Hands-on work
Projects
Nine identity and Cloud Security labs, built from the ground up and documented the way I would document them on the job. Listed in the order I built them, starting with the Active Directory environment everything else builds on.
[project] 1 · Complete
Active Directory Lab
Built a production-style on-premises Active Directory environment from bare metal: domain controller, six-department OU structure, fifteen user accounts, and DNS, designed to sync cleanly into Microsoft Entra ID.
[project] 2 · In progress
Entra ID Lab
Extends the on-premises AD environment into a full hybrid identity setup: Conditional Access, Privileged Identity Management, and Identity Governance, mapped to Microsoft's SC-300 objectives.
[project] 3 · Complete
Enterprise SSO with Conditional Access
Connected Zendesk to Microsoft Entra ID over SAML and enforced MFA through Conditional Access, so authentication is centralized and access can be revoked in one place.
[project] 4 · Complete
Okta SSO with Zendesk
Configured SAML 2.0 single sign-on between Okta as the identity provider and Zendesk as the service provider, covering both SP-initiated and IdP-initiated login flows.
[project] 5 · Complete
Zendesk SCIM Provisioning
Automated user provisioning and deprovisioning between Microsoft Entra ID and Zendesk with SCIM, so accounts are created and suspended automatically instead of by hand.
[project] 6 · Complete
Okta SCIM Provisioning
Automated the same provisioning and deprovisioning lifecycle between Okta and Zendesk, including a real investigation into a SCIM read-only restriction on email updates.
[project] 7 · Complete
Wise API Integration Gateway
Built an internal payment gateway that wraps the Wise sandbox API behind Entra ID, Key Vault, and a Managed Identity with zero hardcoded credentials, then diagnosed four deliberately introduced failure scenarios end to end.
[project] 8 · Complete
Risk-Based Conditional Access with Identity Protection
Built a risk-based Conditional Access policy scoped to a pilot group, triggered a real anonymized-IP risk detection, and used Microsoft Graph PowerShell to investigate and remediate the flagged account, tracing why a dismissed risk still produced a second real block before finding the fix that actually worked.
[project] 9 · Complete
Entra ID as Code: Terraform + Drift Detection
Managed a real Conditional Access policy and security group as Terraform code instead of portal clicks, validated it in report-only mode against real sign-in log evidence, then proved an out-of-band manual change to the policy gets caught by terraform plan and reversed by terraform apply instead of silently drifting.