Things I built and what came of them. Each has a short write-up.
A monthly report that tells each country which seats it can reclaim, and shows the evidence behind every verdict. It began with what looked like the easiest saving of the year (around 40% of Visio and Planner seats apparently unused) and turned into a lesson about what a report should do when a data source quietly returns nothing.
Every mature tenant carries hundreds of app registrations whose secrets and certificates expire without warning. The alerting is the easy part. The hard parts are working out who owns each application and notifying only about credentials that are actually in use, so the owner hears first, in language they understand.
A monthly audit report of every privileged account in Entra ID and in Active Directory, with what changed since the last one. Two automations, one report, sent encrypted to the people who need to read it, and a pattern small enough to copy in a week.
Phishing and impersonation were reaching inboxes, so the company put a dedicated gateway in front of Exchange Online. Changing an MX record takes five minutes. The three inventories that have to exist before anyone touches it took months, and they are the part worth writing down while the migration is still under way.
Entra ID → Event Hubs → Stream Analytics → CrowdStrike NG-SIEM, with Azure Automation keeping the user-to-country lookup fresh. Beyond filtering: each country becomes a measurable unit, with its own events, volumes and security metrics.
The security operations centre detects and analyses; the Workplace team has the hands on the devices. Without an agreed process between the two, every alert was a conversation. With one, it became a playbook, and playbooks can be automated.
At a business school where a lecture cannot stop because a PC asks for a password, every kind of device got its own enrollment profile, baseline and slice of the application catalogue. Onboarding became a matter of picking the right profile.
Intune device management depends on seven external certificates, tokens and connectors, each with its own expiry and failure mode. Miss the APNs renewal window and every iOS device has to be re-enrolled by hand. Two Logic Apps recurrences check all seven against Microsoft Graph and alert 30 days ahead, with the values and the console link needed to act on it.
In Intune there is almost always more than one way to reach a result, and the documentation stops short of telling you which to pick. A design that stays maintainable as the tenant grows: how to structure groups and assignments, which targeting method to use where, and how to decide when change is allowed to land.
A recurring question in device management: why does the inventory never quite match reality? Because one physical endpoint can exist as several objects across Entra ID and Intune, and nothing cleans that up by itself. Three automations keep it honest.
Network access control sounds like a product you switch on. It is actually two teams meeting at one interface (a certificate carrying the Intune Device ID and a Graph query) plus a set of questions about your own maturity that decide whether the project should run at all.