Skip to content

Available for new opportunities

Junaid Ahmed · Cloud Security & Identity ArchitectI make sure the right people, and only the right people, can reach your cloud.

I secure identities and cloud estates for global enterprises, and build open-source tools that make Entra ID, Azure and Microsoft 365 safer to run.

See the work Email me
junaid.policy.json Access granted
{  "displayName": "Junaid Ahmed",  "role": "Cloud Security & Identity Architect",  "state": "enabled",  "conditions": {    "experience": "10+ years",    "scale": "100K+ users",    "location": "Bengaluru, IN"  },  "grantControls": [    "SC-100", "AZ-305",    "CISM", "MCT"  ]}
Profile summary written as a Conditional Access policy

Now building

TenantWarden

Self-hosted security monitoring for Microsoft 365

Years in cloud & identity
10+
Users under Zero Trust designs
100K+
Enterprises across identity designs
50+
Public flagship projects
3

Local time

--:--

Bengaluru, India · IST

Off the clock

Motorcycle enthusiast and photographer.

Selected work

Tools I built for problems I kept meeting

Each one started as a task I was doing by hand for clients. The public ones are open source and run on your own infrastructure.

Open source

EntraGuard

Identity Security Posture Management

SourceDocker Hub

The problem

Entra ID tenants drift: stale guests, weak Conditional Access, standing admin roles. Finding them by hand takes days.

What it does

Continuously assesses a Microsoft Entra ID tenant. Every finding comes with the risk in plain English, step-by-step remediation, affected objects and evidence.

Key features
  • Conditional Access, MFA, PIM, guest access, break-glass and app & service principal hygiene
  • Scans in under 5 minutes, scheduled daily
  • Exceptions workflow and effort-based remediation plans
  • Multi-arch Docker images (amd64 / arm64)
  • 115 checks
  • 12 security domains
  • NIST · CIS · ISO mapped
  • 950+ pulls · Oct 2026

Python · FastAPI · Celery · React · PostgreSQL · Docker

Open source · v0.2

Azure Resource Guardian

Discover. Govern. Optimize.

Source

The problem

Azure estates collect idle resources, unowned costs and Azure Policy blind spots that nobody is looking at.

What it does

A single pane of glass for an Azure estate: idle and orphaned resources, savings, Azure Policy effectiveness, Entra ID hygiene and Terraform drift - with approval-based remediation.

Key features
  • 20+ orphan and idle resource checks across compute, network, storage and databases
  • Monthly and annual savings projections from Azure Cost Management
  • "What governs this resource?" Azure Policy analysis
  • CAF + Zero Trust governance scoring
  • 76 scanners
  • Savings per resource
  • SARIF / JUnit CI gates

Python 3.12 · FastAPI · React · Celery · PostgreSQL · Resource Graph

Open source

AZPaC

Azure Policy as Code

Source

The problem

Azure Policy managed in the portal has no review, no history, and exemptions that quietly last for years.

What it does

Azure Policy managed in Terraform and reviewed through pull requests. Write a rule once, group it, choose where it applies - and every exemption has an owner and an expiry date.

Key features
  • Automatic effect downgrade in audit mode (Deny → Audit, DINE → AINE)
  • Built-in and custom definitions side by side
  • Azure DevOps pipelines for definitions, drift and remediation
  • Separate service principals per pipeline
  • Audit → enforce in one word
  • Nightly drift checks
  • Least-privilege pipelines

Terraform · Azure Policy · Azure DevOps

In development

TenantWarden

Microsoft 365 security monitoring

Source

The problem

Microsoft 365 security signals are spread across half a dozen admin portals, so incidents are spotted late.

What it does

Self-hosted, multi-tenant security monitoring for Microsoft 365. Pulls signals from Microsoft Graph, Entra ID Protection, Intune, Defender XDR and Purview, plus endpoint agents, into one real-time dashboard.

Key features
  • Risky users, sign-ins, Secure Score, Conditional Access and Defender incidents per tenant
  • Alert engine with acknowledge/resolve workflow and z-score anomaly detection
  • Go endpoint agent over mTLS: event logs, services, BitLocker, pending updates
  • Alerts to Teams, Slack, Email, Webhook and PagerDuty
  • Graph collection every 15 min
  • 60s alert rules
  • Windows · Linux · macOS agents

ASP.NET Core 9 · React + TS · Node.js · Go · PostgreSQL · ClickHouse · Redis

In development

Entra MFA & TAP Portal

Approval-driven MFA reset & Temporary Access Pass

Public release coming soon

The problem

Helpdesk MFA resets are a favourite target for social engineering, and are often done with too much access.

What it does

Resets MFA methods and issues Temporary Access Passes through an approval workflow. Privileged Graph scopes never reach the browser, and every action is audited.

Key features
  • MSAL sign-in with PKCE and group-derived permissions
  • Manager-first approval with security-admin fallback and escalation
  • Teams, Slack, webhook and SMTP notifications
  • Horizontally scalable worker with Postgres leader election
  • Single / dual approval
  • On-Behalf-Of to Graph
  • Append-only audit

ASP.NET Core 9 · React 19 · Fluent UI · PostgreSQL · Redis

Architect

Privileged Access Workstations

PAW architecture & delivery

Talk to me about PAW

The problem

Admins doing privileged work from the same laptop they use for email and browsing.

