Bradley Baker · Microsoft identity & Senior Cyber Security Engineer Every sign-in is a decision.

I design the policies that make those decisions and write the code that checks them. Twenty-one years in regulated Microsoft environments, most recently as Global Administrator and identity lead for a 4,300-user tenant spanning multiple countries.

See the work Get in touch Resumé Domain Recon

Reading this portfolio needs no account. Signing in with GitHub, Google, Microsoft, or LinkedIn is optional and only used to sign the guestbook. What sign-in shares

users in the global tenant I ran identity for: 4,300
relying parties moved off AD FS in under a month: about 30
to contain each of three mail-bomb campaigns: 5 to 15 minutes
in regulated enterprise IT, plus six in the Army: 21 years

policy-engine · simulated

Illustrative traffic, no real tenant data.

Field reports

Work that had to go right the first time

Five pieces of work from the 4,300-user tenant where I was Global Administrator, written up in the shape of a change or incident record: context, constraints, actions, outcome.

Tool / Domain Recon

See what a domain runs on, from Microsoft 365 to Google Workspace and Okta

Enter a domain, an onmicrosoft.com name, or an email address. The report names the platforms behind it, then lists the Microsoft tenant ID, every domain, how each one signs in, and the mail records, from public endpoints and DNS only.

Open the lookup

Experience

From the Tier I help desk to Global Administrator

Twenty-one years across clinical research, local government, real estate, and consumer finance. Every one of those employers ran under HIPAA, PCI DSS, SOX, or CJIS.

Jan 2021 – Sep 2026
5 yrs 9 mos
New Braunfels, TX
Worldwide Clinical Trials
IT Applications Administrator (Identity & M365 Lead)
New Braunfels, TX
Microsoft 365 Global Administrator and identity lead for a 4,300-user tenant spanning multiple countries in regulated clinical research. Escalation point for identity and email-security incidents.
12 highlights
- Owned Entra ID administration: Conditional Access design, MFA enforcement, self-service password reset, role and group lifecycle, and hybrid identity through Entra Connect.
- Ran new Conditional Access policies in report-only mode through a full business cycle before enforcement, and configured FIDO2 security keys, Windows Hello for Business, certificate-based authentication, and Identity Protection risk policies.
- Ran Azure PIM so consultant, vendor, and internal administrator accounts activated roles just in time under zero standing privilege, with approval workflow and periodic access validation.
- Onboarded enterprise applications to SSO over SAML 2.0 and OIDC/OAuth 2.0, managing app registrations, service principals, API permission grants, and consent policy.
- Upgraded the AD FS farm through 2012 R2, 2016, and 2019, recovered it from a catastrophic crash, then moved roughly 30 relying parties to Entra ID in under a month and decommissioned the farm.
- Administered roughly 200 Mimecast policies across 35+ categories, including DLP for PHI, PII, and clinical-trial data, enforced DMARC, SPF, and DKIM tenant-wide, and closed a mail-flow path that let senders deliver around the gateway.
- Contained three coordinated mail-bomb campaigns against 30 to 45 high-value mailboxes within 5 to 15 minutes of each first wave, with no business disruption.
- Administered Defender for Endpoint (EDR policy, alert triage, device isolation), Defender Vulnerability Management, and Defender for Office 365 investigations, and worked phishing triage with the SOC across hundreds of reports a month.
- Ran Intune enrollment for corporate and BYOD devices, compliance and configuration policies, and app deployment and protection.
- Deployed and administered Microsoft 365 Copilot for the tenant and built 20 agents in Copilot Studio.
- Automated tenant administration in PowerShell and Microsoft Graph, exported policy state before every change, and ran scripts through Azure DevOps branches and pull requests for about two years.
- Wrote security policies the company adopted and coached Tier 1 and Tier 2 staff near-daily with documented resolutions.
- Entra ID
- Conditional Access
- Azure PIM
- AD FS
- Intune
- Exchange Online
- Mimecast
- Defender XDR
- Purview
- Copilot
Dec 2019 – Jan 2021
1 yr 2 mos
New Braunfels, TX
City of New Braunfels
System Administrator
New Braunfels, TX
Systems administration across 500+ devices and every city department, including systems that handled criminal justice information.
5 highlights
- Administered Active Directory account lifecycle, Group Policy, and AD FS, plus Microsoft 365 identity, mail flow, and endpoint configuration.
- Applied CJIS Security Policy controls to city systems that handled criminal justice information.
- Deployed software and patches through SCCM, ran vulnerability scans, and made firewall rule and ACL changes.
- Configured Microsoft Purview, ran the internal AD CS certificate authority, and wrote security policies the city adopted.
- Rebuilt SQL Server maintenance plans for legacy line-of-business databases, and supported staff, department heads, and elected officials at Tier 2 and Tier 3.
- Active Directory
- CJIS
- SCCM
- AD CS
- Purview
- Group Policy
Jan 2015 – Dec 2019
5 yrs
Austin, TX
Capstone Real Estate Services
IT Systems Manager
Austin, TX
Ran the IT function for about 70 internal staff and 650+ external property-management customers, a multi-client model closer to managed services than internal support.
5 highlights
- Led IT operations, identity, infrastructure, backup, and security policy across the Microsoft stack.
- Ran Office 365 and Exchange Online end to end: user lifecycle, mail flow, mobile devices, SharePoint site builds, permissions, and AD FS-federated SSO for line-of-business SaaS.
- Designed and deployed the company's Hyper-V environment in an infrastructure refresh that added hybrid on-site and cloud backup, redundant offsite servers, and power backup.
- Held HIPAA and PCI DSS posture through patching, vulnerability scanning, firewall and ACL management, risk reviews, and access-policy enforcement.
- Built a self-service knowledge base and onboarding material for new external customers, which cut repeat support tickets.
- Office 365
- Hyper-V
- HIPAA
- PCI DSS
- AD CS
- Backup
Jun 2014 – Jan 2015
8 mos
Austin, TX
EZCORP
Systems Administrator
Austin, TX
Exchange and systems administration in consumer financial services under SOX.
3 highlights
- Stood up a patching process through Configuration Manager where none had existed.
- Resolved more than twice the Exchange ticket volume of peers with a 99% first-time-right rate.
- Supported SOX compliance, SolarWinds SIEM monitoring, and Exchange legal hold and eDiscovery with the security team.
- Exchange
- SCCM
- SOX
- eDiscovery
Aug 2005 – Jun 2014
8 yrs 11 mos
Austin, TX
PPD
Systems Administrator (five roles in nine years)
Austin, TX
Started as a Tier I help desk technician and was promoted four times, ending as a systems administrator in a large regulated clinical-research environment.
4 highlights
- Administered Active Directory, AD FS, Group Policy, DNS, and DHCP, owning account lifecycle and security baselines.
- Kept 1,000+ servers at roughly 50 global sites on uniform monthly patch cycles through Configuration Manager, with compliance reporting.
- Administered Citrix application virtualization, stood up MDM for corporate devices, and kept in-scope systems SOX compliant.
- Set up change-distribution control for desktop environment changes and worked SolarWinds SIEM with the security team.
- Active Directory
- SCCM
- Citrix
- SOX
- MDM

