Microsoft Intune, Azure, M365, endpoint management, application packaging, PowerShell scripts, Graph API, Power BI reporting, and enterprise cloud architecture.
65 posts
Follow one app from source to removal and see where security breaks: secrets in packages, fakeable detection, SYSTEM installs, writable folders and zombie apps.
Every ASR rule on at once: what lights up in audit, what breaks Office, PowerShell, developer machines and line-of-business apps, and how to reach Block safely.
What happens after the certificate lands: device vs user certificates, 802.1X, RADIUS and NPS, VPN authentication, EKUs, trust chains and troubleshooting.
Cloud PKI removes the on-premises CA, NDES and the connector. AD CS can issue to anything. A practical comparison, and a guide to choosing, combining or moving.
How a certificate gets from your Root CA onto an Intune-managed device: AD CS, templates, SCEP vs PKCS, NDES, the Certificate Connector, renewal and revocation.
Follow one request through DNS, CDN, WAF, load balancer, app, API, authentication, authorization and database, and the security controls that matter at each.
Step through a real login with SAML, OpenID Connect and OAuth 2.0, then compare them with Kerberos and certificate authentication, and learn which to use when.
What happens when a certificate expires, a device is deleted or a user leaves: renewal thresholds, failed renewals, revocation timing, CRL vs OCSP.
Client secret, certificate, API key, OAuth token, managed identity, workload identity or mTLS? A practical guide to how applications should prove who they are.
Deploying an app is the easy part. Protecting its data, configuring it on arrival, and retiring it cleanly is where most app management actually lives.
Fifteen named reports, the exact business question each one answers, and the data source, DAX, and visualization that actually deliver it.
Not another 'what is Power BI' post. The full journey from the Intune Data Warehouse to a published dashboard, with real entities, relationships, and DAX.
From a device coming out of the box to an application landing on it, in the actual sequence a real enterprise deployment runs, not five disconnected slides.
Not another dashboard. One governed model, one refresh strategy, one set of numbers everyone actually trusts, with three different reports built on top of it.
Not how many applications you have. Whether they actually reached the devices they were supposed to, and specifically why the ones that didn't, didn't.
Configuration Manager and Intune are two separate data sources, not one warehouse. Here's how to actually bring them together into a single, trustworthy dashboard.
AppLocker vs WDAC vs Intune App Control for Business: how allowlisting decides what runs, and a phased strategy to enforce it without breaking the fleet.
ASR rules don't detect malware, they block the specific techniques malware needs to work. Here's what each major rule actually stops, and how it fits into Intune's wider hardening toolkit.
Not how to turn BitLocker on. What actually happens, at the cryptographic level, between a laptop going missing and its data staying unreadable, or not.
Eleven stages, in the exact order they actually depend on each other, from a blank Windows machine to a fully hardened, Conditional-Access-protected endpoint.
Deploying every control at once produces chaos, not Zero Trust. Eight phases, in the order a real enterprise program actually runs them, with the pitfall at each one.
A device isn't just compliant or not. Follow the actual six-stage path a laptop's security state travels before it becomes an Allow or Block.
Ten real Conditional Access patterns explained through the actual scenario each one exists to stop, not just the settings screen you'd click through.
