Hands-on lab2025–2026
Modern Workplace Lab
Entra ID, Intune, Conditional Access and joiner-mover-leaver with Graph PowerShell, in one connected environment.
github.com/alexander-frank-identity/modern-workplace-labFreelance · Remote · DACH
Identity & Endpoint Management
I help companies control access to their business data: Microsoft Entra ID, Conditional Access, Intune and Okta.
Available nowCV (PDF)
- Microsoft Entra ID
- Intune
- Conditional Access
- Okta
- Microsoft Graph
- Android Enterprise
Identity-first
Only verified users and compliant devices get access to company resources.
Identity is the layer that connects users, applications and devices. When it is set up cleanly, the rest of the security architecture becomes something you can steer.
When it is not, you spend your time managing symptoms.
Starting point
Problems I solve
Most environments were not planned badly — they simply grew over years. These are the points where I usually start.
Identity environments that grew without a clear structure
Groups, roles and policies accumulated over years. Nobody can say any more which of them still does anything.
Active Directory and cloud identity side by side
Two directories, two truths. Synchronisation exists, but ownership of any given attribute is unclear.
Manual onboarding and offboarding
Every arrival is a checklist sent by email. Every departure is a hope that nobody skipped a step.
Inconsistently configured endpoints
Devices arrive from different sources with different baselines. Compliance is a claim, not a measurement.
Too many administrative permissions, too little control
Permanently assigned admin roles, grown historically, with no expiry, no approval and no audit trail.
No overview of who may access what
It can be answered, but only with several days of manual work, and with no guarantee of completeness.
Services
What I work with
Five areas, deliverable in clearly scoped packages. What I can do in each field is stated as a capability, not as a war story.
- 01
Identity & Access Management
The core: a directory structure you can explain, and access decisions you can retrace. From user and group structure through authentication methods to privileged roles.
In hybrid environments I work inside the existing synchronisation between Active Directory and Entra ID.
- 02
Endpoint Management
Devices are the second half of every access decision. Enrollment, baseline, compliance and apps across all four platforms, corporate-owned and personal alike.
- 03
Okta
Okta is my second platform in the workforce identity space. It makes sense where Okta is the leading directory, or runs alongside Entra ID.
- 04
Automation
Whatever is repeatable belongs in a script. Above all the lifecycle: joining, moving, leaving: traceable, logged and without forgotten steps.
- 05
Documentation and handover
The part that most often gets left behind in projects. An environment is only finished when somebody else can keep running it without me.
How I work
How a project runs with me
Four steps I go through in every package, whatever its size.
01 — Understand
Take stock of the identity, access and device environment. What exists, what simply grew, and what was actually intended.
02 — Design
A target picture that fits the organisation, and a route towards it that works while the business keeps running.
03 — Implement
Configure, automate, integrate, in clearly scoped packages rather than one big push.
04 — Hand over
Harden, document, hand over to operations. An environment the internal team can carry on by itself.
Work
Labs and projects
I build my identity practice in my own lab environments and document it publicly. What is a lab is labelled a lab here. What was a client project is labelled a client project.
Hands-on labAugust 2026
Okta: policies, delegated administration, SAML federation
Two of my own Okta orgs, alongside the passed performance exams.
github.com/alexander-frank-identity/modern-workplace-lab/tree/main/05-oktaClient project2024
Blank Baukompetenz — access migration and permission model
Took over a client after an access conflict with their previous provider, who refused them control over their own website. Domain transfer out of the old contract, migration to a system they could administer themselves, and a role and permission model (admin / editor) with defined areas of access. Outcome: full ownership with the client instead of dependency on an outside party.
Verified
I'm looking for scoped implementation work and collaboration with system integrators, MSPs and partners.
Okta Certified AdministratorOkta · September 2026
Okta Certified ProfessionalOkta · August 2026
Microsoft Certified: Identity and Access Administrator AssociateMicrosoft · July 2026
Microsoft 365 Certified: Endpoint Administrator AssociateMicrosoft · June 2026
Android Enterprise Certified ExpertGoogle · January 2026
Notes
Written up from practice
Concrete obstacles, concepts and decisions from my labs, in the form I would have wanted to read them myself.
- Entra ID
- MFA
- Temporary Access Pass
The unprotected path: enrollment and recovery
All the energy goes into strong authentication, while the way in and the way back stay open.
6 min read
- Conditional Access
- Intune
- Zero Trust
Conditional Access: device compliance as an access condition
Why endpoint management and identity are the same job, and how to roll out a policy without locking yourself out.
6 min read
- Identity lifecycle
- Entra ID
- Automation
What a joiner-mover-leaver process actually automates
Three events, three very different levels of difficulty, and why in practice it is almost always the same one that breaks.
6 min read
A question about identity or endpoint management?
Write me a line about what it is about. I usually reply within one working day.
info@alexander-frank.orgRemote, German business hours. Project-based, not employment. Available for new projects now.