Latest
Entra ID & Identity
Conditional Access policy design: the failure modes the documentation leaves out
18 min
Read it
Microsoft MVP / Microsoft 365
Everything I work out about Microsoft 365, written down.
Software developer and M365 specialist. Notes on .NET, Azure, Intune and Copilot rollouts that survive contact with real tenants, plus reviews of the hardware and software I actually run.
Microsoft MVP.NET / AzureIntune / Exchange Online
a tenant, end to end
tracing
- 01 Identity and devices Entra ID / Intune / 1,842 devices compliant
- 02 Data and labels Purview / SharePoint / Exchange 4 tiers
- 03 Services I build .NET 10 / Graph / Azure traced
- 04 Copilot on top Grounding scoped to labelled content ring 2
- Writing on
- .NET, AI, M365
- Reviews
- Hardware + software
- Lab
- 4U / 48 cores / 10GbE
- Based in
- United Kingdom
- Microsoft MVP / Microsoft 365 Apps and Services
- 4 devices and services tested
- lab-01 / 48 cores / 256 GB / 10GbE
- Book: 4 of 14 chapters drafted
- Writing from United Kingdom
Browse by service
What is on fire today?
Latest writing
Notes from real tenants
-
080
Create sensitivity labels in Microsoft Purview: the publishing step everyone misses
-
079
Forcing an Intune sync, and the three problems that look exactly like a sync failure
The admin centre Sync action got fuller in 2607, and the properties catalog can now read the registry. Neither fixes a policy that was never going to apply. -
078
Custom compliance settings for macOS in Intune: the script, the rules, and the type mismatch that wastes your afternoon
New in service release 2607. A shell script that emits JSON, a rules file that judges it, and strict data types that fail quietly when you get them wrong. -
077
Governing browsing with Copilot in Microsoft Edge from Intune
Edge 149 brought the Copilot governance policies into the settings catalog. Two of them decide whether page content is read. The rest just change what a tab looks like. -
076
Controlled Configuration for Defender: deciding which channel actually owns your antivirus settings
New in preview: Intune-delivered Defender settings can now override Group Policy, Configuration Manager and local scripts. Useful, and not something to switch on tenant-wide.
Hardware and software
Tested, then written up
8.4/10
Playwright MCP 0.0.79 browser automation server
Fast, complete and officially maintained. The constraint is not speed, it is that one snapshot of a content-heavy page can eat 31,800 tokens of context.
- Version
- @playwright/mcp 0.0.79, Playwright 1.63.0-alpha
- Runtime
- Node 22.23.2, official Docker image
- MCP protocol
- 2025-06-18, streamable HTTP
- Tools exposed
- 24
8.2/10
Jellyfin 10.11.11 media server
Boots in under five seconds and idles at 140 MiB, a fraction of anything else here. Transcoding on a laptop CPU tops out around two 1080p streams.
- Version
- Jellyfin 10.11.11, single container
- Transcode engine
- Bundled FFmpeg 7.1.4-Jellyfin, software x264
- Tested on
- i5-10210U, 4 cores / 8 threads, no GPU acceleration
- Boot to API
- 4.9 s from up -d
The lab
Where the numbers come from
Three compute nodes, one storage node and a switch that has never needed a reboot. Hardware runs the same workload set for at least ninety days, power logged at the wall. Software gets tested in a tenant with real users in it, not a demo tenant.
- 4
- Devices and services tested
- 90d
- Minimum soak before a score
- 48
- Cores in the rack
- 81
- Notes published
Books
What I am writing, and how much of it you can read
Two titles in progress. How much of each one you can read before it ships depends on who is publishing it, and each book says so on its own page.
Writing now
Apress
Sample chapter
Enterprise Copilot Architecture with .NET
3 of 14 chapters drafted
21%
Chapter 4 is readable here. The rest ships with the book.
Next up
- 04 Extending Copilot with .NET
- 05 Grounding, retrieval and the data boundary
- 06 Identity, consent and least privilege