# Junaid Ahmed - Cloud Security & Identity Architect

> I secure identities and cloud estates for global enterprises, and build open-source tools that make Entra ID, Azure and Microsoft 365 safer to run.

Trust Boundary is the personal site of Junaid Ahmed at https://jahmed.cloud/. This file contains the full site content in plain text.

- Current role: Technology Manager - Cloud Security & Identity, Ernst & Young (EY)
- Location: Bengaluru, India
- Email: iam@jahmed.cloud
- LinkedIn: https://linkedin.com/in/iamjahmed
- GitHub: https://github.com/jahmed-cloud
- Blog: https://learncloud.guru

## In one line

I make sure the right people, and only the right people, can reach your cloud.

## Key numbers

- 10+: Years in cloud & identity
- 100K+: Users under Zero Trust designs
- 50+: Enterprises across identity designs
- 3: Public flagship projects

## Flagship projects

### EntraGuard - Identity Security Posture Management

Status: Open source
Source: https://github.com/jahmed-cloud/entra-guard
Also: https://hub.docker.com/r/jahmed22/entra-guard-api

Problem: Entra ID tenants drift: stale guests, weak Conditional Access, standing admin roles. Finding them by hand takes days.

What it does: Continuously assesses a Microsoft Entra ID tenant. Every finding comes with the risk in plain English, step-by-step remediation, affected objects and evidence.

- 115 checks
- 12 security domains
- NIST · CIS · ISO mapped
- 950+ pulls · Oct 2026
- Conditional Access, MFA, PIM, guest access, break-glass and app & service principal hygiene
- Scans in under 5 minutes, scheduled daily
- Exceptions workflow and effort-based remediation plans
- Multi-arch Docker images (amd64 / arm64)

Stack: Python, FastAPI, Celery, React, PostgreSQL, Docker

### Azure Resource Guardian - Discover. Govern. Optimize.

Status: Open source · v0.2
Source: https://github.com/jahmed-cloud/ARG

Problem: Azure estates collect idle resources, unowned costs and Azure Policy blind spots that nobody is looking at.

What it does: A single pane of glass for an Azure estate: idle and orphaned resources, savings, Azure Policy effectiveness, Entra ID hygiene and Terraform drift - with approval-based remediation.

- 76 scanners
- Savings per resource
- SARIF / JUnit CI gates
- 20+ orphan and idle resource checks across compute, network, storage and databases
- Monthly and annual savings projections from Azure Cost Management
- "What governs this resource?" Azure Policy analysis
- CAF + Zero Trust governance scoring

Stack: Python 3.12, FastAPI, React, Celery, PostgreSQL, Resource Graph

### AZPaC - Azure Policy as Code

Status: Open source
Source: https://github.com/jahmed-cloud/AZPaC

Problem: Azure Policy managed in the portal has no review, no history, and exemptions that quietly last for years.

What it does: Azure Policy managed in Terraform and reviewed through pull requests. Write a rule once, group it, choose where it applies - and every exemption has an owner and an expiry date.

- Audit → enforce in one word
- Nightly drift checks
- Least-privilege pipelines
- Automatic effect downgrade in audit mode (Deny → Audit, DINE → AINE)
- Built-in and custom definitions side by side
- Azure DevOps pipelines for definitions, drift and remediation
- Separate service principals per pipeline

Stack: Terraform, Azure Policy, Azure DevOps

### TenantWarden - Microsoft 365 security monitoring

Status: In development
Source: https://github.com/jahmed-cloud/TenantWarden

Problem: Microsoft 365 security signals are spread across half a dozen admin portals, so incidents are spotted late.

What it does: Self-hosted, multi-tenant security monitoring for Microsoft 365. Pulls signals from Microsoft Graph, Entra ID Protection, Intune, Defender XDR and Purview, plus endpoint agents, into one real-time dashboard.

- Graph collection every 15 min
- 60s alert rules
- Windows · Linux · macOS agents
- Risky users, sign-ins, Secure Score, Conditional Access and Defender incidents per tenant
- Alert engine with acknowledge/resolve workflow and z-score anomaly detection
- Go endpoint agent over mTLS: event logs, services, BitLocker, pending updates
- Alerts to Teams, Slack, Email, Webhook and PagerDuty

Stack: ASP.NET Core 9, React + TS, Node.js, Go, PostgreSQL, ClickHouse, Redis

### Entra MFA & TAP Portal - Approval-driven MFA reset & Temporary Access Pass

Status: In development

Problem: Helpdesk MFA resets are a favourite target for social engineering, and are often done with too much access.

What it does: Resets MFA methods and issues Temporary Access Passes through an approval workflow. Privileged Graph scopes never reach the browser, and every action is audited.

- Single / dual approval
- On-Behalf-Of to Graph
- Append-only audit
- MSAL sign-in with PKCE and group-derived permissions
- Manager-first approval with security-admin fallback and escalation
- Teams, Slack, webhook and SMTP notifications
- Horizontally scalable worker with Postgres leader election

Stack: ASP.NET Core 9, React 19, Fluent UI, PostgreSQL, Redis

### Privileged Access Workstations - PAW architecture & delivery

Status: Architect

Problem: Admins doing privileged work from the same laptop they use for email and browsing.

What it does: I architect Privileged Access Workstation programmes and have helped many organisations design and build them, physical and Azure Virtual Desktop, so admin roles can only be used from hardened, locked-down devices.

