Enterprise IT Security Operations Toolkit

Metric	Value
Total users audited	28
Enabled accounts	27
Licensed accounts	21
Active directory roles	11
Microsoft Secure Score (retained snapshot)	146.26 / 204 (71.7%)
Groups audited	10
App registrations audited	1
Service principals inventoried	241
High-risk OAuth grants detected	3
Mailboxes audited	23
Report types generated	25+
Scripts in toolkit	30+

01

Enterprise Operations Foundation expand

Baseline tenant health, identity hygiene, license governance, MFA compliance, CA auditing, privileged access reviews, and administrative reporting.

Full tenant health snapshot (users, groups, licenses, roles) in a single script
MFA method-level audit — Authenticator, Phone, FIDO2, Passwordless-ready classification
Admin role review with CRITICAL/HIGH/MEDIUM/STANDARD risk tier classification
License waste identification — disabled users holding licenses flagged automatically
User offboarding automation — disable, revoke sessions, remove licenses and groups

02

Identity Threat & Security Operations expand

Microsoft Entra ID Identity Protection workflows — risky users, risk detections, Secure Score analysis, and guest user governance.

Identity Protection scripts prepared for risky-user and risk-detection review
Zero-result risk and guest queries documented honestly; empty exports were not retained
Secure Score analysis — retained lab snapshot scored 146.26 / 204 (71.7%)
Guest user governance — inactive guest detection with external domain mapping

03

Endpoint Enrollment & Intune Operations expand

Microsoft Intune macOS enrollment, Company Portal workflow, managed-device visibility, ownership, and compliance-state review.

Company Portal management-profile installation workflow
Intune managed-device inventory with platform, ownership, and compliance state
Company Portal device-status review
Unsupported Defender incident and recommendation claims explicitly removed

04

BYOD Conditional Access Governance expand

Zero Trust device governance — configured and audited compliant-device requirements for BYOD and personal devices accessing Microsoft 365 resources via Conditional Access.

BYOD device inventory — classifies all Entra ID devices by ownership, trust type, and compliance state
Conditional Access policy audit — identifies policies requiring compliant devices
Three tiered Intune compliance policies: iOS BYOD, Windows Standard, Windows Faculty/Staff
Report-only compliant-device access design documented with Intune policy evidence

05

Exchange Online Mail Flow Audit expand

Automated audit of Exchange Online mail flow security — external forwarding rules, inbox rules, transport rules, anti-spam policies, and litigation hold status.

23 mailboxes audited for unauthorized external forwarding — none detected
Inbox rules scanned for forwarding/redirect actions
Transport rule inventory with state and action documentation
Anti-spam policy coverage verified across inbound, outbound, and connection filtering
3 non-empty CSV reports retained from PowerShell and Exchange Online Management workflows

06

Web-Only Access Governance for Unmanaged Devices expand

Zero Trust web-only access configuration — Conditional Access app-enforced restrictions limiting non-compliant BYOD devices to browser-only access for SharePoint Online and Exchange Online.

CA policy targeting non-compliant devices with device filter rule
App-enforced restrictions session control — browser-only, no native apps, no downloads
PowerShell audit script detects and classifies web-only governance policies
Before/after audit evidence showing 0 → 1 web-only policy detection

07

Entra ID App Registration Audit expand

Automated audit of all Entra ID app registrations, OAuth permission grants, service principals, credential expiry, and high-risk permission assignments.

1 app registration audited — AWS Single-Account Access (SAML SSO integration)
241 service principals inventoried across Microsoft first-party and third-party apps
8 OAuth grants reviewed — full delegated permission inventory
3 high-risk permission grants detected — User.ReadWrite.All, Directory.ReadWrite.All, AuditLog.Read.All
0 expired credentials — no abandoned app registrations
4 CSV reports exported via PowerShell and Microsoft Graph

08

M365 Initial Security Triage expand

Early Microsoft 365 evidence collection — user enumeration, license governance, security group review, and administrative role exposure assessment.

Scenario: a user reports suspicious activity; the administrator uses Microsoft Graph PowerShell to collect early-stage evidence before escalation
25 user accounts enumerated with account status and identity details
3 license SKUs reviewed — consumption and capability status documented
10 security groups inventoried — membership and security enablement verified
11 administrative roles identified — exposure assessment for incident triage
Executive summary report generated for escalation documentation
5 structured reports exported via PowerShell and Microsoft Graph

09

Data Protection & Compliance Operations expand

Microsoft Purview policy design and governance review across DLP, Compliance Manager, Insider Risk Management, sensitivity labels, and retention labels.

DLP policy scope documented across Exchange, SharePoint, OneDrive, and Teams
Sensitive information conditions, alert behavior, user notifications, and overrides reviewed
DLP policy retained in simulation mode for staged validation
Compliance Manager assessments, score snapshot, and improvement actions documented
Insider Risk Management policy design and policy-health evidence captured
Sensitivity-label hierarchy, publishing policy, adaptive scope, and simulation-mode auto-labeling workflow documented
Seven-year retention-label configuration reviewed

10

Microsoft Purview Retention Policy Framework expand

Target-state data lifecycle governance for a fictional 300-user, six-site Microsoft 365 E5 environment.

Retention policy taxonomy across Exchange Online, SharePoint Online, OneDrive, and Teams
Retention-label hierarchy for financial, HR, client, operational, and transactional records
Records-management, legal-hold, archiving, deletion, and audit-review workflows
PowerShell audit script for retention policies, labels, and workload coverage
Explicit separation between design coverage and unverified production outcomes

11

Microsoft Purview DLP Investigation Runbook expand

Target-state DLP investigation, evidence review, escalation, remediation, and stakeholder reporting for a fictional enterprise scenario.

Eight-step workflow spanning DLP alerts, Activity Explorer, audit, eDiscovery, and Insider Risk
Root-cause scenarios and escalation criteria for security, compliance, HR, and business stakeholders
Five DLP rule categories documented as design concepts rather than claimed enforcement history
PowerShell script for date-, policy-, and severity-scoped DLP alert reporting
Fictional organization and reserved example identifiers used throughout

Enterprise IT Security Operations Toolkit

Portfolio Case Summary

What This Proves

Real Lab Results

Multi-Phase Platform Architecture

Platform Architecture

Key Design Decisions & Lessons Learned

Quick Start

Portfolio Ecosystem

Lab Environment Disclaimer