Education

B.S., Information Systems Security
ITT Technical Institute, 2014. Honors graduate, 3.64 GPA.
A.S., Computer Electronics Engineering Technology
ITT Technical Institute, 2004

Capabilities

What I've run, what I've built, and what I haven't

Each entry says where the experience came from. Production means an employer's environment with real users and an auditor. Built and published means a public repository you can read.

Production. Ran it in an enterprise environment with real users and an auditor.
Built & published. Built it in a public repository, outside employer work.
Not yet in production. Familiar with it, but have not run it for an employer.

Identity & access

Entra ID, Production
Conditional Access, MFA, SSPR, Identity Protection risk policies
Global Administrator and identity lead, 4,300-user tenant, 2021–2026
Passwordless, Production
FIDO2 security keys, Windows Hello for Business, certificate-based authentication
Configured at Worldwide Clinical Trials; reference architecture in entra-authn-toolkit
Privileged access, Production
Azure PIM, just-in-time activation, zero standing privilege, access validation
Consultant, vendor, and internal administrator classes at Worldwide
Federation & SSO, Production
AD FS, SAML 2.0, OIDC/OAuth 2.0, app registrations, service principals, consent policy
Retired a two-server AD FS farm, ~30 relying parties in under a month
Hybrid directory, Production
Active Directory, Entra Connect, Group Policy, DNS, DHCP
Every employer since 2005
PKI, Production
AD CS certificate authorities, certificate lifecycle
Internal PKI at four employers

Microsoft 365

Exchange Online, Production
Mail flow rules, connectors, hybrid routing, DMARC, SPF, DKIM
Tenant-wide sender authentication at Worldwide; Exchange at five employers
SharePoint, OneDrive, Teams, Production
Configuration, permission governance, guest and external sharing
Worldwide and Capstone
Copilot, Production
Microsoft 365 Copilot administration, Copilot Studio agents
Deployed Copilot for the Worldwide tenant; built 20 Copilot Studio agents
Purview, Production
Sensitivity labels, retention, eDiscovery
Configured at Worldwide and the City of New Braunfels