- PAW architecture & design
- Physical & AVD-based PAWs
- Baselines delivered as code
- Device isolation, Conditional Access, compliance, AppLocker & WDAC, Autopilot and scope tags
- Scenario designs for AVD, physical, cloud-only, pilot and compromise recovery
- Eligible-only PIM roles and break-glass alerting
- Rollouts delivered as version-controlled code, with dry runs and drift detection

Stack: Intune, Entra ID, Conditional Access, PowerShell, Terraform, AVD

## More tools

- CloudSkills (coming soon): Azure architecture and FinOps reviews from an MCP server or CLI, exported as HTML, JSON and Mermaid reports.
- Entra Helpdesk Portal (https://github.com/jahmed-cloud/entra-helpdesk): Keeps Tier 1/2 support out of the Entra admin centre, with mandatory ticket numbers and a full audit log.
- Entra ID Environment Teardown (https://github.com/jahmed-cloud/Entra-ID-Environment-Teardown): Safely resets an Entra ID tenant with a domain safety lock, protected break-glass accounts and dry runs.
- PIM Role Assignment Export (https://github.com/jahmed-cloud/EntraID): Exports every active and eligible PIM role assignment for access reviews and audits.
- OpenPrint Server (https://github.com/jahmed-cloud/OpenPrint-Server): Docker-based CUPS print server for Raspberry Pi and Linux with a secure admin dashboard.
- Jahmed MotoHub (https://motohub.jahmed.cloud): Containerised web app for my riding club, with rider management and automated CI/CD.
- AVD Monitor (https://github.com/jahmed-cloud/AVD-Monitor): KQL queries for Azure Monitor and Log Analytics to troubleshoot Azure Virtual Desktop.

## How I work

1. **Least privilege, by default.** Standing admin access is a liability. Roles are eligible, not active; elevation is just-in-time; privileged work happens on hardened devices. Seen in: PIM / JIT at EY, PAW programmes.
2. **Policy is code, and code gets reviewed.** Conditional Access, RBAC and Azure Policy change through pull requests, with history, review and rollback. Seen in: AZPaC, Terraform RBAC.
3. **Audit before you enforce.** Measure first. The list of things that fail is the list of work to do before switching enforcement on. Seen in: AZPaC, EntraGuard.
4. **Exceptions expire.** Every exemption has an owner and an end date, so a temporary exception can't quietly become permanent. Seen in: AZPaC, EntraGuard.

## Experience

### Technology Manager - Cloud Security & Identity - Ernst & Young (EY)

May 2025 – Present · Bengaluru

Leading a cloud security team delivering enterprise identity programmes aligned to C-suite risk and compliance objectives.
- Zero Trust & passwordless (FIDO2 + WHfB) programme for 10,000+ users - identity helpdesk tickets down 50%
- Automated PIM/JIT lifecycle removing standing access for 200+ admin accounts
- Terraform-enforced RBAC model aligned to ICFR - audit findings down 30%, full SoD compliance

### Senior Consultant - Identity & Security - Concentrix (Microsoft Partner)

Aug 2023 – May 2025 · Pune

Global Delivery Hub architect for multi-region enterprise identity and cloud designs.
- Passwordless & Conditional Access strategies for 100,000+ users across 50+ enterprises
- Migrated 40,000+ machines off on-prem SCCM to cloud-first update management
- 15–20% cloud cost savings across 20+ WAF/CAF reviews

### Lead Consultant - Cloud & Identity - Allyis (Microsoft Partner)

Jun 2021 – Aug 2023 · Hyderabad

Led a global team of 10+ engineers on the Microsoft Amplify Programme.
- KQL & Azure Workbooks observability - MTTR improved by 60%
- Azure Firewall & hub-spoke designs protecting 1,000+ VMs
- 98% on-time delivery; user onboarding effort cut by 70% via automation

### Senior Azure Engineer - Convergys (Microsoft Partner)

Jan 2017 – Jun 2021 · Bengaluru

Azure solutions for Microsoft Worldwide Learning enterprise customers.
- Contributed to $1M+ in Azure Consumed Revenue
- Power Automate & Power BI pipelines saving 1,800+ manual hours a year

### Technical Support Specialist - Lenovo

May 2015 – Aug 2016 · Bengaluru

Tier-2 commercial support for IT heads of major enterprise accounts across global data-centre dispatches.

## Certifications

- SC-100: Cybersecurity Architect Expert (Microsoft)
- AZ-305: Azure Solutions Architect Expert (Microsoft)
- CISM: Certified Information Security Manager (ISACA)
- SC-300: Identity & Access Administrator (Microsoft)
- AZ-104: Azure Administrator Associate (Microsoft)
- MCT: Microsoft Certified Trainer (Microsoft)
- Instructor Recognition Award - 100+ students trained (Skillable)

## Skills

- Identity & Zero Trust: Entra ID & Identity Governance, PIM / JIT & Conditional Access, Passwordless (FIDO2 · WHfB), Privileged Access Workstations, Zero Trust architecture
- Cloud Governance: Azure Landing Zones & Management Groups, Azure Policy as Code, CAF / WAF reviews, FinOps & cost governance, Defender XDR & Sentinel
- Automation & IaC: Terraform, PowerShell & Python, Azure Automation & Logic Apps, GitHub Actions & Azure DevOps, Docker
- Modern Workplace: Azure Virtual Desktop, Windows 365, Intune, FSLogix, Azure Arc & Update Manager