See My Work
Portfolio
Hands-on implementations across Microsoft 365, Azure, and enterprise platforms — documented with live tenant screenshots.
☁️
Microsoft 365
Exchange · Entra ID · Intune · Defender
🔷
Microsoft Azure
Coming soon
Soon
📊
Dynamics 365
Coming soon
Soon
Microsoft Intune — Device Management & Policy Deployment
Configured a Microsoft Intune lab environment demonstrating end-to-end device enrolment and security policy enforcement. A dedicated Azure AD user (Finance Support) was created and added to the Finance group. The device was enrolled via Azure AD Join using that user's credentials, and a hardening policy (WIN-Server-Hardening-Finance) targeting the Finance group was applied to restrict access to the Windows Control Panel.
🔍 Click to expand
Intune · Devices · Configuration
Device Configuration Policies
The Microsoft Intune admin center showing two active configuration policies: Custom Wallpaper and WIN-Server-Hardening-Finance, both targeting Windows 10 and later devices via the Settings catalog policy type.
🔍 Click to expand
Intune · Enrolment · AAD Join
Azure AD Join — Device Enrolment
The Windows OOBE "Set up for work or school" screen, showing the Finance Support user (f.support@kennyk.online) signing in with their Microsoft credentials to enrol the device into Azure AD and register it with Intune.
🔍 Click to expand
Intune · Post-Enrolment · Login
Windows 11 Login — Finance Support User
The Windows 11 lock screen after successful Azure AD Join, displaying the Finance Support user account as the primary sign-in. The device is now Intune-managed and will receive all assigned configuration policies at next check-in.
🔍 Click to expand
Intune · Policy · Hardening
WIN-Server-Hardening-Finance — Policy Detail
The configuration profile detail page for WIN-Server-Hardening-Finance — a Windows device hardening policy with the description "Disable Control Panel". The policy is assigned to the Finance group (Status: Active) with no exclusions, preventing Finance department users from accessing system settings.
Microsoft Entra ID — Identity, Access & Application Governance
End-to-end administration of the MBK505.com (KENNYK.ONLINE) tenant covering identity lifecycle, group management, device registration, enterprise application provisioning, Conditional Access, authentication methods, administrative units, audit logging and Microsoft 365 license assignment. Demonstrates a complete Entra ID operating model aligned with Zero Trust and least-privilege principles.
🔍 Click to expand
Entra ID · Groups · Members
Finance Group — Direct Members
The Microsoft Entra admin center showing the Finance group's Members blade. One direct member is listed — Finance Support (User type) — the dedicated account used for device enrolment and Intune policy targeting across the Finance department.
🔍 Click to expand
Entra ID · Groups · Directory
All Groups — Tenant Directory
The All groups blade for MBK505.com, listing six security and Microsoft 365 groups including All Company, Finance, Project and AAD DC Administrators. Demonstrates structured group design that underpins licensing, Intune targeting and Conditional Access scoping.
🔍 Click to expand
Entra ID · Roles · Admin Units
Administrative Unit — Melbourne-Users
The Roles and administrators › Admin units page showing the Melbourne-Users administrative unit. AUs are used to delegate scoped administration over a specific subset of users and groups — applying least-privilege role assignments without granting tenant-wide permissions.
🔍 Click to expand
Entra ID · Devices · Overview
Devices Overview — Health & Compliance
The Entra Devices › Overview dashboard reporting zero stale, noncompliant and unmanaged devices. A clean device posture confirms that joined endpoints are actively reporting, Intune-managed and policy-compliant.
🔍 Click to expand
Entra ID · Enterprise Apps · Overview
Enterprise Applications — Tenant Inventory
The Enterprise applications overview reporting 227 total applications registered in the tenant (227 enabled, 0 disabled). Provides a single pane to govern single sign-on, user assignment, provisioning and consent across every SaaS integration.
🔍 Click to expand
Entra ID · Enterprise Apps · SSO
Dropbox Business — Enterprise Application
The overview blade for the Dropbox Business enterprise application added from the Microsoft Entra App Gallery. Shows the Application ID, Object ID and the standard configuration path: assign users & groups, set up single sign-on, configure provisioning and apply Conditional Access.
🔍 Click to expand
Entra ID · Security · Conditional Access
Conditional Access — Policy Console
The Conditional Access › Policies console used to enforce signal-based access controls — requiring MFA for users outside the corporate network and restricting Managers group sign-ins to Intune-compliant or domain-joined devices. Core building block of the tenant's Zero Trust posture.
🔍 Click to expand
Entra ID · Security · Authentication
Authentication Methods — Strong-Auth Policy
The Authentication methods › Policies blade with phishing-resistant and modern factors enabled for all users — Microsoft Authenticator, Temporary Access Pass, Software OATH tokens and Email OTP. SMS and Voice are intentionally disabled to eliminate weaker MFA paths.
