with Intune for device configuration and Action1 for third-party patching. Based on operational evidence, I redirected security-awareness training spend into Avanan email threat protection; fewer malicious messages reached inboxes, reducing the team's investigation work. Bitwarden supported shared-credential management.

Configuration assessment and monitoring

• Recurring Microsoft 365 reviews of sign-ins, mail flow, sharing, app permissions, licensing, and groups.
• Purple Knight reviews of Active Directory and Entra ID configuration.
• CISA ScubaGear baseline checks, supported by PowerShell and Microsoft Graph inventories.
• AdminDroid and Microsoft security tools for ongoing monitoring.

Inventories and review results were kept in version control with the operating documentation.

Response procedures and communication

I wrote and maintained procedures for evidence collection, scope assessment, containment, recovery, verification, and communication. I also ran security-awareness communications and presented Power BI reporting on training completion and simulation results.

Windows estate security and detection

IT Manager · Regional HVAC business

I strengthened identity, server, email, and endpoint protection for a regional business. I owned the configuration work, application testing, monitoring, documentation, and the security plan presented to ownership.

Identity, remote access, and servers

I deployed Duo for server logon and remote desktop through Group Policy, and built layered Entra Conditional Access policies for MFA, geographic access, administrative access, authentication registration, and risk, piloting each before enforcement. Self-service password reset included writeback. Separate admin identities and account lifecycle reviews backed the controls, and I simplified the published remote-access surface after reviewing internet-facing services.

• Server and domain-controller baselines through Group Policy.
• Windows LAPS, directory auditing, account lockout, and password-quality reviews.
• Stronger directory authentication and a review of privileged access.
• Staggered domain-controller patching to keep the directory available.
• Reviews of remote-management software, storage alerting, and recovery procedures.

Endpoint protection and application compatibility

I deployed Defender for Business across workstations and servers. Group Policy onboarded domain-joined devices, and Intune security settings management delivered antivirus, firewall, and attack surface reduction policies without Intune enrollment. Detection and response alerts opened service desk tickets automatically. I staged enforcement and used configuration history, process captures, and server logs to make targeted compatibility changes that kept protection in place without breaking the line-of-business application.

Email, detection, and risk decisions

I configured Exchange Online protection policies, forwarding controls, sending limits, and email authentication. Custom PRTG sensors and Windows event monitoring watched authentication patterns, privileged-group changes, service and scheduled-task creation, and audit-log changes, and a Microsoft Graph sensor added sign-in and identity-risk data. Correlating web and Windows authentication logs supported automated rate limiting for remote access.

A security register tied findings to completed changes or explicit risk decisions, and a costed plan helped ownership prioritize licensing and implementation. Investigation and recovery procedures were documented alongside guarded administrative scripts.