01 Large-Scale OneDrive → SharePoint Migration
Lead Engineer Construction / Engineering Multi-week
End-to-end migration of project folders from individual staff OneDrives into centralised SharePoint document libraries, organised by project year code - consolidating data from multiple source accounts into a structured SharePoint site architecture.
Scope of work
- Migrated a large volume of project folders across hundreds of individual source directories
- Built custom PowerShell + Microsoft Graph scripts for folder detection, copy, permission replication and audit
- Designed and deployed a multi-site SharePoint architecture with consistent naming and permission structures
- Ran deep size/integrity audits (ULTIMATE_Audit.ps1) combining presence, size, permissions and child-count checks
- Resolved OneDrive sync path-length errors on Mac clients post-migration
- Delivered a client-facing PowerPoint, executive summary, and generalised guide with pricing framework
Microsoft Graph APIPowerShell (Graph SDK)SharePoint OnlineOneDrive for BusinessExchange Online
Outcome All target project folders migrated and verified. Post-migration audit confirmed data integrity. Client received a structured SharePoint environment replacing fragmented individual OneDrives.
02 Security Maturity Uplift - Defence Industry Compliance
Lead Engineer Defence-adjacent industry Multi-week
Led a full Defence Industry Security Programme (DISP) Maturity Level 2 uplift requiring alignment with Australian Government security requirements - live tenant auditing, gap analysis, and a comprehensive scope and budget document.
Scope of work
- Audited the live M365 tenant via PowerShell/Graph - Intune compliance, Defender config, Conditional Access, MFA registration, WDAC status, Office macro controls, SIEM readiness and AD server hardening
- Confirmed Defender for Endpoint Plan 2 active, an 18-rule ASR policy deployed, and OneDrive Known Folder Move active via ADMX
- Identified gaps: no SIEM, no PowerShell logging, no break-glass accounts, IE11 on the AD server, Process Creation auditing disabled, Conditional Access in report-only mode
- Ran a dedicated MFA audit covering all licensed users, with a number of service/shared accounts requiring exceptions
- Produced a colour-coded Excel audit workbook with live evidence mapped to DISP controls (green/amber/red)
- Produced a multi-version budget document (11 iterations) with accurate labour estimates and licensing costs
Graph PowerShell SDKEntra IDIntuneDefender for EndpointConditional AccessActive DirectoryPurview
Outcome Comprehensive audit workbook and scoped budget delivered. Labour scope: 141-207 hours. Findings and recommendations accepted by senior team for client presentation.
03 Single Sign-On Uplift - Multi-Application SAML Integration
Lead Engineer (scoping & budget) Resources & services Multi-week
Scoped and budgeted a SAML SSO uplift covering nine third-party business applications across two separate client Entra ID tenants - including vendor engagement, licensing analysis and a client-ready budget document.
Scope of work
- Assessed SSO support across nine SaaS platforms (project management, HR/payroll, ERP, construction safety, analytics, creative suite, transcription and more)
- Determined SAML vs OIDC protocol support per vendor through documentation review and direct vendor engagement
- Analysed Entra ID licence implications - Free supports SAML SSO, but P1 is required for group-based app assignment (a large number of manual assignments without uplift for one tenant)
- Confirmed active user counts per tenant via M365 Admin Centre CSV exports and Graph PowerShell
- Produced a multi-section budget document - executive summary, document control, tools-in-scope, assumptions, exclusions and next steps
- Multiple accuracy passes - removed fabricated vendor activation fees and softened unverifiable claims
Microsoft Entra IDSAML 2.0PowerShell (Graph SDK)Exchange OnlineM365 Admin Centre
Outcome Accurate, fully referenced budget document delivered for senior review. All figures traceable to confirmed sources and structured for direct client presentation.
04 Custom Microsoft 365 Write-Integration MCP Server
Developer / Solutions Engineer Professional services (small business) One day build · ongoing productisation
Built a custom Microsoft 365 write-integration for Claude Desktop after identifying that the standard Anthropic M365 connector is read-only by design - enabling Claude to create calendar events and send emails on behalf of client users within their tenant.
Scope of work
- Registered an Azure application in the client tenant with appropriate Graph API delegated permissions
- Deployed the open-source OutlookMCPServer on macOS and integrated it with Claude Desktop
- Diagnosed a macOS-specific auth failure - default TokenCachePersistenceOptions relies on the keychain, inaccessible when the MCP server runs as a Claude Desktop subprocess
- Rewrote settings.py to use MSAL SerializableTokenCache with a plain JSON file, bypassing the keychain
- Built a companion auth_test.py for one-time device-code authentication to seed the token cache
- Resolved Python version compatibility and confirmed the auth account must hold an Exchange Online licence
PythonMSALMicrosoft Graph APIEntra ID (App Registration)Claude Desktop (MCP)Exchange OnlinemacOS
Outcome Working demo delivered - Claude successfully creates calendar invites and sends emails within the client tenant. Deployment guide prepared; multi-user hosted version identified as a future productisation opportunity.
05 Cursor AI Editor Deployment via Microsoft Intune
Systems Administrator / Packaging Engineer Construction / Engineering Multi-day
End-to-end deployment of Cursor (an Electron/Squirrel-based AI code editor) via Intune - including diagnosis of CDN routing failures, MSIX repackaging, self-signed certificate deployment and WDAC policy integration.
Scope of work
- Diagnosed root cause of 0x87D30067 - Intune TrafficRoutingService pointing IME at a non-resolving CDN hostname; resolved by recreating the app object
- Determined Cursor’s Squirrel installer has no supported silent mode - resolved by MSIX repackaging
- Repackaged Cursor as a signed MSIX with a self-signed certificate (valid to 2027)
- Deployed the signing certificate via Intune trusted-certificate profile to TrustedPeople (deploying to Root caused 0x80073CF3)
- Created a WDAC supplemental policy with a publisher signer rule trusting the Cursor developer (Anysphere)
- Handled a follow-up repackage for a newer version after update prompts began blocking users; also deployed Python 3.x as a Win32 app
Microsoft IntuneMSIX Packaging ToolWDACEntra IDPowerShellWindows 11IntuneWinAppUtil
Outcome Cursor successfully deployed to all target devices. WDAC policy updated without breaking the existing security baseline. Certificate and signing infrastructure documented for future packaging work.