Licence usage report: one figure per country, evidence per seat
A monthly report that tells each country which base licences and add-ons it can reclaim, and why. Built so that a seat is only called unused when a source actually says so.
Projects
Things I built and what came of them. Each has a short write-up.
Credential expiry monitoring for Entra ID app registrations
Close to a thousand app registrations with secrets and certificates that expired without warning. The hard parts were finding who owned each one and notifying only about credentials actually in use; the result is that the owner hears first, in plain language.
Proofpoint in front of Exchange Online: cutting the risk of attack by email
Phishing and impersonation were reaching inboxes. I ran the evaluation and the migration that put Proofpoint in front of about 43,000 mailboxes in more than 25 countries, with no message lost on the way.
Designing on-premises and cloud audit reports for privileged accounts
A monthly audit report of every privileged account in Entra ID and in Active Directory, with what changed since the last one. Built as two automations with two different trust models.
Entra ID audit logs to CrowdStrike SIEM, one stream per country
Entra ID → Event Hubs → Stream Analytics → CrowdStrike NG-SIEM, with Azure Automation keeping the user-to-country lookup fresh. Beyond filtering: each country becomes a measurable unit, with its own events, volumes and security metrics.
Redesigning Intune enrollment for classrooms, meeting rooms and 2,000 staff laptops
At a business school where a lecture cannot stop because a PC asks for a password, every kind of device got its own enrollment profile, baseline and slice of the application catalogue. Onboarding became a matter of picking the right profile.
Turning SOC findings into a remediation process the Workplace team could run
The security operations centre detects and analyses; the Workplace team has the hands on the devices. Without an agreed process between the two, every alert was a conversation. With one, it became a playbook, and playbooks can be automated.