# client organisations anonymised throughout. detail available in conversation.
intune-win32-framework/Deployment framework and packaging catalogue (43 apps, 4 remediations) rebuilt for a technology and cyber-security group - standardised scripting, central logging, cloud distribution. Recurring deployment failures ended.
ncsc-soc-device-build/Hardened Windows build for security analysts: AppLocker and WDAC application control, ASR, BitLocker and a full settings-catalogue baseline aligned to NCSC guidance.
tenant-lifecycle/Greenfield Entra tenant runbook (break-glass, baseline Conditional Access, P2, bulk creation) and a two-tenant wind-down: 280+ mailboxes converted to shared with statutory retention preserved.
retail-byod-migration/800+ devices across 250+ UK retail sites, unmanaged BYOD to fully managed - Intune, Entra ID and zero-touch Autopilot, build time under one hour.
identity-at-scale/Tenant-to-tenant migration for 150+ users across Exchange, SharePoint, OneDrive and Teams; separately, a 238-user UPN/SMTP migration (231 clean first pass) and 189-user attribute stamping.
rbac-pim-standard/Per-subscription Azure RBAC standard: five PIM-eligible, MFA-activated groups per subscription - least privilege as the default posture, fully documented.
apple-estate/Apple management built from nothing: Apple Business Manager, Jamf with ADE, iOS/iPadOS under a second MDM authority, Platform SSO for Entra credential alignment.
governance/Software and AI governance where none existed: approved-application catalogue, WDAC triage of a 355-item inventory (185 allow / 162 review / 8 block), AI usage policy with central platform ownership.
cost-governance/Unauthorised self-service billing accounts discovered via the Cost Management REST API; vendor-side block implemented, four-subscription cost forecasting, invoice restructure.
sudo@stewart.services:~$ theme --set
black |
grey |
blue |
whitetheme set: blacksudo@stewart.services:~$ font --size
smaller |
default |
largerfont scale: 100%