Passwordless GitHub Actions to Azure with Federation
Replace expiring client secrets in GitHub Actions with Workload Identity Federation. This walkthrough sets up an Entra ID App Registration, scoped federated credentials, and a clean azure/login step so your pipelines authenticate to Azure with short lived OIDC tokens.
Real-time Entra ID Break-glass Sign-in Alerts (Part 2)
Part 2 of the real-time Entra ID series. Stream sign-in logs through diagnostic settings to an Event Hub, consume them in the same Azure Function App, and page on duty the moment a break-glass UPN signs in or sign-in risk crosses a threshold.
Real-time Entra ID Group Alerts with Azure Functions (Part 1)
Get notified the moment someone joins your Global Admins or a Tier 0 access group. Part 1 of a two-part series builds an Azure Function App that consumes Microsoft Graph change notifications, validates the webhook, and posts Teams alerts on every membership change.
End-to-End User Offboarding with Microsoft Graph PowerShell
Leavers retaining residual access is a chronic security risk. This walkthrough turns one HR row into a fully offboarded user with sessions revoked, mailbox converted to shared, OneDrive transferred to the manager, groups cleared, and licences released, all with a clean audit trail.
Automating Intune Win32 App Packaging with GitHub Actions
Intune’s Win32 app channel is powerful, but its packaging workflow is stuck in 2018. Here is a GitHub Actions pipeline that builds .intunewin packages, uploads them to Intune through Microsoft Graph using federated credentials, and keeps every app’s metadata version controlled in Git.
Cleaning Up Stale Entra ID Devices with Microsoft Graph PowerShell
Stale device records bloat Conditional Access scope and skew Intune compliance numbers. This walkthrough shows how to find, classify, disable, and eventually delete inactive Entra ID devices with Microsoft Graph PowerShell, with full audit safety.
Entra ID PIM Role Activations with PowerShell
Skip the Entra admin portal clicks for routine maintenance windows. This walkthrough shows how to list, activate, and deactivate PIM role assignments in PowerShell with the Microsoft Graph SDK, including a batch helper for change tickets.
Conditional Access Policy Backups via PowerShell
Conditional Access policies are critical Entra ID security controls, but many tenants have no backup or version history. This walkthrough builds a short PowerShell script that exports every CA policy to JSON and commits it to Git, giving you an auditable, restorable baseline you can schedule in Azure Automation or GitHub Actions.
Articles
- Passwordless GitHub Actions to Azure with Federation
- Real-time Entra ID Break-glass Sign-in Alerts (Part 2)
- Real-time Entra ID Group Alerts with Azure Functions (Part 1)
- End-to-End User Offboarding with Microsoft Graph PowerShell
- Automating Intune Win32 App Packaging with GitHub Actions
- Cleaning Up Stale Entra ID Devices with Microsoft Graph PowerShell