Endpoint

Intune, Production
Corporate and BYOD enrollment, compliance, configuration, app protection
Tenant-wide at Worldwide, feeding device-based Conditional Access
Configuration Manager, Production
Patch cycles, software deployment, compliance reporting
1,000+ servers at ~50 sites (PPD); stood up patching at EZCORP
Hardening, Production
CIS Benchmarks, Microsoft security baselines, Group Policy
Group Policy baselines at PPD and at the City of New Braunfels under CJIS
Virtualization, Production
Hyper-V, Citrix application virtualization
Designed Capstone's Hyper-V environment; Citrix at PPD

Security operations

Defender XDR, Production
Defender for Endpoint, Defender Vulnerability Management, Defender for Office 365
EDR policy, triage, device isolation, and mail investigations at Worldwide
Email security, Production
Mimecast policy and DLP, phishing triage, message-trace forensics
~200 policies in 35+ categories; three mail-bomb campaigns contained
Secure web gateway, Production
Zscaler Internet Access policy
Global user base at Worldwide
Network controls, Production
Firewall rules, ACLs, vulnerability scanning
Capstone and the City of New Braunfels

Compliance

HIPAA, PCI DSS, SOX, CJIS, Production
Control operation, audit readiness, access reviews, evidence preparation
Every employer since 2005 carried at least one of these
NIST SP 800-171 / CMMC 2.0 L2, Built & published
Control mapping and automated evidence
overwatch7six-netauto-demo maps configuration compliance to 800-171 Rev 2
NIST SP 800-53 Rev 5, Built & published
Control-to-service mapping for cloud infrastructure
aws-regulated-landing-zone compliance mapping

Automation & software

PowerShell & Microsoft Graph, Production
Tenant administration, inventory, migration scripting
AD FS migration; two years under Azure DevOps pull-request review
Azure DevOps, Production
Pipelines, branches, pull-request review for tenant automation
About two years at Worldwide Clinical Trials
GitHub Actions, Built & published
OIDC federation to AWS, tflint, tfsec, Checkov, pytest
aws-regulated-landing-zone and entra-authn-toolkit pipelines
Terraform, Built & published
Multi-account AWS organization, SCPs, delegated security services
aws-regulated-landing-zone
Python, Built & published
Log analysis, pytest, Nornir network automation
entra-authn-toolkit sign-in analyzer; netauto demo
TypeScript & Node.js, Built & published
CLIs, zod validation, Anthropic SDK
digital-health-marketing audit CLI; this site
React & Next.js, Built & published
App Router, server components, server actions
This site
Postgres & Supabase, Built & published
Row-level security, security-definer functions, auth
This site's guestbook, contact, and easter-egg counters
Cloudflare Workers, Built & published
Edge rendering, rate-limit bindings, static assets
This site

Not yet in production

These come up in job postings often enough to answer before anyone asks: I have not run any of them for an employer. Most sit on top of work above. Azure Virtual Desktop, for one, runs on the same Entra ID, Conditional Access, and Intune foundation I ran for years.

Microsoft Sentinel analytics rules, SOAR playbooks, and UEBA
Azure network resource plane: VNets, NSGs, ExpressRoute, VPN gateways
Azure Virtual Desktop and Windows 365
Teams Phone and Direct Routing
Okta, PingFederate, or SailPoint migrations to Entra ID
Tenant-to-tenant consolidation

Projects

Built in public, with the caveats written down

Independent work published under Patriot 7Six LLC, the company I formed in December 2025. Each README states what has been tested, and the cards below repeat it.

