I build, secure, and automate Microsoft environments so the people using them never have to think about what's underneath.
Plymouth, Michigan
About
I'm Zach Anger, a Microsoft cloud infrastructure and security professional in Plymouth, Michigan, with 5+ years in IT. Today I own most of the technical architecture for a multi-site lumber and building materials company: around 300 people across 9 locations, running on Azure, Azure Virtual Desktop, Entra ID, Intune, and Microsoft 365.
I came into IT from retail and manufacturing, so I know what it feels like when the systems don't work. That shapes everything I do. I think in blast radius and least privilege, I secure what can reasonably be secured, and I add logging and detection around the gaps. Security should make things safer without getting in people's way.
I also lean hard on AI as a force multiplier: for automation, scripting, hostile review of my own designs, and building internal tools faster than a small IT team normally could. I trust it the way I'd trust a sharp junior, which means I check its work.
Skills & Stack
Real-world, multi-site Microsoft environments, built to be stable, secure, and boring in the best way.
Projects & Impact
Projects that made environments safer, cheaper, and easier to run.
ProblemA growing Microsoft environment needed an honest look at its security posture, not a checkbox exercise.
What I didRan a CIS-style benchmark audit across identity, endpoints, email, and Azure, then built a phased plan: high and critical findings first, medium and low after, with documented exceptions where the business needs them.
ImpactContributed to a cyber insurance assessment score around 95, with a clear, prioritized roadmap for what's left.
ProblemA small IT team supporting hundreds of users across 9 sites, with too much repetitive work.
What I didBuilt a Microsoft 365 tenant toolkit on app-only Graph authentication for inventory and reporting, and used AI to speed up scripting, troubleshooting, and documentation.
ImpactRoughly 440 hours saved in three months across about 346 users.
ProblemHosted ticketing tools charge per seat, hide your data, and are built for enterprise IT. A small, multi-site team needs the real features without the overhead.
What I didArchitected and built a full service desk on ASP.NET Core, SQL Server, and Microsoft Graph: ticketing with SLAs, automation rules and webhooks, a requester portal, knowledge base and catalog, employee lifecycle plans, Microsoft 365 mail intake, a Teams helper bot, reports, and Entra sign-in with a tested route-security matrix. Built with AI agents under the guardrails in my setup repo, with a 6,000+ test suite.
ImpactRunning in production today for a ~300-user, 9-site company. A free, AGPL-licensed Community edition is being prepared for release.
ProblemEmployees were adopting AI tools faster than policy could keep up.
What I didWrote a 16-page AI implementation risk report for leadership, rolled out an approved business AI platform, and enforced Edge URL filtering that blocks unapproved AI sites with scoped exceptions.
ImpactAI use moved onto approved tools with real controls instead of shadow accounts.
ProblemRemote and multi-site users needed reliable access to line-of-business apps without constant session issues.
What I didBuilt out separate host pools for standard, GPU design, and IT admin users, tuned FSLogix profiles on Azure Files, fixed licensing and activation issues, and set up autoscale.
ImpactStable sessions, fewer tickets, and lower compute cost after hours.
ProblemOnboarding and offboarding were manual, slow, and easy to get wrong, which is a security risk on the way out.
What I didBuilt an application that handles account provisioning, group assignments, and offboarding steps consistently.
ImpactFaster onboarding, cleaner offboarding, and fewer accounts left behind.
ProblemAzure spend was creeping up, with oversized and misconfigured resources.
What I didReviewed usage and cost data, right-sized or removed what wasn't needed, and adjusted schedules while watching performance.
ImpactAbout 15% lower Azure spend with better stability.
ProblemParked and product domains with soft-fail SPF and no DMARC are free to spoof.
What I didWrote PowerShell tooling against the Cloudflare API that audits every zone's SPF, DKIM, DMARC, and MX posture, then hardens non-sending domains. Preview by default, explicit apply, scoped two-permission token.
ImpactEvery domain I own now hard-fails SPF and rejects on DMARC, with a repeatable report to prove it.
ProblemCoding agents are fast and useful right up until one runs rm -rf in the wrong folder or force-pushes over a branch.
What I didBuilt the setup I actually run: a tested guard hook that blocks or asks before destructive commands, with a human-only escape hatch; deny-by-default permissions; context reminders; secret scanning on every commit; and a one-script rebuild for a new machine.
ImpactAgents do real work in a production environment without me babysitting every command, and the whole setup moves between machines in minutes.
ProblemA small business moving into a much larger building with infrastructure built for the old one.
What I didPlanned and rebuilt networking, Wi-Fi, cameras and NVR, and core services, and moved file storage from an on-prem NAS to SharePoint.
ImpactA cleaner, scalable environment and a smooth move with minimal downtime.
Experience
I've worked where downtime costs real money. That's where I learned to treat stability, clear communication, and careful changes as non-negotiable.
Lumber & building materials company · ~300 employees, 9 sites
Security Oak · small business clients
Select, hands-on projects on the side. I help small businesses tighten identity and access, harden devices and email, and map what they do today against frameworks like NIST in plain, practical steps.
Started on the help desk and in managed service roles: end-user support, Windows environments, and core services. Learned fast, and learned exactly the kind of know-it-all I never wanted to be.
Worked in retail and a CNC shop, close to the people who feel it first when technology breaks. That perspective still drives how I make changes.
DeVry University
Contact
Have a question, a project, or just want to talk Microsoft security? Reach out.