Training

Workshops that end with something your team can use.

I am a Microsoft Certified Trainer. The formats below are what I can offer to teams in Singapore and the region, onsite or online, in English or German. Each one works with your own environment where possible and ends with a concrete result, not just slides.

Workshop · email authentication

DMARC in a day

From an SPF record nobody understands to a written plan for DMARC p=reject, using your own domains and your own DMARC reports.

For
IT administrators and MSP engineers who own one or more mail domains
Duration
1 day, or 2 half days
Language
English or German

Content

  • SPF, DKIM and DMARC alignment, explained with real headers
  • Reading aggregate reports and grouping senders
  • SPF lookup limit, subdomains for third-party senders, parked domains
  • DKIM in Exchange Online and at third-party senders
  • MTA-STS and TLS-RPT in one hour
  • Rollout plan: none, quarantine, reject, and how to roll back

You leave with

  • A sender inventory with an owner per sender
  • DNS changes ready to apply
  • A dated rollout plan to p=reject

Related article: DMARC and Cyber Essentials

Training · messaging

Exchange Online mail flow deep dive

Why a message took the path it took, and how to prove it. Connectors, headers, message trace and the errors that keep coming back.

For
Messaging administrators, second-level support, MSP engineers
Duration
1 day
Language
English or German

Content

  • Inbound and outbound connectors, Enhanced Filtering, gateways in front of Exchange Online
  • Hybrid routing: the connectors the Hybrid Configuration Wizard creates and what breaks them
  • Message trace in the portal and in PowerShell
  • Reading Authentication-Results and compauth
  • NDR codes that matter, such as 5.7.1, 5.4.1 and 5.7.708
  • SMTP relay for devices and apps without passwords

You leave with

  • A troubleshooting runbook for your environment
  • PowerShell snippets your team can reuse
  • A list of risks in your current mail flow

Related article: message trace in practice

Workshop · identity

Conditional Access workshop

Design and roll out Conditional Access in a way that cannot lock out the people who would have to fix it.

For
Entra ID administrators, security engineers, IT leads
Duration
1 day
Language
English or German

Content

  • Break-glass accounts that are actually usable, and how to monitor them
  • Report-only mode, sign-in logs and What If
  • Rings: administrators, pilot, everyone
  • Authentication strengths and phishing-resistant MFA
  • Guests, B2B and cross-tenant access settings
  • Naming, ownership, documentation and rollback

You leave with

  • A policy set for your tenant in report-only mode
  • A rollout plan with owners and test cases
  • An exception process that stays small

Related article: Conditional Access in phases

Hands-on review · your tenant

Microsoft 365 security baseline review

We read your tenant together, read-only and by script, and turn what we find into a list your team can work through.

For
IT teams responsible for a Microsoft 365 tenant, together with their security or compliance lead
Duration
2 days
Language
English or German

Content

  • Read-only collection with reader roles: identity, sharing, retention, mail, devices
  • CIS Microsoft 365 benchmark and open-source assessment tools such as Maester
  • Why Secure Score is a hint, not an assessment
  • Admin roles, consented applications and app registrations
  • Audit log retention and how to keep evidence longer

You leave with

  • A findings list with target value, actual value, rating and measure
  • Raw data with timestamps for next year's comparison
  • The first fixes, planned with a pilot and a way back

Related case: evidence instead of screenshots

Workshop · data governance

Copilot readiness

Copilot shows people what they already have access to. This workshop finds the oversharing before Copilot does.

For
IT and SharePoint administrators, data protection and compliance leads
Duration
1 day
Language
English or German

Content

  • How Copilot uses permissions, and why that makes oversharing visible
  • Sharing settings: default link type, anyone links, guest access
  • Finding broadly shared sites, teams and files
  • Sensitivity labels and the order to introduce them
  • A pilot group, usage reports and the questions works councils and employees ask

You leave with

  • A ranked list of overshared sites and teams
  • Sharing settings to change, with impact
  • A pilot plan for the first Copilot users

Related article: oversharing before Copilot

Training · endpoint

Intune and Windows Autopilot, hands-on

From an empty Intune tenant to a device that arrives in its box, signs in and is ready to work.

For
Endpoint administrators and help desk teams
Duration
2 days
Language
English or German

Content

  • Enrolment, Autopilot profiles and the Enrollment Status Page
  • Win32 apps, detection rules, dependencies and supersedence
  • Compliance policies and the settings catalog
  • Windows Update rings and reporting
  • Moving devices from on-premises AD to Entra ID join

You leave with

  • A working Autopilot flow in a test tenant or yours
  • Checklists for app packaging and ESP troubleshooting
  • A migration path for existing devices

Related article: from AD to Entra ID join

How I run them

  • A short call beforehand: who attends, what they already know, which questions are open
  • Hands-on in a test tenant or, read-only, in yours
  • Examples from real projects, anonymised
  • A written summary with the commands, decisions and next steps

Formats

Each topic works as a half-day introduction, a full-day workshop or a series of shorter sessions. They can also be combined into a handover at the end of a project, so the team that runs a system afterwards understands it.

Certifications

Want one of these for your team?

Tell me who will attend and what your environment looks like. I adapt the content to your tenant and your questions.

hello@lappenbusch.com CV