Patriot7Six/entra-authn-toolkit
Entra Authentication Ops Toolkit
Policy-as-code for Entra ID authentication. Exports Conditional Access and the Authentication Methods Policy to timestamped JSON, diffs snapshots for drift, and analyzes sign-in logs for legacy authentication and passwordless adoption.
- Drift detector exits non-zero when policy changes, so it can gate a CI pipeline.
- Read-only Microsoft Graph scopes only; nothing in the toolkit writes to a tenant.
- Includes a phased FIDO2, Windows Hello for Business, and certificate-based authentication rollout design.
Status Sign-in analyzer tests pass on synthetic data. The PowerShell scripts target the current Graph SDK but have not yet run against a live tenant.
- PowerShell
- Microsoft Graph
- Python
- pytest
- Pester
- GitHub Actions
Patriot7Six/entra-iam-field-assessment-kit
Entra IAM Field Assessment Kit
A customer-facing IAM assessment for Entra ID environments. Scores Mean Time to Enable, reviews SSO and MFA coverage, privileged access, joiner-mover-leaver lifecycle, and service accounts, and turns findings into a remediation plan.
- Demo mode runs on sanitized CSV and JSON; tenant mode reads Graph with read-only scopes.
- Redaction helper swaps IDs and display names for stable pseudonyms so relationships stay traceable in published reports.
- Writes an evidence ledger and a redaction checklist alongside the report.
Status Tenant mode has not been execution-tested against a live tenant. Cmdlet names are checked against Microsoft's Graph PowerShell documentation.
- PowerShell
- Microsoft Graph
- Terraform
- Mermaid
Patriot7Six/aws-regulated-landing-zone
AWS Regulated Landing Zone
A five-account AWS foundation for regulated workloads in Terraform: an organization CloudTrail into an Object Lock log archive, delegated GuardDuty and Security Hub, Transit Gateway with DNS Firewall, and SCP guardrails.
- CI authenticates to AWS through GitHub OIDC federation, with no long-lived access keys.
- tflint, tfsec, and Checkov run on every pull request; apply requires manual approval.
- Architecture decision records, a STRIDE threat model, and a control mapping to HIPAA, NIST SP 800-53 Rev 5, and PCI DSS v4.0.
Status Modules and CI pass code review. They have not yet been applied to a live AWS account.
- Terraform
- AWS Organizations
- GitHub Actions
- Checkov
- tfsec
Patriot7Six/overwatch7six-netauto-demo
CMMC Network Compliance Automation
Configuration compliance for a virtual branch network. Renders golden configs from a Nautobot source of truth, detects drift on Arista cEOS devices, remediates with Nornir, and writes a dated evidence pack mapped to NIST SP 800-171.
- Runs the whole drift, detect, remediate, re-verify loop on a single Ubuntu host.
- Custom Nautobot job renders intended configs with no paid plugins.
- Evidence pack records device inventory, compliance diffs, and operator attribution.
Status Runs end to end on one host. Requires a free Arista account for the cEOS image.
- Python
- Nautobot
- Nornir
- Containerlab
- Jinja2
- Arista cEOS
Patriot7Six/Digital-Health-Marketing
Healthcare Acquisition Audit CLI
An outside-in audit for multi-location healthcare providers. Reports technical SEO defects, advertising pixels that sit near intake forms, local listing consistency, and answer-engine visibility, with a confidence level on every finding.
- Public data only: obeys robots.txt per RFC 9309, rate-limits per host, and never authenticates.
- The anonymizer refuses to write a report if any reference to the target survives.
- Findings store the observation and the recommendation as separate fields.
Status 43 assertions run with no network access.
- TypeScript
- Node.js
- cheerio
- zod
- commander
- Anthropic SDK
Patriot7Six/ai-security-guardrails
AI Security Guardrails
A starter kit for putting guardrails around AI tools in a Microsoft 365 tenant. Finds the AI apps people connected through OAuth consent, scores what each one can reach, closes the consent path, and adds a policy and review checklist for new tools.
- Inventory sends GET requests only, with three delegated read scopes. Every finding lists the reasons behind its score.
- Consent policy script has a plan mode that never signs in, supports -WhatIf, and reads the policy back after each write.
- Acceptable use policy template and tool risk checklist map to NIST AI RMF, NIST AI 600-1, and the OWASP Top 10 for LLM Applications.
Status Runs offline against a synthetic Contoso tenant. The live collector has only run against that snapshot and is untested against a real tenant.
- PowerShell
- Microsoft Graph
- Pester
- PSScriptAnalyzer
- GitHub Actions
bradbaker-it.com
This site
Next.js 16 and React 19 rendered on Cloudflare Workers, with Supabase Postgres behind row-level security for the guestbook, the contact form, and the easter-egg counters. It reads your hardware in the browser to decide which easter eggs you get, and keeps the raw details there.
How it's built

Standing orders

How I work

The rules I held myself to in production, stated as plainly as I could.

New Conditional Access policies run in report-only mode through a full business cycle before they enforce anything.
Device-based Conditional Access waits until there is compliance data to feed it.
Export the policy state before every change so there is something concrete to roll back to.
Automation changes go through branches and pull-request review.
Copilot surfaces whatever a user can already reach, so permissions, sensitivity labels, and DLP are the real AI controls.
Give people a safe way to use AI instead of a ban they will work around.
State the gaps up front. A technical screen is a bad place to discover them.

Service

Before IT: six years in the Army

Infantry with the 82nd Airborne Division and the 172nd Infantry Brigade, leaving as a sergeant and squad leader.

