sbd.org.uk
All topics

Automation

Graph API, PowerShell, GitOps, configuration as code, and CI/CD pipelines.

15 articles

The Global Admin You Did Not Hire
·12 min read·Identity controls that move under you

The Global Admin You Did Not Hire

A ConnectWise app added itself to Global Administrator. Why a people-first review misses vendor service principals and Entra agent identities too.

microsoft-365entra-idsecurityidentityzero-trustpowershellgraph-api
Entra Connect Sync: Why Auto-Upgraded Servers Fail in April
·16 min read

Entra Connect Sync: Why Auto-Upgraded Servers Fail in April

Entra Connect Sync fails on 7 April 2027 unless it runs 2.6.84.0 or later with application-based authentication. Auto-upgrade does not set it.

microsoft-365entra-idsecurityconditional-accesspowershellgraph-apitenant-healthhybrid-identity
Entra ID Directory Enumeration: The Attack Map
·38 min read

Entra ID Directory Enumeration: The Attack Map

A default member in Entra ID can enumerate the whole directory: every user, group, service principal and role assignment. The controls that narrow it.

microsoft-365entra-idsecuritygraph-apipowershellzero-trustconditional-access
M365 Add-On Costs: Evaluation Framework
·16 min read

M365 Add-On Costs: Evaluation Framework

Control M365 add-on costs: a five-question framework for Intune Suite, Entra ID Governance, Copilot, and Purview, plus a PowerShell audit script.

microsoft-365licensingcost-optimisationintuneentra-idcopilotpurviewgovernancedefenderteams-premiumpowershellgraph-api
M365 Solution Architect: What the Role Does
·13 min read

M365 Solution Architect: What the Role Does

What an M365 Solution Architect actually does: standards ownership, security architecture, licensing strategy, and delivery oversight. Beyond diagrams.

microsoft-365architecturegovernanceentra-idintuneautomationsecuritylicensing
Intune Security Baselines vs CIS Benchmarks
·19 min read

Intune Security Baselines vs CIS Benchmarks

Compare Intune security baselines against CIS benchmarks with a PowerShell export-and-diff workflow: ASR deployment and deviation tracking included.

microsoft-365intunesecurityendpoint-managementpowershellgraph-apiwindows-security
Microsoft 365 E3 vs E5: Decision Framework
·15 min read

Microsoft 365 E3 vs E5: Decision Framework

M365 E3 vs E5 decision framework for architects: TCO breakpoints, cost comparison scripts, and the rule for when E5 actually beats E3 plus add-ons.

microsoft-365licensingcost-optimizationpowershellgraph-apientra-idsecuritygovernance
M365 Tenant Health: Why It's Probably a Mess
·11 min read

M365 Tenant Health: Why It's Probably a Mess

Microsoft 365 tenant health audit checklist: detect orphaned groups, expired app secrets, CA policy sprawl, and SharePoint chaos with Graph API scripts.

microsoft-365entra-idgovernancepowershellgraph-apiautomationtenant-healthconditional-access
Microsoft Graph API: Endpoints for Architects
·9 min read

Microsoft Graph API: Endpoints for Architects

Production-ready PowerShell scripts for M365 tenant assessment via Graph API: discovery, identity auditing, security posture, governance, licensing.

microsoft-365graph-apipowershellarchitectureentra-idsecurityautomation
The M365 Licensing Audit Nobody Wants to Do
·14 min read

The M365 Licensing Audit Nobody Wants to Do

Automated M365 licensing audit using Graph API and PowerShell: find unused Copilot seats and reclaim licences from disabled accounts still on E5.

microsoft-365graph-apipowershellazurelicensingautomationcost-optimization
Self-Maintaining Intune App Catalogue with AI
·12 min read·Practical AI for Endpoint Management

Self-Maintaining Intune App Catalogue with AI

How I built a self-maintaining Intune app catalogue: Graph API pulls inventory, AI classifies it, and surfaces your MSIX migration shortlist automatically.

windowsintuneaigraph-apipower-automatemsixautomation
Intune Endpoint Management: AI, APIs, Copilot
·15 min read·Windows Endpoint Management

Intune Endpoint Management: AI, APIs, Copilot

How AI changes Intune endpoint management: Copilot agents, API-driven policy configuration, and intelligent drift detection instead of manual clicks.

intuneaiautomationcopilotdevopsendpoint-managementagentic-aimicrosoft-graph-apidrift-detection
Application Packaging: Win32 vs MSIX vs Store
·12 min read·Windows Endpoint Management

Application Packaging: Win32 vs MSIX vs Store

Win32 vs MSIX vs Microsoft Store for Intune: a decision framework covering COM interoperability, kernel drivers, deployment rings, and MSIX App Attach.

windowsintunedevopsmsixapplication-packaging
Configuration as Code for Endpoint Management
·7 min read·Windows Endpoint Management

Configuration as Code for Endpoint Management

Configuration as Code for Intune with Microsoft365DSC: version control, drift detection, and automated deployment via Git, without becoming a developer.

intunegitopsdevopsmicrosoft365dscautomation
Windows Estate Standardisation: The Foundation
·8 min read·Windows Endpoint Management

Windows Estate Standardisation: The Foundation

How to build a repeatable, auditable Windows estate using Intune, Autopilot, and GitOps: the foundation for Zero Trust and Copilot-ready endpoints.

windowsintunegitopszero-trust

Get the next one by email

Long, specific write-ups on M365 architecture and security, worked out against real tenants rather than summarised from documentation. Sent rarely, and only when it is worth your time.