Projects

Selected work.

Selected projects delivered at a Sydney-based MSP - Microsoft 365 and mailbox migrations, security compliance, endpoint management, networking and automation. Client names and identifying details have been removed.

01 2026

OneDrive → SharePoint Migration

Lead Engineer Construction & infrastructure advisory Multi-week

Migrated 1,270+ project folders (~475 GB) from individual staff OneDrives into 14 SharePoint sites organised by project year - replacing fragmented personal storage with a structured SharePoint site architecture.

Scope of work
  • Built custom PowerShell + Microsoft Graph scripts for folder detection, copy, permission replication and audit
  • Designed and deployed a multi-site SharePoint architecture with consistent naming and permission structures
  • Built a combined integrity audit that checked every migrated folder against its source for presence, size, permissions and item count
  • Resolved OneDrive sync path-length errors on Mac clients post-migration
  • Delivered a client-facing PowerPoint, executive summary, and generalised delivery guide for future migrations

Tech Microsoft Graph API / PowerShell (Graph SDK) / SharePoint Online / OneDrive for Business / Exchange Online

Outcome

All target project folders migrated and verified. Post-migration audit confirmed data integrity. Client received a structured SharePoint environment replacing fragmented individual OneDrives.

02 2026

Large Mailbox Migration via Microsoft Graph

Engineer (sole) Facilities & construction services

Consolidated a contract-specific helpdesk mailbox - about 31,000 messages in 477 nested folders - into a client's maintenance shared mailbox with the folder tree intact. Built a two-stage export and import pipeline on Microsoft Graph and engineered it to reach 100% despite heavy throttling.

Scope of work
  • Exported every message to MIME (.eml) files with the 477-folder hierarchy preserved, retrying 143 failures caused by bracketed names and file locks until the export was complete
  • Recovered a destination shared mailbox that was failing Graph calls by opening it once in Outlook on the web, after which Exchange rebuilt its folder structure
  • Imported through Graph's MIME upload, which needs base64-encoded message content rather than raw bytes
  • First pass: 15,425 messages imported and 15,543 failed, mostly HTTP 429 throttling (14,132) and expired tokens (795)
  • Re-ran the failures with fixed pacing and exponential backoff - 14,929 of 14,934 succeeded over about 15 hours
  • Traced the final 614 failures to "&" and other special characters in folder names breaking OData $filter queries; URL-encoding the filters cleared them
  • Delivered everything into one archive folder under the destination Inbox so the team can search it in one place

Tech Microsoft Graph API / PowerShell / Exchange Online / OData / Outlook on the web

Outcome

All ~31,000 messages migrated with the original folder structure intact.

03 2026

Security Maturity Assessment & Uplift Scoping - Defence Industry Compliance

Lead Engineer Defence-adjacent industry Multi-week

Led the assessment and scoping phase of a Defence Industry Security Program (DISP) Maturity Level 2 uplift - live tenant audit, gap analysis, and a scoped budget for the remediation work.

Scope of work
  • Audited the live Microsoft 365 tenant and on-premises Active Directory with PowerShell and Microsoft Graph across identity (Conditional Access, MFA registration), endpoint (Intune compliance, Defender, application control), Office macro controls, logging and SIEM readiness, and server hardening
  • Confirmed which required controls were already in place and documented the gaps across logging and monitoring, privileged and emergency access, server hardening, and Conditional Access enforcement
  • Ran a dedicated MFA audit across all licensed users, with documented exceptions for service and shared accounts
  • Built an audit workbook mapping live tenant evidence to each DISP control with a red / amber / green status
  • Produced the scope and budget document (labour estimate and licensing costs), refined through senior review

Tech Graph PowerShell SDK / Entra ID / Intune / Defender for Endpoint / Conditional Access / Active Directory / Purview

Outcome

Audit workbook and scoped budget delivered. Findings and recommendations accepted by the senior team for client presentation.

04 2026

Cursor AI Editor Deployment via Microsoft Intune

Systems Administrator / Packaging Engineer Construction / Engineering Multi-day

End-to-end deployment of Cursor (an Electron/Squirrel-based AI code editor) via Intune - including diagnosis of CDN routing failures, MSIX repackaging, self-signed certificate deployment and WDAC (now App Control for Business) policy integration.

Scope of work
  • Diagnosed root cause of 0x87D30067 - Intune TrafficRoutingService pointing IME at a non-resolving CDN hostname; resolved by recreating the app object
  • Determined Cursor’s Squirrel installer has no supported silent mode - resolved by MSIX repackaging
  • Repackaged Cursor as a signed MSIX with a self-signed certificate (valid to 2027)
  • Deployed the signing certificate via Intune trusted-certificate profile to TrustedPeople (deploying to Root caused 0x80073CF3)
  • Created a WDAC supplemental policy with a publisher signer rule trusting the Cursor developer (Anysphere)
  • Handled a follow-up repackage for a newer version after update prompts began blocking users; also deployed Python 3.x as a Win32 app

Tech Microsoft Intune / MSIX Packaging Tool / WDAC / Entra ID / PowerShell / Windows 11 / IntuneWinAppUtil

Outcome

Cursor successfully deployed to all target devices. WDAC policy updated without breaking the existing security baseline. Certificate and signing infrastructure documented for future packaging work.

05 2026

UniFi Controller Platform Migration

Engineer MSP-wide (multiple clients) Bulk cut-over in one day

Moved the MSP's client UniFi network sites off a legacy cloud-hosted controller onto a new UniFi OS Server, then audited what was left so the old controller could be retired.