Bradley Baker in desert camouflage on deployment with the U.S. Army — On deployment, U.S. Army

Branch: U.S. Army
Service: Mar 1996 – Jul 2002
MOS: 11B Infantryman
Final rank: Sergeant (E-5)
Foreign service: 3 years, 3 months
Deployments: Saudi Arabia, Thailand
Discharge: Honorable
Status: Service-connected disabled veteran

Mar 1996 – Mar 1999
Team Leader, E-4
82nd Airborne Division
Led a three-person fire team and was accountable for $250K in equipment.
Apr 1999 – Jul 2002
Squad Leader, Sergeant (E-5)
172nd Infantry Brigade
Led an eight-person infantry squad and held personal accountability for government equipment valued over $500K.

Expert Infantryman Badge, a multi-day evaluation of infantry skills that a small fraction of candidates pass
Leadership Development Training

Under the hood

This page is part of the portfolio

The same habits as the identity work, applied to a web app: least privilege, policy you can read, and tests that prove the policy does what it says.

Browser

React 19 client components
Canvas 2D decision stream
Recon probes (local only)

Cloudflare edge

Next.js 16 on Workers via OpenNext
proxy.ts: CSP nonce, host redirects
Rate-limit bindings
Immutable static assets

Supabase

Postgres with row-level security
Auth: OAuth with PKCE
Security-definer functions

Request path. The guestbook also reaches Supabase straight from the browser with the publishable key. On that path row-level security is the only control, by design.

A fresh CSP nonce on every response

Scripts run only if they carry this response's nonce, with no unsafe-inline and no unsafe-eval. The cost is real: every HTML page renders per request on the Worker instead of being served as cached static HTML. For a site that belongs to a security engineer, that trade is worth it.

Row-level security is the authorization layer

The browser holds a publishable key and nothing more. Postgres policies decide what that key can do: read approved guestbook entries, insert one pending entry as yourself, and withdraw your own. Column grants stop anyone from setting a status or display name, or reading which account wrote an entry, and a trigger copies the name from your OAuth profile.

Writes that matter go through the Worker

Contact messages and easter-egg counters are written with a secret key that exists only as a Worker secret. Requests are validated with zod and rate-limited at the edge before they reach the database. The contact form also accepts a Cloudflare Turnstile check.

Hardware recon stays in your browser

WebGPU, WebGL, User-Agent Client Hints, and media queries run client-side. When an egg fires, its id is the only thing sent back, with no identifier attached, and nothing is sent at all when Global Privacy Control or Do Not Track is on.

Graceful at both ends of the hardware range

Flagship GPUs get more particles. Software renderers, Data Saver, low batteries, and reduced-motion settings get a still frame. The animation pauses whenever it scrolls out of view or the tab is hidden.

Tested where it can break

Unit tests cover GPU string parsing, every egg rule, the CSP builder, WCAG contrast for both themes, and the writing standard for all site copy. The RLS policies run against a real Postgres in CI. Playwright loads the page at 320 pixels wide and at 8K.

supabase/migrations · the guestbook insert policy

create policy "users insert their own pending entry"
  on public.guestbook_entries for insert to authenticated
  with check (user_id = (select auth.uid()) and status = 'pending');

Guestbook

Sign the guestbook

A small, moderated wall for people who came by. It's also the one part of this site where your browser talks to the database directly, so row-level security does real work here.

Sign to leave a note

Signing in is optional and only used for this guestbook, so every note has a real author. The provider you pick shares your basic profile with this site, such as your name, email address, and profile picture. Your name appears with your note once I approve it. Your email address and picture are never shown, and the site reads nothing beyond that basic profile.

What is stored, and how to delete it, is in the privacy policy.

Loading entries…

Contact

Bradley Baker · Microsoft identity & Senior Cyber Security Engineer Every sign-in is a decision.

Retiring AD FS on a live enterprise

Three mail-bomb campaigns, contained in minutes

Zero standing privilege with Azure PIM

Conditional Access, measured before it enforces

Email security for regulated data

See what a domain runs on, from Microsoft 365 to Google Workspace and Okta

Worldwide Clinical Trials

City of New Braunfels

Capstone Real Estate Services

EZCORP

PPD

Identity & access

Microsoft 365

Endpoint

Security operations

Compliance

Automation & software

Not yet in production

Entra Authentication Ops Toolkit

Entra IAM Field Assessment Kit

AWS Regulated Landing Zone

CMMC Network Compliance Automation

Healthcare Acquisition Audit CLI

AI Security Guardrails

This site

Team Leader, E-4