04 · Cloud, Identity & Endpoint — Microsoft 365, Entra, Intune, Azure
The domain, extended into the cloud.
The same domain extended into Microsoft's cloud: hybrid identity, conditional access, compliance, zero-touch device provisioning, and Azure infrastructure.
Hybrid identity 6
- Microsoft Entra ConnectPassword hash sync plus Exchange hybrid attributes from a dedicated sync server; OU filtering to drop health mailboxes; a documented workaround for the wizard's browser-MFA block.
- Duplicate-attribute cleanup with Microsoft GraphPowerShell 7 + Graph SDK script that finds cloud-only objects sharing an ImmutableId with synced ones and removes only the duplicates.
- Conditional AccessMFA enforcement and country-based blocking; report-only first, then enforced.
- Self-service password reset with writebackSSPR enabled and password writeback configured so a cloud reset lands in on-premises AD.
- Group-based licensingLicences assigned to security groups so membership, not a person, decides who gets what.
- SSO sign-in on a Windows 11 VMOutlook, OneDrive and Teams signed in through the organisation account on a fresh VM — the end-user view of everything above.
Microsoft 365 administration & compliance 6
- Data Loss PreventionPurview DLP policies over Exchange, SharePoint, OneDrive and Teams for financial and personal data types.
- Retention policiesKeep-or-delete rules by age across mail, files and chats.
- Litigation holdMailbox preservation regardless of what the user does, for as long as the hold stands.
- Email forwardingMailbox and transport-level forwarding, internal and external, with the admin controls that govern it.
- SharePoint sitesTeam and communication sites created and configured.
- Copilot agentA grounded Copilot agent — instructions plus an uploaded document — built as an interview coach.
Endpoint management 3
- Windows Autopilot with IntuneDevice group, deployment profile, Enrollment Status Page, required Microsoft 365 Apps, manual HWID registration — a device goes from box to signed-in without IT touching it.
- Google Chrome by IntuneThe GPO deployment, redone the cloud way: Chrome as a required app during provisioning.
- Windows 365 Cloud PCDesktop-as-a-service — a full Windows desktop streamed to any device.
Azure 2
- Point-to-Site VPNResource group, VNet and gateway subnet, VPN gateway, self-signed root and client certificates, a home PC reaching a VM by private address.
- Secure website on an Azure VMWindows Server 2022 VM, IIS site, DNS pointed at a static IP, and a free certificate from Win-ACME with HTTPS enforced.
Tenant names, domains and identities are deliberately absent from these pages.