• Microsoft Entra ID: Conditional Access and PIM, tied together so access follows the role, not the person's mood that day
• Microsoft Intune: devices that are compliant without anyone noticing they are
• Microsoft Defender: catching the stuff Conditional Access didn't block
• PowerShell & Microsoft Graph: if I do it twice by hand, it becomes a script
• Azure Logic Apps: for whatever native Microsoft 365 just can't do on its own

• Building Zero Trust solutions that actually work in the real world: pros, cons, and lessons learned
• Exploring the balance between usability and security, because blocking everything isn't strategy 😉
• Moderator on the Microsoft EMS Discord, co-organizer of the Microsoft EMS Community Summit

Most of what I write about ends up running somewhere: a script, a module, a Logic App tucked into a client's tenant. These are the ones worth sharing publicly.

PIM Manager Open source dashboard for visualizing and managing Entra ID PIM assignments. Self-hosted by other organisations too, which still surprises me every time someone mentions it.

PIM Monitor My own interpretation of Enterprise Access Management model classifying Entra roles across control plane, management plane, and data plane. Built because I was tired of guessing which role belonged where, and so was everyone I asked.

IntoTheCloud Where the tools and scripts from actual client work land once they're clean enough to share. First up: a Logic App that tags PIM-eligible admins so Conditional Access can pull them out of standard end-user SSPR, because eligible isn't the same as harmless.

IntuneLaps PowerShell module that pulls the Intune LAPS username and password straight from the tenant. Small, does one thing, does it fast.

Helping teams get clarity, stay secure, and move fast, without vendor noise or buzzwords.

Let's connect if you care about Microsoft 365 security, real-life automation, and learning together.