I build, secure, and automate Microsoft environments so the people using them never have to think about what's underneath.
Plymouth, Michigan
About
I'm Zach Anger, a Microsoft cloud infrastructure and security professional in Plymouth, Michigan, with 5+ years in IT. Today I own most of the technical architecture for a multi-site lumber and building materials company: around 300 people across 9 locations, running on Azure, Azure Virtual Desktop, Entra ID, Intune, and Microsoft 365. I took over the environment with little notice when the previous admin left. It was unstable and undocumented, and most of what's on this page is the work of making it fast, reliable, secure, and understandable to the rest of the team, not just to me.
I came into IT from retail and manufacturing, so I know what it feels like when the systems don't work. That shapes everything I do. I think in blast radius and least privilege, I secure what can reasonably be secured, and I add logging and detection around the gaps. Security should make things safer without getting in people's way.
I also lean hard on AI as a force multiplier: for automation, scripting, hostile review of my own designs, and building internal tools faster than a small IT team normally could. I trust it the way I'd trust a sharp junior, which means I check its work.
Skills & Stack
Real-world, multi-site Microsoft environments, built to be stable, secure, and boring in the best way.
Projects & Impact
Projects that made environments safer, cheaper, and easier to run.
ProblemA growing Microsoft environment needed an honest look at its security posture, not a checkbox exercise.
What I didRan a CIS-style benchmark audit across identity, endpoints, email, and Azure, then built a phased plan: high and critical findings first, medium and low after, with documented exceptions where the business needs them.
ImpactContributed to a cyber insurance assessment score around 95, with a clear, prioritized roadmap for what's left.
ProblemA small IT team supporting hundreds of users across 9 sites, with too much repetitive work.
What I didBuilt a Microsoft 365 tenant toolkit on app-only Graph authentication for inventory and reporting, and used AI to speed up scripting, troubleshooting, and documentation.
ImpactRoughly 440 hours saved in three months across about 346 users.
ProblemHosted ticketing tools charge per seat, hide your data, and are built for enterprise IT. A small, multi-site team needs the real features without the overhead.
What I didArchitected and built a full service desk on ASP.NET Core, SQL Server, and Microsoft Graph: ticketing with SLAs, automation rules and webhooks, a requester portal, knowledge base and catalog, employee lifecycle plans, Microsoft 365 mail intake, a Teams helper bot, reports, and Entra sign-in with a tested route-security matrix. Built with AI agents under the guardrails in my setup repo, with a 6,000+ test suite.
ImpactRunning in production today for a ~300-user, 9-site company. A free, AGPL-licensed Community edition is being prepared for release.
ProblemEmployees were adopting AI tools faster than policy could keep up.
What I didWrote a 16-page AI implementation risk report for leadership, used Microsoft Defender cloud app discovery to find which AI tools people were actually using, rolled out an approved business AI platform, and enforced Edge URL filtering that blocks unapproved AI sites with scoped exceptions.
ImpactAI use moved onto approved tools with real controls instead of shadow accounts.
ProblemInherited an AVD environment that was slow and unreliable: session freezes, profile load failures, licensing and activation errors, and a steady stream of tickets from users across nine sites who depended on it for line-of-business apps.
What I didTraced the root causes instead of restarting hosts: fixed FSLogix profile handling on Azure Files, resolved the shared-computer licensing and Office activation issues, split users into purpose-built host pools (standard, GPU design, IT admin), tuned session host configuration, and added autoscale.
ImpactFaster logons, sessions that stay up, a sharp drop in AVD tickets, and lower compute cost after hours. The environment went from the top complaint to something nobody thinks about.
ProblemOnboarding and offboarding were manual, slow, and easy to get wrong. A missed offboarding step is a security hole, and nobody knew whether one had been missed.
What I didBuilt an application that runs provisioning and offboarding as audited, step-by-step workflows. On offboarding it disables access first, then handles mailbox and OneDrive handover, and notifies the person's manager what was done and who now has access, with a prompt to tell IT immediately if the request was in error. Every run is logged; completion opens a ticket for IT, and any failed step is flagged for review.
ImpactFaster onboarding, cleaner offboarding, no accounts left behind, and a paper trail for every change. Because access is cut before anything else runs, a failure partway through still leaves the account in a safe state. The manager notification has already caught an offboarding submitted in error; it was reversed before the employee noticed anything.
ProblemEverything about the environment lived in one person's head, and changes happened with no record, no notice, and no approval. When that person left, the team was flying blind.
What I didWrote the knowledge base, runbooks, SOPs, and architecture documentation from scratch, and put in a change process: change requests with a notice period, written approval for anything that touches production, and a record of what changed and why. Triage Microsoft 365 Message Center updates into action items so nothing lands as a surprise.
ImpactOther IT staff can operate and troubleshoot the environment without me in the room. Changes are announced before they happen and traceable after, and the team actually talks to each other about what's changing instead of finding out from a ticket.
ProblemAzure spend was creeping up, with oversized and misconfigured resources.
What I didReviewed usage and cost data, right-sized or removed what wasn't needed, and adjusted schedules while watching performance.
ImpactAbout 15% lower Azure spend with better stability.
ProblemParked and product domains with soft-fail SPF and no DMARC are free to spoof.
What I didWrote PowerShell tooling against the Cloudflare API that audits every zone's SPF, DKIM, DMARC, and MX posture, then hardens non-sending domains. Preview by default, explicit apply, scoped two-permission token.
ImpactEvery domain I own now hard-fails SPF and rejects on DMARC, with a repeatable report to prove it.
ProblemCoding agents are fast and useful right up until one runs rm -rf in the wrong folder or force-pushes over a branch.
What I didBuilt the setup I actually run: a tested guard hook that blocks or asks before destructive commands, with a human-only escape hatch; deny-by-default permissions; context reminders; secret scanning on every commit; and a one-script rebuild for a new machine.
ImpactAgents do real work in a production environment without me babysitting every command, and the whole setup moves between machines in minutes.
ProblemA small business moving into a much larger building with infrastructure built for the old one.
What I didPlanned and rebuilt networking, Wi-Fi, cameras and NVR, and core services, and moved file storage from an on-prem NAS to SharePoint.
ImpactA cleaner, scalable environment and a smooth move with minimal downtime.
Experience
I've worked where downtime costs real money. That's where I learned to treat stability, clear communication, and careful changes as non-negotiable.
Lumber & building materials company · ~300 employees, 9 sites
Security Oak · small business clients
Select, hands-on projects on the side. I help small businesses tighten identity and access, harden devices and email, and map what they do today against frameworks like NIST in plain, practical steps.
Started on the help desk and in managed service roles: end-user support, Windows environments, and core services. Learned fast, and learned exactly the kind of know-it-all I never wanted to be.
Worked in retail and a CNC shop, close to the people who feel it first when technology breaks. That perspective still drives how I make changes.
DeVry University
Contact
Have a question, a project, or just want to talk Microsoft security? Reach out.