What it does

I architect Privileged Access Workstation programmes and have helped many organisations design and build them, physical and Azure Virtual Desktop, so admin roles can only be used from hardened, locked-down devices.

Key features
  • Device isolation, Conditional Access, compliance, AppLocker & WDAC, Autopilot and scope tags
  • Scenario designs for AVD, physical, cloud-only, pilot and compromise recovery
  • Eligible-only PIM roles and break-glass alerting
  • Rollouts delivered as version-controlled code, with dry runs and drift detection
  • PAW architecture & design
  • Physical & AVD-based PAWs
  • Baselines delivered as code

Intune · Entra ID · Conditional Access · PowerShell · Terraform · AVD

More tools

All repositories

How I work

Four rules I design by

The same ideas run through my client work and my projects.

  1. 01

    Least privilege, by default

    Standing admin access is a liability. Roles are eligible, not active; elevation is just-in-time; privileged work happens on hardened devices.

    Seen inPIM / JIT at EYPAW programmes

  2. 02

    Policy is code, and code gets reviewed

    Conditional Access, RBAC and Azure Policy change through pull requests, with history, review and rollback.

    Seen inAZPaCTerraform RBAC

  3. 03

    Audit before you enforce

    Measure first. The list of things that fail is the list of work to do before switching enforcement on.

    Seen inAZPaCEntraGuard

  4. 04

    Exceptions expire

    Every exemption has an owner and an end date, so a temporary exception can't quietly become permanent.

    Seen inAZPaCEntraGuard

Experience

10+ years in identity, security and cloud

  1. May 2025 – PresentBengaluru

    Technology Manager - Cloud Security & Identity

    Ernst & Young (EY)

    Leading a cloud security team delivering enterprise identity programmes aligned to C-suite risk and compliance objectives.

    • Zero Trust & passwordless (FIDO2 + WHfB) programme for 10,000+ users - identity helpdesk tickets down 50%
    • Automated PIM/JIT lifecycle removing standing access for 200+ admin accounts
    • Terraform-enforced RBAC model aligned to ICFR - audit findings down 30%, full SoD compliance

  2. Aug 2023 – May 2025Pune

    Senior Consultant - Identity & Security

    Concentrix (Microsoft Partner)

    Global Delivery Hub architect for multi-region enterprise identity and cloud designs.

    • Passwordless & Conditional Access strategies for 100,000+ users across 50+ enterprises
    • Migrated 40,000+ machines off on-prem SCCM to cloud-first update management
    • 15–20% cloud cost savings across 20+ WAF/CAF reviews

  3. Jun 2021 – Aug 2023Hyderabad

    Lead Consultant - Cloud & Identity

    Allyis (Microsoft Partner)

    Led a global team of 10+ engineers on the Microsoft Amplify Programme.

    • KQL & Azure Workbooks observability - MTTR improved by 60%
    • Azure Firewall & hub-spoke designs protecting 1,000+ VMs
    • 98% on-time delivery; user onboarding effort cut by 70% via automation

  4. Jan 2017 – Jun 2021Bengaluru

    Senior Azure Engineer

    Convergys (Microsoft Partner)

    Azure solutions for Microsoft Worldwide Learning enterprise customers.

    • Contributed to $1M+ in Azure Consumed Revenue
    • Power Automate & Power BI pipelines saving 1,800+ manual hours a year

  5. May 2015 – Aug 2016Bengaluru

    Technical Support Specialist

    Lenovo

    Tier-2 commercial support for IT heads of major enterprise accounts across global data-centre dispatches.

Credentials

Certified, and still teaching

  • SC-100

    Cybersecurity Architect Expert

    Microsoft

  • AZ-305

    Azure Solutions Architect Expert

    Microsoft

  • CISM

    Certified Information Security Manager

    ISACA

  • SC-300

    Identity & Access Administrator

    Microsoft

  • AZ-104

    Azure Administrator Associate

    Microsoft

  • MCT

    Microsoft Certified Trainer

    Microsoft

Instructor Recognition Award - 100+ students trained (Skillable)

Identity & Zero Trust

  • Entra ID & Identity Governance
  • PIM / JIT & Conditional Access
  • Passwordless (FIDO2 · WHfB)
  • Privileged Access Workstations
  • Zero Trust architecture

Cloud Governance

  • Azure Landing Zones & Management Groups
  • Azure Policy as Code
  • CAF / WAF reviews
  • FinOps & cost governance
  • Defender XDR & Sentinel

Automation & IaC

  • Terraform
  • PowerShell & Python
  • Azure Automation & Logic Apps
  • GitHub Actions & Azure DevOps
  • Docker

Modern Workplace

  • Azure Virtual Desktop
  • Windows 365
  • Intune
  • FSLogix
  • Azure Arc & Update Manager

Contact

Let's talk about who has access to your cloud.

Identity, Zero Trust, privileged access or Azure governance, or one of the projects above. I read every message.

iam@jahmed.cloud LinkedIn GitHub