Skip to content2026
- Project4 min readCredential expiry monitoring for Entra ID app registrationsEvery mature tenant carries hundreds of app registrations whose secrets and certificates expire without warning. The alerting is the easy part. The hard parts are working out who owns each application and notifying only about credentials that are actually in use, so the owner hears first, in language they understand.
- Project2 min readDesigning on-premises and cloud audit reports for privileged accountsA monthly audit report of every privileged account in Entra ID and in Active Directory, with what changed since the last one. Two automations, one report, sent encrypted to the people who need to read it, and a pattern small enough to copy in a week.
- Project2 min readEntra ID audit logs to CrowdStrike SIEM, one stream per countryEntra ID → Event Hubs → Stream Analytics → CrowdStrike NG-SIEM, with Azure Automation keeping the user-to-country lookup fresh. Beyond filtering: each country becomes a measurable unit, with its own events, volumes and security metrics.