INDEPENDENT THINKING. ENTERPRISE EXPERIENCE.
I’m Manuel, an Azure Solutions Architect. I turn complex infrastructure into secure, well-built environments that people can depend on.
01 HANGAR
02 LANDING ZONE
03 WIND
01 / SELECTED WORK
Real environments. Tangible outcomes.
A selection of engagements, with client details anonymised.
AZURE INFRASTRUCTURE / SENIOR CARE
Migrated an elder-care provider’s full IT estate into Azure. An ALZ-Bicep landing zone, 16 sites connected through SD-WAN, and Azure Virtual Desktop for the people who keep care running.
Led a Windows 10 1607 to 22H2 upgrade across 10,500+ devices, roughly 650 test centres, and four regional subdomains. Delivered in under six months against previous vendor estimates of more than a year.
A tenant-wide move from Google Workspace to Microsoft 365 using BitTitan. Migrated mail and Drive data to Exchange Online and OneDrive, and designed and provisioned more than 300 SharePoint sites.
Designed and delivered a Conditional Access baseline of 11 policies, including break-glass and exclusion patterns, plus an Intune security group structure that became a repeatable starting point for subsequent deployments.
02 / EXPERTISE
I work across the Microsoft stack, connecting architecture decisions to the detail that makes them work in production.
Let’s discuss your environmentLanding zones, hub-and-spoke networks, Firewall Premium, governance and monitoring. Built with Bicep and designed to grow.
Entra ID, Conditional Access, Defender and Zero Trust controls. Clear policies, practical protection, repeatable deployment.
Multi-site infrastructure moves, Microsoft 365 migrations, tenant consolidation and Azure Virtual Desktop.
Intune and SCCM co-management, Windows upgrade campaigns, Autopilot and modern provisioning across thousands of devices.
PowerShell, Azure Automation, KQL and Log Analytics. Tools that make operations more visible and less manual.
Well-Architected reviews, M365 licensing strategy, CSP structures and technical pre-sales, grounded in delivery experience.
03 / THE LAB
Proofs of concept, reusable tools, and ideas
tested against real engineering problems.
Modular Azure Landing Zone implementation using Bicep with hub-and-spoke topology, Azure Firewall Premium, and centralized logging.
Bicep / Infrastructure / AzurePolicy-as-code framework for deploying and testing Conditional Access policies at scale with built-in validation and compliance checks.
PowerShell / Microsoft Graph / IdentityRepeatable Intune configuration baseline covering compliance policies, device configuration profiles, and app protection policies.
PowerShell / Intune / EndpointKQL-based analytics dashboards for Azure security posture, Defender for Endpoint threat intelligence, and operational metrics.
KQL / Azure Monitor / AnalyticsAutomated tenant provisioning and configuration orchestration across multiple M365 environments with tenant-switching utilities.
PowerShell / M365 / AutomationEnterprise-grade security baseline with 6 phases: Identity & Access (PIM, Conditional Access), Email Protection (Defender for Office 365), Endpoint Security (Intune + EDR), Data Governance (DLP, sensitivity labels), and Compliance Audit. Full Zero Trust implementation with policy-as-code.
PowerShell / M365 / SecurityExplore the implementationNear-full Azure Virtual Desktop environment composed from vendored Azure Verified Modules, with a monthly automated sync pipeline for upstream module versions and session hosts joined to an existing AD DS domain, deployed via Azure DevOps.
Bicep / Azure Verified Modules / AVDDedicated Azure virtual network carrying two application paths: a Function App to SQL Managed Instance over TCP 1433, and API Management to an on-premises IIS backend over TCP 443. Peered into three existing production networks and deployed through approval-gated Azure DevOps pipelines.
Bicep / Networking / Azure DevOpsA CLOSER LOOK / AUTOMATION
I use AI-assisted workflows to develop and validate scripts, policies, and runbooks. The useful part is what follows: consistent deployments, clearer reporting, and more time for the work that needs judgment.
EPA devices covered by automated telemetry collection and performance reporting.
04 / BEHIND THE WORK
I like understanding how things fit together.
Then making them work better.
I’m a Microsoft Certified Azure Solutions Architect Expert, delivering Azure and Microsoft 365 engagements for North American MSP and CSP partners.
Previously, I worked as a Customer Success Architect across LATAM and North America at Microsoft, contracted through Persistent Systems, and went on to lead a regional team of 9–12 architects.
Today, my work combines hands-on engineering with that broader perspective: the architecture, the implementation, and the people who will operate it.
I work with a senior network of Microsoft-experienced engineers, several ex-Microsoft, with active certifications across Azure, M365 security, Intune and Entra ID. The team scales to the engagement.
HAVE SOMETHING IN MIND?
A project, a tricky migration, or a fresh perspective.
Let’s start with a 30-minute conversation.