Scope of work
  • Migrated about 77 client sites to the new UniFi OS Server, including 54 in a single day to complete every outstanding migration
  • Audited the legacy controller for stale sites: about 15 with no devices or offline health flagged for client confirmation, and about 7 marked decommissioned or out of scope, including one still holding 48 orphaned devices
  • Retired the legacy controller once the remaining sites were resolved

Tech UniFi OS Server / UniFi Network

Outcome

All in-scope sites running on the new platform and the legacy controller decommissioned.

06 2026

Brand Font and Word Template Rollout via RMM

Engineer Facilities & construction services

Delivered a client's brand typeface and a library of branded Word templates to 108 Windows workstations through one chained RMM job, with no user action needed and Word using the brand fonts by default.

Scope of work
  • Built a 10-task RMM job that installs only the three font weights the brand guidelines allow, distributes six branded templates (form, two letterheads, meeting agenda, meeting minutes, blank document) and points Word's personal templates location at them for every user profile
  • Made the per-user step resilient: removed the global stop-on-error setting and wrapped each profile's registry changes in its own try/catch, so one locked profile hive can't abort the run
  • Installed templates to a dedicated subfolder so Normal and NormalEmail don't clutter Word's template picker
  • Edited each user's Normal.dotm theme fonts (light weight for body text, bold for headings), which stopped Word defaulting to a heavy-looking body font
  • Converted the client's .docx files into .dotx templates, and piloted on test devices, including a client stakeholder's, before the bulk run
  • Recommended a SharePoint organization assets library for central template management long term

Tech Bluetrait RMM / PowerShell / Windows Registry / Microsoft Word templates (.dotx, Normal.dotm) / SharePoint Online

Outcome

Rolled out to all 108 workstations with no user action required.

07 2026

Single Sign-On Uplift - Multi-Application SAML Integration

Lead Engineer (scoping & budget) Resources & services Multi-week

Scoped and budgeted a SAML SSO uplift covering nine third-party business applications across two separate client Entra ID tenants - including vendor engagement, licensing analysis and a client-ready budget document.

Scope of work
  • Assessed SSO support across nine SaaS platforms (project management, HR/payroll, ERP, construction safety, analytics, creative suite, transcription and more)
  • Determined SAML vs OIDC protocol support per vendor through documentation review and direct vendor engagement
  • Analysed Entra ID licence implications - Free supports SAML SSO, but P1 is required for group-based app assignment (a large number of manual assignments without uplift for one tenant)
  • Confirmed active user counts per tenant via Microsoft 365 admin center CSV exports and Graph PowerShell
  • Produced a multi-section budget document - executive summary, document control, tools-in-scope, assumptions, exclusions and next steps
  • Verified every cost and capability claim against vendor documentation or direct vendor confirmation before senior review

Tech Microsoft Entra ID / SAML 2.0 / PowerShell (Graph SDK) / Exchange Online / Microsoft 365 admin center

Outcome

Accurate, fully referenced budget document delivered for senior review. All figures traceable to confirmed sources and structured for direct client presentation.

08 2026

Microsoft 365 Write Integration for Claude Desktop (MCP)

Developer / Solutions Engineer Professional services (small business) One-day build

Adapted and extended the open-source OutlookMCPServer to give Claude Desktop write access to Microsoft 365, after identifying that the Microsoft 365 connector available at the time was read-only - enabling Claude to create calendar events and send emails on behalf of client users within their tenant.

Scope of work
  • Registered an Azure application in the client tenant with appropriate Graph API delegated permissions
  • Deployed the open-source OutlookMCPServer on macOS and integrated it with Claude Desktop
  • Diagnosed a macOS-specific auth failure - default TokenCachePersistenceOptions relies on the keychain, inaccessible when the MCP server runs as a Claude Desktop subprocess
  • Rewrote settings.py to use MSAL SerializableTokenCache with a plain JSON file, bypassing the keychain
  • Built a companion auth_test.py for one-time device-code authentication to seed the token cache
  • Resolved Python version compatibility and confirmed the auth account must hold an Exchange Online licence

Tech Python / MSAL / Microsoft Graph API / Entra ID (App Registration) / Claude Desktop (MCP) / Exchange Online / macOS

Outcome

Working demo delivered - Claude created calendar invites and sent email inside the client tenant. Later recommended a simpler, lower-maintenance setup (Claude Cowork saving into a synced SharePoint folder) over running a custom server.

Also

More work

Smaller pieces of work, one line each.

  • Calendar deployment through Microsoft Graph

    296 events into a user's mailbox as a separate calendar, after .ics imports kept being silently removed.

  • Legacy Outlook for Mac freezes

    Diagnosed remotely from system diagnostics and fixed with a reversible profile reset, with signatures and their images restored in the background - all through the RMM.

  • Mac enrolment into Intune

    RMM tasks plus Company Portal to bring Macs under Intune management.

  • SAML SSO for an HR/payroll platform

    A custom (non-gallery) Entra ID enterprise app, configured and tested end to end, with a rollout plan covering group-based assignment, UPN matching and break-glass access. Go-live sits with the client.

  • Domain controller replacement

    Replaced a client's temporary domain controller with a new Windows Server 2025 DC.

  • External audit support

    IT general controls evidence for a client's FY26 external audit (ASA 315): 21 controls across 6 systems.