Expertise

Microsoft 365, from the MX record to the managed device.

What I can take over in a Microsoft 365 environment, and how I do it. Concrete enough that an engineer can check it, short enough that a hiring manager will read it. The core is the whole stack, from identity to the managed device; email security is one of my specialisations within it.

Exchange & mail flow

Mail is the system everybody notices when it breaks. I know Exchange Online and Exchange hybrid at the level of connectors, routing and headers: why a message took the path it took, and how to change that path without losing a single one.

  • Exchange Online
  • Exchange Server
  • Hybrid
  • Connectors
  • Mail flow rules
  • Message trace
  • TLS

Typical work

  • Fixing hybrid mail routing in planned phases, with a rollback for each step
  • MX cutover readiness: inventory of senders, gateways, connectors and TLS before the switch
  • Decommissioning on-premises Exchange after the migration, including recipient management afterwards
  • Replacing SMTP relay for apps and devices with Microsoft Graph and a tightly scoped app registration
  • TLS hardening for mail and servers

Case: Exchange hybrid, fixed and then switched off

Email security

Most domains have an SPF record and a DMARC record that says p=none. That is a start, not protection. I take domains to p=reject without breaking the newsletter tool, the ERP or the scanner in the basement: by reading the DMARC reports, finding every legitimate sender and fixing them one by one.

  • SPF
  • DKIM
  • DMARC
  • MTA-STS
  • TLS-RPT
  • BIMI
  • Secure email gateways
  • Defender for Office 365
  • Exchange Online Protection

I built my own tool for this. DMARC Geeks collects and visualises DMARC aggregate reports across many domains and tenants, checks DNS records, scores test mails and tests how a Microsoft 365 mailbox handles harmless malware, spam and phishing test strings. More on DMARC Geeks

Typical work

  • SPF clean-up: sender inventory, staying under the 10-lookup limit, ending with -all
  • DKIM for Microsoft 365 (selector1/selector2) and for every third-party sender
  • DMARC from p=none via quarantine to reject, driven by report data, not guesswork
  • MTA-STS and TLS reporting so inbound mail is only delivered over verified TLS
  • Gateways in front of Exchange Online: connectors, enhanced filtering, no double scanning
  • Defender for Office 365: anti-phishing and impersonation, Safe Links, Safe Attachments, quarantine policies, and a test that proves they work

Case: DMARC to p=reject
Case: Mail filtering and encryption

Try it

Check your domain's email security

Type a domain and see its MX, SPF, DKIM, DMARC, MTA-STS, TLS-RPT and BIMI records in DMARC Geeks, the analysis tool I built and run.

Opens dmarc-geeks.ch in a new tab (interface in German). Only public DNS records are read; the domain you enter is sent to dmarc-geeks.ch. Privacy

  • p=noneDMARC only reports. Spoofed mail is still delivered.
  • p=quarantineFailing mail goes to junk. A step, not the goal.
  • p=rejectFailing mail is refused. Where a domain should end up.
  • no recordAnyone can send as your domain and nobody tells you.

Identity & access

Entra ID is the front door of every Microsoft 365 tenant. I roll out Conditional Access in phases, starting in report-only mode with break-glass accounts excluded, so nobody gets locked out on a Monday morning. And I look at the side door too: app registrations and the permissions they hold.

  • Microsoft Entra ID
  • Conditional Access
  • MFA & authentication strengths
  • App registrations
  • Enterprise applications
  • Managed identities
  • Microsoft Graph permissions

Typical work

  • Conditional Access rollout in five phases, from report-only to enforced, with a documented exception process
  • App registrations with certificates instead of client secrets, least-privilege Graph permissions and scoped mailbox access
  • Managed identities for automation in Azure, so no secret has to be stored at all
  • Reviewing consented applications and their permissions
  • CIS benchmark gaps for Microsoft 365, closed and documented
  • Evidence kits for regulated financial clients in Switzerland (FINMA, Swiss data protection law) that can be re-run every year

Case: Conditional Access without lockouts
Case: Evidence instead of screenshots

Endpoint management

New laptop out of the box, signed in, compliant, ready to work. I build Intune and Windows Autopilot setups that do that, and I move existing devices and user profiles from on-premises Active Directory to Entra ID without starting from zero.

  • Microsoft Intune
  • Windows Autopilot
  • Compliance policies
  • Settings catalog
  • Win32 apps
  • Windows Update for Business

Typical work

  • Intune and Autopilot from scratch: enrolment, compliance, configuration, apps, updates
  • Profile migration from local AD-joined devices to Entra ID-joined devices
  • Replacing Remote Desktop Services with managed endpoints
  • Printer inventory moved to Intune
  • Secure Boot certificate updates (Windows UEFI CA 2023) planned across a fleet
  • Around the endpoint: file server to SharePoint, SharePoint permission audits, OneDrive rollouts

Case: Autopilot from about three hours to under 45 minutes

Automation & AI

If I do something twice, I script it. PowerShell and Microsoft Graph are my daily tools, and for anything bigger I build software. I use AI agents where they save real time, with a human approving every change that matters.

I am interested in the business process behind the ticket: who requests, who approves, where the data ends up. That is where automation pays off.

The biggest piece of automation I have written: the M365 Control Plane, a multi-tenant platform for Microsoft 365. Baselines as code, change evidence with content hashes, Maester audits, and PowerShell 7 jobs in Semaphore that get short-lived app-only tokens through a ticket broker instead of holding a certificate. Architecture and details

  • PowerShell
  • Microsoft Graph
  • Exchange Online PowerShell
  • REST APIs
  • Node.js
  • Python
  • PostgreSQL
  • Docker
  • AI agents & MCP

How my automation behaves

  • Read-only by default: a script first reports what it would change
  • JSON backup of the current state before any change, with a matching restore script
  • Pilot group first, then the rest
  • Changes only with an explicit -Apply switch
  • Timestamped logs, HTML/PDF documentation and a runbook for the team that runs it next
  • AI agents propose, humans approve: tools exposed to an agent are scoped, logged and reversible

Case: AI that proposes, a human who approves
Case: My own infrastructure

Training

I am a Microsoft Certified Trainer (MCT). From 2020 to 2023 I worked as a consultant and trainer for Microsoft 365. Training is also how I finish projects: the team that runs the system afterwards should understand it, not just own it.

I teach in German and in English.

Who I train

  • Administrators: Exchange Online, Entra ID, Intune, security and compliance in Microsoft 365
  • Help desk teams: the troubleshooting that actually comes up
  • Management: what a security decision means, in plain language
  • Project handovers: runbooks and hands-on sessions instead of a slide deck

Workshops and trainings I offer
Certifications

Hiring for Microsoft 365, identity or email security in Singapore?

Permanent role, contract or a first conversation: write to me. I answer personally.

hello@lappenbusch.com CV