🔍 Click to expand
Entra ID · Monitoring · Audit Logs
Audit Logs — Directory Activity Trail
The Monitoring & health › Audit logs view filtered to directory activity, capturing Add / Update application, Add service principal and B2C authentication events. Essential for change tracking, incident investigation and compliance evidence.
🔍 Click to expand
M365 Admin · Licensing · E5
Microsoft 365 E5 — License Assignment
The Microsoft 365 E5 licensing page in the M365 Admin Center showing 5 of 25 licences assigned, with group-based assignment to the Finance group plus direct assignments to individual users. Demonstrates hybrid licensing strategy and license-consumption visibility.
🔍 Click to expand
Entra ID · Users · Directory
All Users — Full Tenant Directory
The Users blade for MBK505.com listing all 7 provisioned user accounts: ABC, Finance Support, John - Finance, Kenny Khalid ×2, Support and Test 4435 — all Member type. Demonstrates structured identity provisioning covering dedicated service accounts, department users and shared identities across the kennyk.online domain.
🔍 Click to expand
Entra ID · Users · Profile
User Profile — Kenny Khalid (contact@kennyk.online)
The Entra ID user profile for Kenny Khalid (contact@kennyk.online) showing full identity attributes: Object ID, UPN, created date, User type (Member), and identity source (MBK505com.onmicrosoft.com). The profile blade also exposes direct access to Audit logs, Sign-in logs, Assigned roles, Administrative units, Groups, Devices, Licences and Authentication methods — the complete user management surface.
🔍 Click to expand
Entra ID · Monitoring · Sign-in Logs
Sign-in Events — Interactive User Sign-ins
The Monitoring & health › Sign-in logs view showing real-time interactive sign-in events for kenny@kennyk.online across Azure Portal and Office 365 Shell, all with Success status. The log provides complete forensic data including Request ID, User Principal Name, Application name and UTC timestamp — essential for troubleshooting authentication failures and detecting anomalous access patterns.
🔍 Click to expand
Entra ID · Roles · RBAC
Roles & Administrators — Global Administrator
The Roles and administrators › All roles page confirming the logged-in user holds Global Administrator and 1 other role on the MBK505.com tenant. The full built-in role catalogue is visible including Privileged roles (Application Administrator, AI Administrator) — demonstrating deep familiarity with Entra ID RBAC, Privileged Identity Management (PIM), and the principle of least-privilege role assignment.
Exchange Online — Mailbox Management, Mail Flow & Email Security
Configured a full Exchange Online environment on the kennyk.online tenant, covering mailbox provisioning, shared mailbox delegation, distribution groups, mail flow rules, outbound connectors, and complete email authentication (SPF, DKIM, DMARC). Domain health was verified as Healthy in the Microsoft 365 Admin Center, and DKIM signing is active and validated via Namecheap DNS records.
🔍 Click to expand
Exchange · Recipients · Mailboxes
Manage Mailboxes — Multi-User Tenant
The Exchange Admin Center showing the full mailbox list for the kennyk.online tenant, including user mailboxes (ABC, Finance Support, John - Finance, Kenny Khalid ×2) and the Support shared mailbox. Demonstrates provisioning of multiple mailbox types across a single Microsoft 365 tenant.
🔍 Click to expand
Exchange · Shared Mailbox · Outlook
Shared Mailbox Live in Outlook Web
The support@kennyk.online shared mailbox rendered live inside Outlook Web App, showing Focused/Other inbox tabs and a clean empty inbox state. Confirms successful shared mailbox provisioning and delegate access configuration for team-based email management.
🔍 Click to expand
Exchange · Shared Mailbox · Delegation
Mailbox Delegation — Send As Permissions
The Manage Mailbox Delegation panel for the Support shared mailbox, listing three delegates with Send As permissions: abc@kennyk.online, contact@kennyk.online, and Kenny@kennyk.online. This allows all three users to send email as the Support mailbox identity.
🔍 Click to expand
Exchange · Groups · Distribution List
Distribution List Group — Project
The Exchange Admin Center Groups panel showing the Project distribution list group (1 owner, 3 members) created for team-wide email distribution. The group is configured with a description "Project for Distribution List" and can be used to send a single email to all project team members simultaneously.
🔍 Click to expand
Exchange · Mail Flow · Transport Rules
Mail Flow Rule — External Disclaimer
An enabled transport rule named Add disclaimer for external recipients configured in the Exchange Admin Center. Set to Enforce mode with Priority 0, this rule automatically appends a legal disclaimer to all outbound emails sent to external recipients, ensuring compliance and professional communication standards.
🔍 Click to expand
Exchange · Mail Flow · Message Trace
Message Trace — Successful Delivery Verification
The Exchange message trace detail view confirming that Office 365 successfully delivered a test email from contact@kennyk.online to the external address mbk505@gmail.com. All three pipeline stages — Received, Processed, and Sent — show green, verifying end-to-end mail flow functionality.
