What I do
I work on enterprise-scale Azure infrastructure — landing zones, identity and the
automation that keeps both from drifting. Most of my time goes into Terraform,
PowerShell and the parts of Azure that only reveal themselves once something is
actually in production.
The work I find most interesting sits between “it deploys” and “it survives”: the
permission model that still makes sense six months later, the runbook that handles
the exception nobody planned for, the tag that quietly turns into an invoice nobody
approved.
I started with Azure Virtual Desktop in 2019, where a session host costs money every
hour nobody is looking at it. That is where the habit came from — if a machine can
decide for itself when to switch off, it should.
How I write
Every article here started as a problem at work. I write things down at the point
where the documentation ran out and I had to work it out the hard way, which means
you get the version with the dead ends still in it rather than the tidy one.
Where there is code, it is on GitHub and it is the code I actually ran. Where there
is a number, it came out of a real tenant. Nothing here is a product demo in disguise.
If a post saves you an afternoon, that is exactly what it was for.
What I’m working on now
TenantThrift is in beta — a hosted, read-only scan that finds the Azure spend
nobody signed off on and puts a euro amount next to every finding, along with the
fix. It connects through admin consent in a few minutes: Reader role, nothing to
deploy, no agents.
Least Privilege Studio came out of the same frustration on the identity side.
Pick the actions you actually need and get back the narrowest built-in roles that
cover them — or paste in your Terraform and let it work out the permissions your
deployment needs.
Both started as a script I wrote for one problem and kept reaching for. Most of what
is on the Tools page did.