The licence report that said 500 seats were unused
A clean-up report for base licences and add-ons across 20+ countries. The first version found over 500 unused seats. It was wrong, and the fix is the interesting part.
Hey, I'm Enric Díaz
+15 years in IT. Microsoft 365 and identity engineer from Barcelona, Spain . I automate identity, licensing and mail flow for a tenant of about 40,000 users, and I like to see a dry run before any change.
Experience
2026 — Present
Microsoft 365 & Identity Engineer
Multinational group
Identity and collaboration for a tenant of about 40,000 users in more than 40 countries: Entra ID, licensing, Exchange Online and SharePoint. Automation in PowerShell, Microsoft Graph and Logic Apps.
2023 — 2026
Workplace Technical Lead
IESE Business School
Led the Workplace team and the endpoint estate: 2,000+ Windows, macOS, iOS and Android devices in Intune, with enrollment profiles redesigned per device role (staff, classrooms, Zoom Rooms, meeting rooms). Defender for Endpoint, CrowdStrike and Purview; the SOC-to-Workplace remediation process; vendors and licences.
2021 — 2023
Modern Workplace & Microsoft Mobility Consultant
Clevertask IT Solutions
Modern-workplace deployments and identity integration for several enterprise clients; tier-2 support in regulated environments (Active Directory, Microsoft 365, Citrix, SCCM, XenMobile).
2017 — 2021
L2 IT Technician & Asset Management Specialist
Accenture, for Almirall
Tier-2 support in a regulated pharmaceutical environment; CMDB and IT asset lifecycle, leading a small operational team; mobility and infrastructure projects.
Projects
Credentials that stopped expiring in silence
About a thousand app registrations, each with secrets and certificates that expired without warning. Now the owner hears first, in plain language, with enough context to decide.
Putting a gateway in front of 43,000 mailboxes
From proof of concept to production: an email security gateway in front of Exchange Online for about 43,000 mailboxes in more than 40 countries, without a single lost message.
Who can do damage here? A monthly answer, cloud and on-prem
One mail a month listing every privileged account in Entra ID and in Active Directory, and what changed since the last one. Two halves, two trust models, and the weaker one was in the cloud.
Sending each country’s sign-in logs to that country’s SIEM
In a group of 40-plus countries, each security team must see only its own events. Nothing in an Entra ID event says which country the user belongs to, so that has to come from the directory, and the directory does not always know.
Redesigning Intune enrollment for classrooms, Zoom Rooms and 2,000 laptops
At a business school where a lecture cannot stop because a PC asks for a password, every kind of device got its own enrollment profile, baseline and slice of the application catalogue. Onboarding became a matter of picking the right profile.
Turning SOC findings into a remediation process the Workplace team could run
The security operations centre detects and analyses; the Workplace team has the hands on the devices. Without an agreed process between the two, every alert was a conversation. With one, it became a playbook, and playbooks can be automated.
How my scripts are organised
Every script I write ends up in a catalogue organised by platform, not by project: a fix for Exchange lives next to the other Exchange scripts, whatever project needed it first. Two things are shared by all of them: a domain-to-country map, because six copies of it had drifted apart, and a paging helper for Graph, because three copies of that had too and only one got the bug fix.
The public version has 43 scripts across seven platforms, stripped of anything specific to one tenant. Every one that changes state says so, and none does anything without -Execute.
About me
Hi, I'm Enric Díaz. I started in IT at 15 and learnt the trade from the bottom: answering calls, managing inventory and doing on-site support, then systems administration, where I specialised in cloud and automation. I've led Workplace teams, and today I work on identity and collaboration in Microsoft 365 for a multinational.
Some results I'm proud of: a licence report that identified about €60,000 a year in reclaimable seats, with evidence for each one; moving the mail of roughly 43,000 mailboxes to a new security gateway without anyone noticing; and a notification system so that the credentials of close to a thousand applications never expire in silence again.
Short term, I want to keep growing my catalogue of scripts and automations so my effort goes into decisions that help the business rather than day-to-day operations. Medium term, I'd like to lead large IT teams.
Contact
Questions about identity, licensing or automation in Microsoft 365? Write to me.