Security & Compliance

Configured and deployed Conditional Access policies through Entra ID to enforce MFA via Microsoft Authenticator as a broker, which had been rolled out across all accounts as part of the broader cloud migration. Policies were scoped to separate corporate and personal device flows — BYOD devices are required to comply with App Protection Policies to access company resources, while Windows devices must meet a compliance policy baseline enforced through Intune before access is granted. Device filters were used to ensure the correct protection policy applied to each device context without conflict.

Built a full MAM architecture to protect corporate data on personal iOS devices without requiring full device enrollment. Enrollment restrictions were configured to block personal devices from enrolling into Intune while allowing corporate devices to enroll via Apple Business Manager (ADE). Two-tiered App Protection Policies were deployed — Level 1 for managed corporate devices with relaxed controls, and Level 2 for BYOD devices enforcing strict data transfer restrictions and encryption. Assignment filters were used to differentiate policy enforcement based on device management state, ensuring only one APP policy applied per device context. App Configuration Policies were also deployed to reinforce app identity and ensure correct MAM policy assignment through Intune MAM UPN and OID keys.

Configured Single Sign-On for Mimecast through Entra ID using SAML 2.0, setting up Mimecast as an Enterprise Application in the Azure portal and establishing the trust relationship between the identity provider and service provider. Prior to this, users were managing a separate set of Mimecast credentials entirely. After SSO was enabled, users authenticate to Mimecast through their Entra ID identity, eliminating credential sprawl, reducing the risk of weak or reused passwords on the email security platform, and removing IT overhead associated with Mimecast password resets.

Built an automated monitoring solution using Power Automate that runs weekly to detect any changes to Entra ID groups — including additions, deletions, and modifications. The flow establishes a baseline snapshot of all groups on first run, then compares the current state against that baseline every Friday. Any detected changes are logged and an alert email is sent to IT summarizing exactly what changed. The baseline is then updated automatically to reflect the new state, ensuring the next comparison is always accurate. This gives the team visibility into group membership drift that could indicate unauthorized access changes or misconfiguration — something that previously went completely undetected.