Microsoft 365 and Entra ID administration for a multi‑country tenant.

Credential expiry notification for about 1,000 Entra ID app registrations

Problem

Client secrets and certificates on about 1,000 app registrations were expiring silently. An integration would stop working, a ticket would arrive days later, and nobody could say who owned the app or what it was for.

What I did

Inventoried every app and credential through Microsoft Graph and matched each credential against roughly a thousand sign-in records to separate "in use" from "forgotten". A Logic App now writes to the app owner at 30 and 7 days before expiry. Owners are mostly product owners, not engineers, and the raw configuration (permission scopes, redirect URIs, sign-in audience) does not tell them what will break. So the notice includes a plain-language summary of what the application does and what stops working if the credential lapses, generated by Azure OpenAI from configuration metadata only: permission names, redirect domains, whether the credential shows recent use. No secrets or tokens are sent; flags such as "involves user sign-in" are computed deterministically first, and the model returns strict JSON with a confidence score so low-confidence summaries are reviewed before sending. A companion script retires credentials expired for over 30 days; dry-run is the default.

Result

Owners receive a notice they can act on without a ticket to IT: renew, or confirm the app can be retired. The first clean-up pass found and retired around 60 credentials that had already expired, some by years.

• Microsoft Graph
• PowerShell
• Logic Apps
• Entra ID

Licence clean-up report: base licences and add-ons across 20+ countries

Problem

Base licences (F1, E3, Exchange Online) and paid add-ons (Copilot, Power BI Pro, Visio, Project, Planner) had been assigned over years and never reviewed. Country IT leads were asked to confirm who still needed what, with no data to answer. The add-ons alone came to about 900 seats, roughly €190,000 a year.

What I did

Built a per-country report that joins licence assignment, account liveness and per-app usage into four tiers — dormant, app unused, needs confirmation, keep — and carries a UsageSource column so "no usage recorded" is never mistaken for "no usage". Where Microsoft exposes no telemetry (desktop Visio and Project) I added an endpoint detector deployed through Intune. The clean-up script that follows is dry-run by default.

Result

Each country lead received one CSV and one figure per licence family. On the add-ons alone the report identified about 300 seats that can be reclaimed, roughly €60,000 a year, with the evidence for each seat on the same row.

• Microsoft Graph
• PowerShell
• Entra ID
• Intune

Read how this one went ↓

Email security gateway migration for about 43,000 mailboxes

Problem

After a run of phishing and impersonation attempts that reached inboxes, the company decided the native mail filtering was not enough on its own and chose to put a dedicated gateway in front of Exchange Online.

What I did

Ran the proof of concept, then the migration. Mapped every mailbox to its country so the cost could be charged back correctly, inventoried the 120-plus accepted domains that had to be onboarded, verified the TLS posture of more than 200 partner domains before the MX cut-over, and tuned policies against real traffic after go-live.

Result

Mail for about 43,000 mailboxes in over 40 countries now passes through the gateway. The chargeback mapping also surfaced close to 7,000 users with no attributable country — found before the invoice, not after it.

• Proofpoint
• Exchange Online
• Defender for Office 365
• Microsoft Graph