Practical guides forarchitects

Enterprise M365 architecture, endpoint management, security baselines, and infrastructure automation. Deep dives with companion code you can use today.

Articles

Topics

20+

Years experience

Abstract geometric illustration of a row of four user identities, with an orange application identity above them linked to a gold crown privilege

5 November 2026·12 min read

The Global Admin You Did Not Hire

A ConnectWise app added itself to Global Administrator. Why a people-first review misses vendor service principals and Entra agent identities too.

The Global Admin You Did Not Hire

Abstract geometric illustration of a user identity linked to three cyan key credentials, with a fourth orange key being attached

2 November 2026·9 min read

Enrolment Is the New Perimeter

Attackers win the account when a credential is registered, and Microsoft's enrolment schedule gives them the pretext. Gate it before 1 February 2027.

Enrolment Is the New Perimeter

Abstract geometric illustration of a sign-in gate with a long dashed token line running far past it, one segment of the line glowing orange

2 November 2026·12 min read

Session, Not Sign-In: What MFA Leaves Unchecked

MFA and Conditional Access decide at sign-in; the token lives for hours or days. What CAE, token protection and revocation cover, and what they miss.

Session, Not Sign-In: What MFA Leaves Unchecked

Abstract geometric illustration of a directory synchronisation link between an on-premises forest and an Entra tenant, with one segment missing

12 October 2026·16 min read

Entra Connect Sync: Why Auto-Upgraded Servers Fail in April

Entra Connect Sync fails on 7 April 2027 unless it runs 2.6.84.0 or later with application-based authentication. Auto-upgrade does not set it.

Entra Connect Sync: Why Auto-Upgraded Servers Fail in April

Abstract geometric illustration of a passkey credential being registered against an Entra identity

1 October 2026·16 min read

Entra Passkey Migration: The Default Problem

On 1 September 2026 Entra put SMS and voice users into a passkey profile with attestation off. What it costs you, and the runbook change it forces.

Entra Passkey Migration: The Default Problem

All 23 articles

18 August 2026·38 min read

Entra ID Directory Enumeration: The Attack Map

A default member in Entra ID can enumerate the whole directory: every user, group, service principal and role assignment. The controls that narrow it.

microsoft-365entra-idsecuritygraph-apipowershellzero-trustconditional-access

29 July 2026·19 min read

Giving Claude a Second Brain

How I gave Claude persistent memory in Postgres: an MCP server with per-project isolation enforced by database roles, not application code.

aiclaudeknowledge-managementpostgresmcparchitecture

23 April 2026·16 min read

M365 Add-On Costs: Evaluation Framework

Control M365 add-on costs: a five-question framework for Intune Suite, Entra ID Governance, Copilot, and Purview, plus a PowerShell audit script.

microsoft-365licensingcost-optimisationintuneentra-idcopilotpurviewgovernancedefenderteams-premiumpowershellgraph-api

7 April 2026·13 min read

M365 Solution Architect: What the Role Does

What an M365 Solution Architect actually does: standards ownership, security architecture, licensing strategy, and delivery oversight. Beyond diagrams.

microsoft-365architecturegovernanceentra-idintuneautomationsecuritylicensing