// Projects
Projects & Labs
Architecture diagrams, design decisions and the runbooks that make them operable. Each project includes a write-up oriented to engineers and auditors, not marketing.
Enterprise Entra ID Lab
A full-fidelity Entra ID tenant modeling enterprise identity: hybrid sync, Conditional Access, PIM, and break-glass procedures.
Zero Trust IAM for a Hybrid Cloud
Conditional access and least-privilege identity across Entra ID and AWS for a 2,000-person SaaS company.
Okta → Entra ID Workforce Migration
Consolidated two identity providers after a merger and migrated 120+ SSO apps with zero unplanned downtime.
Zero Trust Proxmox Architecture
A homelab Proxmox cluster rebuilt around Zero Trust principles: identity-aware access, micro-segmentation, and no implicit trust between tiers.
Just-in-Time Privileged Access
Replaced standing admin rights with approval-gated, time-boxed elevation and full session audit.
OPNsense Segmented Network
Multi-VLAN home/lab network with strict inter-segment policy on OPNsense — workstation, lab, IoT and DMZ tiers, each with explicit allow rules.
Azure Conditional Access Lab
A reproducible Conditional Access policy set covering baseline MFA, device compliance, risk-based controls and break-glass exclusions.
IAM Automation with Graph API
Python tooling on top of Microsoft Graph that automates joiner-mover-leaver, group hygiene and orphan account reporting.
Flask OIDC Authentication App
A reference Flask application that delegates authentication to an OIDC provider with PKCE, refresh tokens and role-based access.