TECHNOLOGY · PRACTICE · EVIDENCE
My focus is Microsoft security engineering. This page separates demonstrated activity from areas I am still developing.
These are the tools and disciplines I work with or am learning. A technology listed here is not automatically proof of proficiency. Follow the linked cases to see the recorded checks and limitations.
Device enrollment, user-driven Windows Autopilot and MDM management.
User observed device management by Microsoft Intune; effective policy and ESP outcomes still pending.
Cloud device identity, sign-in and PRT validation in an authorized test environment.
AzureAdJoined = YES and AzureAdPrt = YES, user-observed on 3 November 2026.
Metadata inspection, corroboration of public clues and risk assessment.
7/7 OhSINT questions with coaching; precise limits of independent verification recorded.
Endpoint security controls, monitoring and investigation workflows.
Not yet presented as a completed validated Defender case.
Detection engineering, query validation and monitoring scenarios.
Practical detection implementation has not yet been demonstrated.
PowerShell, Microsoft Graph and repeatable reporting with least privilege.
No independently verified automation project published yet.