Cloud identity and access management for users, groups, and app sign-in.

On-prem directory service: domains, OUs, group policy.

Syncs on-prem Active Directory identities to Entra ID.

Lightweight agent-based alternative to Entra Connect for hybrid sync.

The productivity and collaboration suite this work is built around.

Cloud mailbox hosting, mail flow, and transport rules.

Document libraries, site structure, and permission design.

Collaboration platform administration and policy configuration.

Endpoint management and compliance across managed devices.

Cloud infrastructure platform for hybrid and cloud-native workloads.

The unified API behind most Microsoft 365 automation.

Low-code platform underlying Power Automate and related tooling.

Policy-based sign-in controls built around user, device, and risk signals.

Enforcing a second sign-in factor across users and sensitive apps.

Verify-explicitly security model applied across identity, device, and network.

Threat detection and response across endpoints, identity, and email.

Data governance, classification, and compliance across Microsoft 365.

Blocking or flagging risky data movement directly on the device.

Classifying and protecting documents and email by sensitivity level.

Full-disk encryption managed and recovered through Intune/AD.

Randomized, rotated local administrator passwords per machine.

Application control that restricts which code is allowed to run.

Firewall and SD-WAN appliances used for perimeter and branch security.

Switching and routing hardware for core and access-layer networking.

Ubiquiti’s unified networking gear for switching, Wi-Fi, and gateways.

Firewall and endpoint security appliances used in real deployments.

Firewall appliances used for branch and perimeter deployments.

Separating broadcast domains and designing access/trunk port layouts.

Static and dynamic routing between networks and sites.

Isolating network zones so a breach in one doesn’t reach the rest.

Steering traffic across multiple WAN links by policy.

Site-to-site and remote-access VPN configuration.

Writing and auditing rule sets so access matches actual intent.

Server OS administration: roles, services, and hardening.

Day-to-day server administration across common distributions.

Virtual machine hosting and management in production environments.

Windows-native virtualization for server consolidation.

Open-source virtualization for VMs and containers on bare metal.

Containerizing and running applications consistently across environments.

Reverse proxy, TLS termination, and static file serving.

Managing and troubleshooting Linux services and startup order.

Running production workloads on a shared VPS without disturbing other tenants.

Automation scripts, backend services, and data processing.

Administration and automation across Windows and Microsoft 365.

Backend services and application logic on .NET.

The runtime and framework behind the C# backend work above.

Server-rendered web pages and forms on top of ASP.NET.

Designing and consuming HTTP APIs between services.

Connecting application code to a database reliably and safely.

Scoping what a user or service can do by assigned role.

Verifying identity and enforcing what that identity is allowed to do.

Relational database used as the backing store for real applications.

Structuring relational data and writing queries against it.

In-memory store used for caching and fast key-value lookups.

Agent-assisted development: building, debugging, and deploying real projects.

Designing autonomy, task scope, and stopping conditions for an agent.

Packaging reusable, scoped instructions an agent loads for a specific task.

The protocol connecting an agent to external tools and data sources.

Letting a model invoke real functions instead of just producing text.

Coordinating multiple agents so their work stays predictable, not chaotic.

Keeping a required approval checkpoint before consequential actions.

Structuring instructions so a model’s output is reliable and specific.

Deciding what information an agent actually needs in its working context.

Wiring a language model into a real application’s architecture.

Running language models on owned hardware instead of a hosted API.

Running model inference against real GPU memory and throughput limits.

Node-based workflow tool for local generative-model pipelines.

Grounding model output in retrieved documents. Research interest, no production track record yet.

Similarity search over embeddings. Research interest, not production-confirmed.

Frameworks for testing agent behavior under adversarial conditions. Research interest.

Low-code workflow automation across Microsoft 365 and connected services.

Defining and running multi-container deployments from one config file.

Routing and securing traffic to multiple apps behind one entry point.

Building and testing before deployment, repeatably rather than by hand.

Knowing whether a running system is actually healthy.

Shipping changes with a tested way back if something breaks.

Moving mailboxes between systems without losing mail or breaking access.

On-prem mail server administered as part of real migration work.

Open-source mail/collaboration server administered in real deployments.

The mail protocols underneath most migration and routing work.

Running two environments side by side during a transition window.

MX, SPF/DKIM/DMARC, and routing changes that keep mail flowing during cutover.

3D modeling tool, explored outside of professional engineering work.

How assets move from modeling to a usable, rendered result.

Game engines and real-time rendering, followed as a personal interest.

Single-board computer used for small IoT and automation experiments.

Microcontroller platform used for hands-on hardware experiments.

Reading and acting on real-world sensor input through GPIO pins.

Using small devices to automate a physical task, as a personal project area.