Insights

Notes from the work, with the commands.

Each article is written from project practice: concrete steps, PowerShell and Graph commands, the mistakes I see most often, and a checklist at the end. No client names, no filler.

AI · accessibility

Making 1,000-page PDFs accessible with AI: what worked and what did not

Lessons from building DokAudit: rules first, a local layout model, an LLM only for uncertain pages, a cross-check against the page image and a cost budget.

· 5 min read Email authentication

DMARC for Singapore companies: what Cyber Essentials asks for, and how to reach p=reject

What CSA Cyber Essentials (2025) clause A.4.4 says about SPF, DKIM and DMARC, and a step-by-step path to p=reject that does not break legitimate mail.

· 5 min read Email security

Business email compromise in practice: what DMARC stops, what it does not, and what Defender for Office 365 adds

DMARC stops exact-domain spoofing. Lookalike domains, display names and compromised vendor mailboxes need Defender for Office 365 and a payment process.

· 4 min read Exchange

Decommissioning the last Exchange server: what has to move first

Before the last Exchange server goes: find every SMTP sender, move relays to Graph or a connector, plan recipient management and clean up hybrid and DNS.

· 5 min read Identity

Rolling out Conditional Access in phases without locking anyone out

Break-glass accounts first, then report-only, sign-in logs and What If, then rings from admins to everyone. With Graph PowerShell for export and rollback.

· 5 min read Identity

App registrations with least privilege: Graph permissions, scoped access, certificates and review

App registrations are the side door of a tenant. Pick narrow Graph permissions, scope mailbox and site access, use certificates instead of secrets, review regularly.

· 3 min read Compliance

MAS Notice FSM-N06 and Microsoft 365: admin accounts, MFA and patching evidence

How the six cyber hygiene practices of MAS Notice FSM-N06 map to Microsoft 365, Entra ID and Intune, and how to collect evidence by script. Not legal advice.

· 4 min read Data governance

Copilot readiness: find and fix oversharing in SharePoint and Teams before you switch Copilot on

Copilot only shows what users can already open. That makes old oversharing visible. How to find broadly shared sites, teams and links, and what to change first.

· 4 min read Email security

MTA-STS and TLS-RPT: enforcing encrypted mail transport, step by step

SMTP falls back to plain text when TLS fails. MTA-STS tells senders not to, TLS-RPT tells you when it happens. Policy file, DNS records, testing and enforce mode.

· 4 min read Backup

Microsoft 365 backup: what Microsoft does and does not cover, and how to test a restore

Retention is not backup. The built-in recovery windows of Microsoft 365, what a backup must add, configuration backup, and a restore test you can repeat.

· 4 min read Exchange

Message trace and mail flow troubleshooting in Exchange Online, with real cases

A repeatable way to find out why a message went missing: Get-MessageTraceV2, header analysis, connectors and NDR codes, with anonymised cases from projects.

· 4 min read Endpoint

Moving devices from on-premises AD to Entra ID join with Intune and Autopilot

There is no switch from domain join to Entra ID join. The two real paths, the prerequisites, Autopilot and ESP pitfalls, and keeping access to file servers.

· 4 min read Automation · AI

AI agents with a human in the loop: how I automate admin work without giving an AI the keys

Scoped tools, short-lived tokens, switches that default to off, and a log of every call: the patterns I use to let AI and automation work on Microsoft 365.

· 4 min read

Questions about one of these topics?

Write to me. If it is a role in Singapore or a project where this matters, all the better.

hello@lappenbusch.com CV