Mark Saweres

Acquisition cutover

Intune · Acquired team moving tenants

60+ apps

from many vendors, packaged and tested in under two weeks

IntuneAutopilotPowerShellPIM

Problem

A team of 20 from an acquired company was moving into the parent company's Microsoft 365 tenant on a fixed cutover date, with a 94-entry software list of specialist tools, drivers, and utilities that all had to install silently through Intune.

What I built

A PowerShell toolkit that detects each installer's engine and builds Intune packages, with install, uninstall, and detection rules, from a single JSON manifest.
Silent installs for MSI, InstallShield, NSIS, Inno, WiX bundles, self-extractors, portable apps, and driver INFs, consolidating component rows (for example, 20 rows from one vendor into 6 apps).
Every app tested through Company Portal on an Autopilot test machine for silent install, launch, and silent uninstall, working under least-privilege PIM roles.

Result

All 94 entries were covered by Day 1, delivered as 60+ tested Intune apps. I also gave the client's security team the findings they needed, each with a proven fix: an attack surface reduction rule blocking plug-ins, a driver blocked by memory integrity with a supported replacement, and a signed driver that only installed after I imported the publisher certificate.

Swipe sideways to see the whole diagram →

Every package went through the same loop: build from the manifest, deploy through Intune, prove install, launch, and uninstall on a test machine, and fix or escalate anything that failed.

Access that follows the job

Automation · HR system to Entra ID

3,170

employee records processed per full sync

PowerShellMicrosoft GraphREST APIsEntra ID

Problem

Purchasing roles had to be changed by hand whenever someone was hired, changed jobs, or left, so access depended on a ticket getting filed and worked.

What I built

A sync that pulls the employee roster from the HR system's REST API and assigns each person to Entra ID security groups by job title, status, and supervisor.
Those groups drive purchasing roles, so the right access lands automatically, and inactive or terminated staff are removed on the next run.
App-only Microsoft Graph auth through a dedicated Entra app registration, retry with backoff when Graph throttles, and an exception list for HR edge cases.
A logging system that records every add, move, and removal on each run, with size-based rotation, so any access change can be traced back to the run that made it.

Result

Joiners, movers, and leavers are handled by the sync instead of tickets, so purchasing access stays in step with the HR record.

Swipe sideways to see the whole diagram →

One run sorts every employee into joiner, mover, or leaver by job title, status, and supervisor, then updates the Entra ID groups that drive purchasing roles.

Facilities management app

Power Apps · Nonprofit client

In production

for a 600+ person organization, without per-user premium licenses

Power AppsPower AutomateMicrosoft GraphPythonEntra ID

Problem

Facilities data lived in flat SharePoint lists. Staff needed one place for compliance dates, tickets, and emergency documents, where each person sees only their own facilities and role, without buying premium licenses for 600+ people.

What I built

A canvas app with five roles, resolved from Entra security groups through a flow that calls Microsoft Graph.
A searchable facility gallery with eight tabs per facility, from finance and vendors to files, programs, and compliance.
A broker pattern: flows run under a service account, so users never get direct access to the lists, and a mapping list scopes each person to their facilities.
A Python service that syncs the HR roster into SharePoint with app-only Graph auth scoped to one site. It upserts records, logs every run, and fails closed if the roster comes back empty.
A compliance tab tracking 15 expiration dates with 30, 60, and 90-day reminders.
Separate dev, demo, and prod environments with managed solutions and a custom security role.

Result

The Python sync replaced a per-user premium flow, so the organization avoids premium licensing for 600+ staff. After a live demo to the organization's VPs, the app went into production and is now in the final phase of a five-phase rollout to all staff.

Facility gallery with search, photo cards, and links to the console, IT ticketing form, and maintenance form — Real screens from the app. Facility names, addresses, photos, and client branding are blurred.

Facility page with eight tabs, showing the Files tab with document folders — Real screens from the app. Facility names, addresses, photos, and client branding are blurred.

Swipe sideways to see the whole diagram →

Staff never get direct access to the lists. Every read and write goes through flows running as a service account, and the HR roster arrives through a separate Python sync with access to one site only.

Case management app

Power Apps · Apprenticeship program

150+

apprentices tracked by 11 career navigators

Power AppsSharePointEntra IDALM

Problem

A program with 11 career navigators needed one place to track 150+ apprentices: their status, meeting notes, and course progress, with a meeting summary that could be shared with the program's corporate partner.

What I built

A six-screen canvas app over four SharePoint lists, starting from a roster that filters by navigator and status and flags each apprentice red, yellow, or green.
An apprentice page that brings together meeting notes and course enrollments, with dated progress updates for each course.
Structured meeting notes with separate personal, academic, and professional updates, plus a summary meant for the partner.
Dev and Prod environments with managed solution releases. I chose solution export and import over Pipelines, because Pipelines needs Managed Environments, which would have meant a standalone Power Apps license for every user.
Access through Entra security groups, verified on partner-issued laptops.

Result

The app went live in production in late September 2026 for the program's career navigators.

Apprentice roster with search, navigator and status filters, and red, yellow, and green status bars — Real screens from the app. Apprentice names, notes, and client branding are blurred.

Apprentice page showing meeting notes and course enrollments — Real screens from the app. Apprentice names, notes, and client branding are blurred.

I run IT for organizations, then automate the work behind the tickets.

Selected work

Acquisition cutover

Problem

What I built

Result

Access that follows the job

Problem

What I built

Result

Facilities management app

Problem

What I built

Result

Case management app

Problem

What I built

Result

More work

Phishing-resistant sign-in

SharePoint migration toolkit

Endpoint security rollout

Conflicts portal

Code projects

AI Shorts pipeline

Plated

Starbucks ordering system

Skills

Experience