Markus H.-Senior Microsoft Identity & Security Architect | Entra ID | Zero Trust | M365 Governance

Restructuring email authentication across the entire domain inventory of an international industrial company with 1,000 to 5,000 users: around 45 domains in more than 20 countries.

• Inventory of all domains and classification as sending, non-sending, or unclear; target design for each domain group
• DMARC reporting (rua) as the data basis before any policy tightening, with aggregate reports analyzed over several weeks
• SPF lookup budget (limit of 10 lookups) counted rather than estimated; several assumptions from previous findings were thus disproved
• Analysis of the multi-stage mail flow across on-premises Exchange, Microsoft 365, and security gateways, and its impact on DKIM alignment and SPF
• Assessment of external findings based on evidence: confirmed, false positive, or context-dependent, with justified disagreement presented to the assessor
• Change proposals with before/after state, risk, and rollback; implementation is handled by the customer
• Tenant-to-tenant migration analysis for a group company: read-only audit, technical assessment, management summary, migration paths
• Analysis of a service shared mailbox according to CISO and data protection requirements: anonymized in the transformation layer, without personal data analysis

Technologies: Exchange Online, Exchange Hybrid, Entra ID, Microsoft Graph, PowerShell, SPF, DKIM, DMARC, MTA-STS, TLS-RPT, Power BI

Zero Trust and Identity-First Security program in a hybrid enterprise environment with 20,000 to 50,000 users.

• Zero Trust architecture based on Entra ID: Conditional Access, MFA, Identity Protection, External Identities
• Privileged Identity Management: permanent admin rights replaced by just-in-time access, with role activations fully logged
• Active Directory tiering model according to Microsoft Best Practices and PAW concept: the attack path from the workstation to Domain Admin is interrupted
• Kerberos hardening with FAST and Authentication Policies
• Active Directory security analyses with PurpleKnight and PingCastle; the risk assessment demonstrably improved
• PKI hardening and management
• Evaluation and implementation of cloud solutions on Azure and Entra ID
• Logging as the basis for compliance evidence under NIS2 and ISO 27001
• Handover to operations and knowledge transfer: the internal team operates the solution independently

Technologies: Active Directory, Entra ID, Microsoft 365, Azure (IaaS, PaaS), Microsoft Graph, PIM, Conditional Access, PKI, PowerShell

Architecture topics in a very large hybrid Exchange environment of an international IT service provider with more than 100,000 users.

• Design for enhanced email security through labeling external emails
• Design for standardized access to Exchange resources through Microsoft Graph: for users, administrators, and applications
• Analysis and assessment of the existing antivirus and antispam solution for Exchange
• Planning and company-wide introduction of new Exchange features, such as dynamic distribution groups

Technologies: Exchange Online, Exchange 2019, Exchange Hybrid, Microsoft 365, Microsoft Graph, Active Directory, Azure AD, PowerShell

Migration from Exchange 2016 to Exchange Online and establishment of the security and compliance foundation in Microsoft 365 at a logistics service provider with 1,000 to 5,000 users.

• Planning and piloting the mail migration from Exchange 2016 to Exchange Online
• Introduction of security and compliance settings in Microsoft 365: MFA, Conditional Access, Information Protection and Data Loss Prevention
• Consolidation of Active Directory 2016
• Management of Azure AD

Technologies: Exchange Online, Exchange 2016, Microsoft 365, Active Directory, Azure AD, Azure AD Connect, Conditional Access, MFA, Information Protection, DLP, PowerShell

Cloud transition from Lotus Notes and on-premises to Microsoft 365 at an internationally operating logistics company with 20,000 to 50,000 users.

• Planning and piloting the mail migration from Lotus Notes to Exchange Online
• Planning and piloting the introduction of Microsoft Teams
• Security and compliance settings in Microsoft 365: MFA and Conditional Access were part of the new platform from the beginning
• Introduction of Information Protection and Data Loss Prevention
• Management of Active Directory 2016 and Azure AD
• Identity management with role-based concepts

Technologies: Microsoft 365, Exchange Online, Microsoft Teams, Active Directory, Azure AD, Azure AD Connect, ADFS, Conditional Access, MFA, Information Protection, DLP, PowerShell

Complete replacement of a Micro Focus environment with Microsoft at an Austrian university with 1,000 to 5,000 users.

• Analysis of the existing IT infrastructure
• Concept for the transformation from Micro Focus to Microsoft
• Migration from eDirectory to Active Directory and Azure AD
• Migration from GroupWise to Exchange and Exchange Online
• Introduction of Office 365 and Azure services
• Planning of an MDM environment with Microsoft Intune

Technologies: Office 365, Exchange Online, Active Directory, Azure AD, Azure AD Connect, Azure (IaaS, PaaS), Microsoft Intune, GroupWise, eDirectory, PowerShell

Strategic planning for the restructuring of the Microsoft infrastructure of a European retail group with 50,000 to 100,000 users.

• Analysis of the existing IT infrastructure
• Planning and high-level concept for the future Active Directory infrastructure
• Planning and high-level concept for the migration strategy
• Work in an agile project environment

Technologies: Active Directory, Exchange 2016, Exchange Online, Microsoft 365, Azure AD, Azure AD Connect, ADFS, Quest Migration Manager

Exchange 2016 architecture and early automation with Desired State Configuration in a complex multi-forest topology with a resource forest, at an internationally active industrial services provider with 50,000 to 100,000 mailboxes.

• Concepts and migrations for Exchange 2016
• Concepts and migrations for Office 365 and Exchange Online
• Automation of the Exchange configuration with Desired State Configuration (DSC)
• Active Directory in the multi-forest environment
• ADFS and Azure AD Connect

Technologies: Exchange 2010 to 2016, Exchange Online, Office 365, Active Directory, ADFS, Azure AD Connect, DirSync, PowerShell, Desired State Configuration

See CV