Work

JML Lab: joiner/mover/leaver automation with Microsoft Graph PowerShell

The complete identity lifecycle in Microsoft Entra ID through the Graph PowerShell SDK: onboarding with user creation, group and licence assignment, department change, offboarding with disable and delete. Documented with scripts, screenshots from a real tenant and the obstacles that came up while building it.

• User creation, group membership and licence assignment as the joiner chain
• Attribute change on department switch as the mover
• Disable and delete as a two-stage leaver
• Eight documented scripts plus a cheat sheet

# fails
Update-MgUser -UserId $id -AccountEnabled $false

# correct
Update-MgUser -UserId $id -BodyParameter @{ AccountEnabled = $false }

Intune and Entra labs

Device enrollment and access control across all four platforms: Windows, macOS, Android and iOS. Compliance policies as a measurable condition, Conditional Access as the decision point on top of it, and BYOD through App Protection Policies where the device is not managed.

• Device enrollment for Windows, macOS, Android and iOS
• Compliance policies
• Conditional Access granting Microsoft 365 only to compliant devices
• BYOD through App Protection Policies (MAM)
• Android Enterprise enrollment

Write-up in progress

Blank Baukompetenz — access migration and permission model

Took over a client after an access conflict with their previous provider, who refused them control over their own website. Domain transfer out of the old contract, migration to a system they could administer themselves, and a role and permission model (admin / editor) with defined areas of access. Outcome: full ownership with the client instead of dependency on an outside party.

• Domain transfer out of the existing contractual relationship
• Migration to a system the client can administer themselves
• Role separation between administration and editorial staff
• All credentials returned to the client's own hands