🔍 Click to expand
Exchange · Mail Flow · Connectors
Outbound Connector — Partner Organisation
The Exchange Admin Center Connectors page listing one active connector: Outbound connector to partner organization (Status: On), routing mail from a Partner org to Office 365. Demonstrates configuration of secure mail routing between the kennyk.online tenant and an external partner domain.
🔍 Click to expand
Exchange · Connectors · Configuration
Connector Detail — Partner Domain Identification
The detail panel for the outbound partner connector, showing the mail flow scenario (Partner org → Office 365) and partner identification via domain verification: messages from partner.kennyk.online are authenticated before being accepted into the tenant, enforcing secure inbound routing from the partner organisation.
🔍 Click to expand
Exchange · Email Auth · DKIM
DKIM Signing — kennyk.online Enabled
The DomainKeys Identified Mail (DKIM) management page in Microsoft Defender, showing kennyk.online with Status: Valid and Toggle: Enabled. DKIM signing is active for the authoritative domain, ensuring outbound emails carry a cryptographic signature that recipients can verify — protecting against spoofing and improving deliverability.
🔍 Click to expand
Exchange · DNS · Email Authentication
DNS Records — SPF, DKIM & M365 Authentication
The Namecheap DNS management panel for kennyk.online showing the full set of Microsoft 365 authentication records: SPF TXT record (
v=spf1 include:spf.protection.outlook.com -all), DKIM CNAME selector record (selector1._domainkey), Autodiscover CNAME, enterprise enrolment/registration CNAMEs for Intune MDM, and SRV records for Teams/Skype federation.
🔍 Click to expand
M365 Admin · Domains · Health
Domain Status — Healthy ✅
The Microsoft 365 Admin Center domain overview page for kennyk.online, displaying a Healthy status with the message "Everything looks healthy and no items need your attention." The domain is registered as the Default domain, managed at Namecheap, confirming all DNS records (MX, SPF, DKIM, CNAME) are correctly resolved and validated by Microsoft.
Microsoft Defender for Office 365 — Threat Protection & Security Posture
Configured a comprehensive threat protection environment using Microsoft Defender for Office 365 on the kennyk.online tenant. This includes creating anti-phishing, anti-spam, and anti-malware policies, reviewing the full Threat Policies suite (Safe Attachments, Safe Links, Tenant Allow/Block lists), and achieving a Microsoft Secure Score of 84.64%. Threat Explorer was used to investigate real email delivery events by Network Message ID — demonstrating active SOC-level investigation capability.
🔍 Click to expand
Defender · Security Posture · Secure Score
Microsoft Secure Score — 84.64%
The Microsoft Defender home dashboard showing a Secure Score of 84.64% (58.4 / 69 points), with Identity scoring at 90.82% and Apps at 37.5%. The score graph shows a sharp improvement trajectory from near-zero to near-maximum, reflecting the systematic hardening of the tenant. Zero users are at risk, and all detected malware has been remediated.
🔍 Click to expand
Defender · Policies & Rules · Threat Policies
Threat Policies — Full Policy Suite
The Microsoft Defender Threat Policies overview page listing all available policy types: Preset Security Policies, Configuration Analyzer, Anti-phishing, Anti-spam, Anti-malware, Safe Attachments, Safe Links, Tenant Allow/Block Lists, Email Authentication Settings, and Advanced Delivery. This demonstrates a thorough understanding of the complete Defender for Office 365 policy framework.
🔍 Click to expand
Defender · Policies · Anti-Spam
Anti-Spam Policies — Inbound, Outbound & Connection
The Anti-spam policies page within Microsoft Defender showing three always-on policies: Anti-spam inbound policy (Default), Connection filter policy (Default), and Anti-spam outbound policy (Default) — all set to Always on at Lowest priority. This covers full-spectrum spam filtering for inbound email, outbound email, and connection-level IP reputation filtering.
🔍 Click to expand
Defender · Policies · Anti-Phishing
Anti-Phishing Policy — kennyk.online
The review screen for a custom anti-phishing policy named Anti-Phishing Protection for kennyk.online, targeting users contact@kennyk.online and support@kennyk.online across the full domain. Phishing threshold is set to Standard (Level 1), with user impersonation protection enabled for 1 user and domain impersonation protection active for all owned domains — providing multi-layer identity spoofing defence.
🔍 Click to expand
Defender · Explorer · Threat Hunting
Threat Explorer — Email Investigation by Message ID
Microsoft Defender's Threat Explorer being used to investigate a specific email by Network Message ID and recipient address (mbk505@gmail.com). The histogram chart shows a single delivered message on 23 May 2026, confirming the delivery action and allowing drill-down into email origin, URL clicks, top targeted users, and campaign attribution — demonstrating active threat investigation workflow.