Platforms that run without drama.
Day-to-day administration and engineering across the platforms your organization actually works in — identity, Microsoft 365, endpoints, mail flow, and the automation that keeps them consistent. Hands-on delivery, documented well enough that your team can run it after I'm gone.
What I administer and build
Delivered as a scoped project, a remediation engagement, or ongoing administration and engineering support alongside an existing team or MSP.
Identity & Access Administration
Entra ID and hybrid AD, conditional access, MFA and passwordless rollout, SSO integrations, role and group design, and joiner-mover-leaver lifecycle. Plus the access reviews that catch the accounts nobody remembered to disable.
Microsoft 365 Administration
Exchange Online, SharePoint, OneDrive, and Teams governance. Tenant configuration, sharing and retention policies, mailbox and distribution management, and licensing reconciled against what people actually use rather than what was bought.
Endpoint & Device Management
Intune and MDM baselines, zero-touch provisioning, application packaging and deployment, patch rings, and configuration drift control. Fleet state should be a query you can run, not a spreadsheet somebody maintains by hand.
DNS, Mail Flow & Certificates
DNS zone design and cleanup, mail routing and authentication (SPF, DKIM, DMARC), connector and transport rules, and certificate lifecycle. The unglamorous records that quietly decide whether your mail is delivered or filed as spam.
Automation & Integration
PowerShell and Graph scripting, provisioning and offboarding workflows, SaaS-to-SaaS integration, scheduled reporting, and removing the manual steps from runbooks. Anything done monthly by hand is a candidate.
Backup, Recovery & Continuity
Backup design with immutable and offsite copies, documented restore procedures, and recovery tests that are actually performed. Recovery objectives defined against what the business can absorb, not what the software defaults to.
How the work gets done
Documented as built. Diagrams, runbooks, and an asset inventory delivered with the work — not promised afterward. Credentials go into your vault, in your tenant, under your control.
Change control, even when it's small. Maintenance window, rollback plan, and notice to whoever is affected. Most outages I get called about were an undocumented change made on a Friday afternoon.
Test the restore, not the backup. A backup job reporting success proves very little. I restore to an isolated target and time it, so your recovery objective is a measurement rather than an assumption.
Least privilege as the default. Standing admin rights get replaced with just-in-time elevation, service accounts get scoped and inventoried, and shared logins get eliminated rather than documented.
Boring and supportable beats clever. I build what your team — or the next consultant — can operate without me. Configuration lives in the platform's native tooling wherever possible, not in a bespoke layer only I understand.
Most engagements open with an assessment
A fixed-scope review of your tenant and environment — identity and access, licensing, endpoint and patch state, mail flow, and backup posture — delivered as a written report with a prioritized remediation plan. Useful on its own, and it means neither of us is guessing about scope before committing to the work.
