SkillsSkills

Microsoft 365

• Tenant & identityDone several times

  • Setting up and hardening tenants, from the education baseline to the BSI template
  • Entra ID: Conditional Access with country blocking, MFA with exclusion groups, tested in report-only mode first
  • Restrictive settings for app registration, consent, guest access and admin center access
  • Break-glass accounts and separate, personal admin accounts
  • Entra B2B for guests, partner model via distributor and GDAP

• Hybrid identityDone several times

  • Entra Connect with its own OU, UPN changes, soft match
  • Moving AD groups and distribution lists to Entra or into M365 groups, with AD staying the source
  • Seamless SSO and device writeback for hybrid devices (from training)

• Exchange Online & mailUsed daily

  • Migrations from on-prem to Exchange Online (remote move, CodeTwo)
  • Shared mailboxes and hybrid setups
  • Turning off legacy auth (SMTP AUTH, POP, IMAP) and enforcing modern auth
  • SPF, DKIM, DMARC, mail filtering (Trend Micro Email Security), archiving via journal rule (MailStore)

• Incident responseUsed daily

  • Handling compromised accounts properly: ending sessions, checking inbox rules, reviewing sign-in logs, tracing messages

• Apps & collaborationDone several times

  • Microsoft 365 Apps via the Office Deployment Tool, including mixed 32- and 64-bit
  • OneDrive and SharePoint with safe sharing, Known Folder Move
  • Teams, M365 groups, Planner, workflows with Power Automate (e.g. Fortinet security advisories posted to Teams automatically)

• Backup & operationsUsed daily

  • M365 backup with Acronis Cyber Protect Cloud as an MSP, including the switch from EWS to Graph
  • License management, offboarding with a shared mailbox
  • PowerShell and Graph for bulk tasks like license assignments and exports

YubiKey, MFA & passwordless

• Strong sign-inDone several times

  • YubiKey 5 and Bio, which I use myself every day: FIDO2/passkeys and PIV/smart card logon
  • Passwordless sign-in with Microsoft Authenticator
  • MFA rollouts at customers, regularly in projects: planning, communication, guides, go-live

• PKI & key managementDone several times

  • Key lifecycle management with Appterix (EgoMind), cloud and on-prem
  • AD Certificate Services: certificate templates, permissions, certutil, NTAuth store
  • Troubleshooting enrollment and connecting the Appterix External API

Infrastructure & network

• VirtualizationDone several times

  • Proxmox as a single server and as a cluster, dozens of VMs and containers set up
  • Hyper-V as a single server, little experience with Hyper-V clusters so far

• WorkstationsDone several times

  • In-place upgrades from Windows 10 to 11 at small and mid-sized businesses, several hundred
  • Complete moves to new PCs with data, programs and settings, dozens

• Windows Server & Active DirectoryBasic knowledge

  • Server and DC migrations with FSMO roles, replication and time sync, done several times as part of a team

• EncryptionBasic knowledge

  • BitLocker and VeraCrypt, comes up every now and then

• Wi-FiDone several times

  • UniFi Wi-Fi with separate networks for staff, guests and devices
  • In my homelab: outdoor access point connected via mesh, channel planning including DFS

• Switching & VLANsBasic knowledge

  • UniFi switching and controller
  • VLANs from hands-on work, at customers and in my homelab, without deep specialization
  • In my homelab: five zones, including my own network, smart home, cameras without internet and guests

• Routing & firewallBasic knowledge

  • UniFi gateways
  • Set up IPsec VPN tunnels a few times
  • I know the basics of firewalls, but haven't set one up completely on my own yet
  • In my homelab: zone-based firewall with every crossing allowed one by one, from outside only the reverse proxy is open

• DNS & remote accessBasic knowledge

  • Split DNS
  • In my homelab: internal names via the gateway DNS, DynDNS for access from outside, VPN from my iPhone back home

• Monitoring & endpoint protectionUsed daily

  • servereye with sensors and alert triage
  • Trend Micro
  • Remote support for customers, day to day

AI & knowledge management

• AI at workUsed daily

  • Picked and rolled out an AI workspace, with Entra SSO and SCIM provisioning via AD groups
  • Langdock: administration and the person responsible for AI, agents and workflows
  • Rebuilt the internal intranet, with Claude Code

• ToolsUsed daily

  • Claude Code, MCP connectors, my own context management
  • Obsidian as a central knowledge base with a clear structure

MS-102 (Microsoft 365 Administrator)

I finished the official training, the exam is next. Here's where I stand in each area.