Architecture & Leadership Goal
Maintain a current Microsoft cloud environment that demonstrates not only administration skills but also the governance, architecture, security, and operating decisions required to lead modern workplace technology.
Governance & Architecture
- Identity and access through Microsoft 365 and Entra ID.
- SharePoint Online information architecture, permissions, governance, and modern collaboration design.
- Teams governance, operating standards, documentation, and repeatable configuration practices.
Hands-On Technical Work
- Microsoft 365 tenant administration, Entra ID, SharePoint Online, Teams, PnP PowerShell, security configuration, testing, and automation.
- Changes are treated as engineering work: define the objective, implement, validate, document, and preserve public-safe evidence.
What This Demonstrates
Modern workplace strategy supported by direct technical fluency in cloud administration, identity, governance, automation, collaboration architecture, and operational validation.
Detailed Project Scope
Develop a repeatable Microsoft cloud and endpoint-management demonstration that connects business access requirements with identity security, Windows Server and Active Directory, operating-system enrollment, device compliance, monitoring, recovery, and accountable administration. This page now owns the enterprise program continuation from CHG-016 through CHG-025; the Secure Infrastructure case study intentionally ends with CHG-015, the QNAP compute and application-platform milestone.
Technical approach and validation
The proposed laboratory will start with a safe tenant and licensed test identities, then work through identity roles, Windows Server interoperability, enrollment profiles, conditional access and endpoint defense. Each control will have a business reason, test scenario, expected result, rollback condition and sanitized evidence. Policies will be piloted with test accounts before any wider enforcement; actual licensing and device compatibility will be verified before implementation.
Planned Project Roadmap
Architecture Change Sequence — CHG-016 to CHG-025
The change identifiers below continue directly from the Secure Infrastructure roadmap. They are maintained here so the Microsoft and endpoint-management work can evolve without making the infrastructure case study appear unfinished after the QNAP milestone. All remain Planned until implementation and validation evidence are recorded.
| Change | Microsoft / Enterprise Workstream | Related Phase | Status |
|---|---|---|---|
| CHG-016 | Windows Server + Active Directory foundation | MS-03 | Planned |
| CHG-017 | Microsoft Entra ID / hybrid identity | MS-02 / MS-03 | Planned |
| CHG-018 | Intune endpoint management | MS-04 / MS-05 | Planned |
| CHG-019 | BYOD / MAM / Conditional Access | MS-06 | Planned |
| CHG-020 | Endpoint security baseline | MS-07 | Planned |
| CHG-021 | Guest + wireless access validation | MS-04 / MS-06 / MS-08 | Planned |
| CHG-022 | Central monitoring / logging | MS-02 / MS-07 / MS-08 | Planned |
| CHG-023 | Backup / recovery / UPS / restore testing | MS-08 | Planned |
| CHG-024 | Least-privilege policy and access cleanup | MS-02 / MS-06 / MS-07 | Planned |
| CHG-025 | Enterprise acceptance & disaster-recovery exercise | MS-08 | Planned |
All roadmap milestones below are Planned. Existing general Microsoft administration experience described above should not be interpreted as proof that these exact lab milestones have already passed.
MS-01 — Tenant and licensing baseline (Planned)
- Inventory available Microsoft 365 and Intune/Entra licenses against planned features
- Create a nonproduction test-user and administrator role matrix
- Document tenant-level security defaults, audit settings and recovery prerequisites
Expected deliverable: A versioned tenant inventory and test plan.
MS-02 — Entra ID identity and access (Planned)
- Define least-privilege administrator roles and emergency-access conditions
- Plan MFA and authentication-method registration for test identities
- Build an access-review and sign-in validation checklist
Expected deliverable: Identity matrix, configuration record and approved test cases.
MS-03 — Windows Server and hybrid identity (Planned)
- Map the on-premises lab AD design and DNS/network dependencies
- Select a supported hybrid identity synchronization approach for a test environment
- Specify sign-in, synchronization failure and rollback tests
Expected deliverable: Hybrid architecture diagram and validation plan.
MS-04 — Intune and device enrollment (Planned)
- Inventory one supported test device per intended operating system
- Design Windows enrollment and Autopilot evaluation where licensing allows
- Plan managed enrollment tests for macOS, iOS/iPadOS and Android
Expected deliverable: Device enrollment matrix and sanitized enrollment evidence.
MS-05 — Configuration and compliance (Planned)
- Draft baseline configuration and update policies for test devices
- Create device compliance decision rules and exception handling
- Validate healthy, noncompliant and lost-contact device behavior
Expected deliverable: Compliance test matrix and remediation runbook.
MS-06 — BYOD, MAM and Conditional Access (Planned)
- Define corporate-managed versus personal-device access scenarios
- Plan application protection and data-loss safeguards without requiring full BYOD enrollment
- Stage Conditional Access policies in report-only mode before enforcement
Expected deliverable: BYOD policy comparison and access decision log.
MS-07 — Endpoint security (Planned)
- Scope Microsoft Defender capabilities available in the licensed environment
- Draft endpoint hardening, encryption and risk-reporting tests
- Document alert triage, device isolation dependencies and rollback
Expected deliverable: Endpoint-security baseline and incident exercise.
MS-08 — Validation and operations (Planned)
- Capture redacted screenshots and repeatable configuration steps
- Create change log, operational SOPs and a least-privilege review cadence
- Cross-reference completed results to CHG-016 through CHG-025 as each program change is validated
Expected deliverable: Reviewed public-safe technical case study with dated evidence.
Project Updates
Update status: The new milestones listed above are planned. No completed milestone update is claimed by this section; dated progress notes will be added only when work has been verified.
Next planned update: Publish the approved tenant and licensing baseline, then start the first safely scoped Entra ID test.
Future entries will include a date, the milestone identifier, what was implemented or documented, sanitized validation evidence, lessons learned, and the next step.