Hello, I'm
Microsoft 365 & Cybersecurity Engineer
I secure, audit and automate Microsoft 365 environments. From support to security, I turn field needs into tools that run in production.
Paris area · FR / EN / IT
I read Microsoft 365 logs, alerts and configurations like an attacker, I measure read-only, I prove every finding, then I fix with human approval. The result: tools that run in production, not slides.
Microsoft 365 & Intune security audit
Software I design, build and sell on my own: it audits a full Microsoft 365 tenant read-only and produces a client-ready report mapped to CIS, ISO 27001, NIS2, ANSSI and GDPR.
Microsoft 365 security investigation & audit agent
An augmented SOC analyst: it reads Defender XDR, Entra ID, Exchange, Intune, Purview and Sentinel read-only, investigates with KQL hunting and returns a full report — verdict, timeline, indicators, MITRE ATT&CK, remediation — or a three-level security audit.
Microsoft 365 security monitoring platform
Microsoft 365 logs turned into detections and dashboards: compromised accounts, exfiltration, invoice fraud. Started as a lab, now a multi-customer platform with data isolation.
Microsoft Defender phishing simulations and awareness training, run for every school of a group from a single interface, with sending guardrails and strict GDPR handling.
authentication methods audit
Measure real adoption of MFA, passwordless and phishing-resistant methods without creating an App Registration or a secret. First a local web dashboard, then a native Windows application.
network intrusion detection (IDS)
A Suricata IDS on my Internet-facing server: 53,500 ET Open rules, alerts in EveBox, SSH bots banned, and a commented report produced by a read-only AI agent.
From identity to endpoints, from detection to audit.
Defender XDR incident investigation, KQL hunting, Sentinel, compromised account analysis (AiTM, OAuth consent, inbox rules), MITRE ATT&CK.
Microsoft 365 posture audits mapped to CIS, ISO 27001, NIS2, ANSSI and GDPR; ISO 27001 ISMS preparation.
Entra ID, Conditional Access, MFA and phishing-resistant methods, PIM, Active Directory, SAML federation and OIDC SSO.
Intune (compliance, updates, apps, LAPS), Exchange Online, Teams, SharePoint, Purview DLP and labels.
Tools in PowerShell, Python, Node.js and C# on Microsoft Graph; AI agents with guardrails and human approval.
OpenSearch, Splunk, Wazuh, Suricata; Azure (VMs, networking, NSGs, RBAC), Docker, Linux, Cloudflare, tenant-to-tenant migrations.
I measure.I prove.Then I fix.
Read the tenant read-only, on complete lists, no sampling.
Every finding rests on evidence that was read, never on assumptions.
Propose the fix, have a human approve it, then apply it.
Detections, reviews and regular audits so it holds over time.
How my tools turn Microsoft 365 logs into decisions. Click a stage.
Sign-in, unified audit, mail logs and Defender alerts from every tenant, read-only.
Automatic ingestion resuming where the previous cycle stopped; data isolated per customer (SecureOps 365).
Brute force, new global admin, MFA disabled, forwarding rule, app consent… plus Defender XDR advanced hunting.
The agent reads the tenant itself: sign-ins by IP, malicious mail, inbox rules, indicator reputation, verified MITRE techniques.
Report with verdict and fixes; every action (revoke sessions, remove a rule) waits for the analyst's click.
Products, internal tools, company assignments and labs. Assignments are shown without any internal data.
Microsoft 365 & Intune security audit
Software I design, build and sell on my own: it audits a full Microsoft 365 tenant read-only and produces a client-ready report mapped to CIS, ISO 27001, NIS2, ANSSI and GDPR.
Microsoft 365 security investigation & audit agent
An augmented SOC analyst: it reads Defender XDR, Entra ID, Exchange, Intune, Purview and Sentinel read-only, investigates with KQL hunting and returns a full report — verdict, timeline, indicators, MITRE ATT&CK, remediation — or a three-level security audit.
Microsoft 365 security monitoring platform
Microsoft 365 logs turned into detections and dashboards: compromised accounts, exfiltration, invoice fraud. Started as a lab, now a multi-customer platform with data isolation.
Microsoft Defender phishing simulations and awareness training, run for every school of a group from a single interface, with sending guardrails and strict GDPR handling.
Anomalies from several tenants in one consolidated view, with one-click remediation: licences, sessions, bulk account disabling. Built as a team.
authentication methods audit
Measure real adoption of MFA, passwordless and phishing-resistant methods without creating an App Registration or a secret. First a local web dashboard, then a native Windows application.
network intrusion detection (IDS)
A Suricata IDS on my Internet-facing server: 53,500 ET Open rules, alerts in EveBox, SSH bots banned, and a commented report produced by a read-only AI agent.
supervised web penetration testing
A web pentest lab on a dedicated server: passive and active ZAP scans against a training target, then an AI pentest agent, all under written rules of engagement. In progress.
SOC search and dashboards on Entra ID logs without depending on Sentinel, plus a dozen Microsoft 365 detection sets for Wazuh.
Audit of a Shibboleth identity provider in the RENATER / eduGAIN federation and pilot migration plan to Microsoft Entra ID.
AI assistant for support
Jira tickets analysed by AI with web search: diagnosis, step-by-step fix and a ready-to-post answer, with no technical account, using the agent's own SSO session.
A team of agents automating AuditM365's sales cycle: company search, qualification, writing, replies, onboarding, content and threat watch. Nothing goes out without approval.
Three tools to regain control of licences: an unused-licence scanner with savings estimate, a bulk management console, and clean-up scripts for disabled accounts.
A web portal to create and manage accounts, groups, lists and contacts directly in synced OUs, with Excel bulk processing and secure credential delivery.
A Keycloak identity provider (local or Microsoft 365 accounts) in front of an operations portal: tool tiles with live status, admin-only n8n actions and an audit log.
An aggregation API and a single interface for Microsoft Defender alerts and Entra ID risky users across tenants, by severity and status.
A PowerShell GUI that repairs Windows Update in 10 selectable steps, with built-in SetupDiag diagnostics.
Web, mobile and desktop apps, outside security.
PDF suite for Windows: reading, text editing, pages, signature, conversion.
Adaptive fitness coaching mobile app, in production with subscriptions.
Bilingual FR / ES web app in production for an SMB: rotation, deadlines, alerts, documents.
Web vault: JWT, bcrypt, AES-256 encryption of secrets, generator.
Local, secure Windows personal assistant: diagnostics, e-mail, calendar, no write permission.
Right now · Now building
Software I design, build and sell on my own: it audits a full Microsoft 365 tenant read-only and produces a client-ready report mapped to CIS, ISO 27001, NIS2, ANSSI and GDPR.
Apr 2026 — present
2026 — present
Jul 2025 — Apr 2026
Oct 2022 — Jun 2025
Mar 2022 — Oct 2022
Jun 2021 — Jan 2022
AuditM365Watch the demoin 13 minutes.
