Scan to Save: A Digital Business Card People Save in One Tap
Scan to Save is a free digital business card from Andy Kemp Consulting: people scan your QR code and save you to their contacts in one tap, with your ph...
BLOG START HERE
Start with the right Microsoft 365 topic
The full blog is intentionally broad. This page groups the strongest routes into the main themes: security, identity, privileged access, Copilot readiness, endpoint modernisation and cloud change.
LATEST STARTING POINTS
Recent Posts Worth Reading First
Two Exchange Servers, One IP Address
I have a production Exchange server and a lab one, and a single public IP address. Both want port 443. HAPMan is the free tool I built to route them by...
Win11 Image Prep: From PowerShell Script to Windows App
Win11 Image Prep builds Windows 11 install media with your drivers already in it: a free Windows app that grew out of a PowerShell script for the Surfac...
CURATED READING PATHS
Choose a Theme
SECURITY FOUNDATION
Microsoft 365 Security and Identity
Start here for identity governance, privileged access, Conditional Access, authentication assurance and practical Microsoft 365 security decisions.
Related service: Security & IdentityTwo Exchange Servers, One IP Address
I have a production Exchange server and a lab one, and a single public IP address. Both want port 443. HAPMan is the free tool I built to route them by...
TLS Inspection and Custom Block Pages
Turn Global Secure Access’s “connection reset” into a custom block page. Deploy a TLS inspection certificate with Intune, scope it to a pilot and block...
Source IP Anchoring with Private Network Connectors
Install a Microsoft Entra Private Network Connector, configure selected SaaS traffic through Private Access, and verify the public IP seen by the applic...
Understanding Traffic Forwarding and Advanced Diagnostics
Understand Global Secure Access forwarding profiles, investigate Tunnel and Bypass decisions, and test SharePoint and internet traffic with Windows Adva...
TRUSTED ADMINISTRATION
Zero Trust and Privileged Access
A curated path through Zero Trust thinking, administrative workstations, assurance levels and practical privileged access strategy.
Related service: Security & IdentityTLS Inspection and Custom Block Pages
Turn Global Secure Access’s “connection reset” into a custom block page. Deploy a TLS inspection certificate with Intune, scope it to a pilot and block...
Source IP Anchoring with Private Network Connectors
Install a Microsoft Entra Private Network Connector, configure selected SaaS traffic through Private Access, and verify the public IP seen by the applic...
Understanding Traffic Forwarding and Advanced Diagnostics
Understand Global Secure Access forwarding profiles, investigate Tunnel and Bypass decisions, and test SharePoint and internet traffic with Windows Adva...
Deploying the Global Secure Access Client with Intune
Learn how to deploy the Microsoft Global Secure Access Windows client using Intune, configure a controlled pilot and verify traffic forwarding.
ENDPOINTS AND ACCESS
Modern Workplace, Intune and Cloud PCs
Posts on Windows 365, Azure Virtual Desktop, Intune, device security and remote access choices for modern work.
Related service: Modern WorkplaceWin11 Image Prep: From PowerShell Script to Windows App
Win11 Image Prep builds Windows 11 install media with your drivers already in it: a free Windows app that grew out of a PowerShell script for the Surfac...
Exchange Certificates, URLs and Domains, Without the Homework
Setting up Exchange Server means virtual directory URLs, a certificate and accepted domains, done in the right order. I do it rarely enough to look it u...
I Just Needed My Battery to Last
In this instalment of Building Again, I share how coding drains the batteries on my Mac and Surface devices, and how Windows 365 helps me continue acros...
Operating Windows LAPS: Deployment Isn't the Finish Line
Operate Windows LAPS: privileged retrieval, auditing, post-authentication rotation, event-log monitoring and governance of other local administrator acc...
IDENTITY-LED NETWORKING
Global Secure Access and Network Modernisation
Follow the move from traditional network access patterns toward Microsoft Global Secure Access, Private Access and identity-aware controls.
Related service: Security & IdentityScan to Save: A Digital Business Card People Save in One Tap
Scan to Save is a free digital business card from Andy Kemp Consulting: people scan your QR code and save you to their contacts in one tap, with your ph...
Two Exchange Servers, One IP Address
I have a production Exchange server and a lab one, and a single public IP address. Both want port 443. HAPMan is the free tool I built to route them by...
TLS Inspection and Custom Block Pages
Turn Global Secure Access’s “connection reset” into a custom block page. Deploy a TLS inspection certificate with Intune, scope it to a pilot and block...
Source IP Anchoring with Private Network Connectors
Install a Microsoft Entra Private Network Connector, configure selected SaaS traffic through Private Access, and verify the public IP seen by the applic...
AI READINESS
Copilot, AI and Automation
Useful reading on AI adoption, Microsoft 365 Copilot readiness, automation, data exposure and practical tooling.
Related service: AI & Copilot AdoptionWin11 Image Prep: From PowerShell Script to Windows App
Win11 Image Prep builds Windows 11 install media with your drivers already in it: a free Windows app that grew out of a PowerShell script for the Surfac...
Exchange Certificates, URLs and Domains, Without the Homework
Setting up Exchange Server means virtual directory URLs, a certificate and accepted domains, done in the right order. I do it rarely enough to look it u...
I Just Needed My Battery to Last
In this instalment of Building Again, I share how coding drains the batteries on my Mac and Surface devices, and how Windows 365 helps me continue acros...
What If Other People Could Use It?
Adding Clerk made sign-in easy. The real challenge was authorisation, tenant boundaries and keeping every SaaS customer's data securely separated.
CHANGE AND DELIVERY
Cloud, Migration and Architecture
A route into cloud architecture, tenant change, migration planning, Exchange, hybrid environments and delivery lessons.
Related service: Cloud TransformationScan to Save: A Digital Business Card People Save in One Tap
Scan to Save is a free digital business card from Andy Kemp Consulting: people scan your QR code and save you to their contacts in one tap, with your ph...
Two Exchange Servers, One IP Address
I have a production Exchange server and a lab one, and a single public IP address. Both want port 443. HAPMan is the free tool I built to route them by...
Exchange Certificates, URLs and Domains, Without the Homework
Setting up Exchange Server means virtual directory URLs, a certificate and accepted domains, done in the right order. I do it rarely enough to look it u...
EWS Retirement: The Exchange Deadline You Cannot Keep Ignoring
EWS retirement is about far more than rewriting an application. The 1 October 2026 Exchange Online disablement phase is almost here, and April 2027 will...