Bring me the tenant nobody wants to touch.
I'm Michal, a Polish engineer based in Malta. I fix Microsoft 365 and Entra ID for EU teams, by the day or as a fixed-scope job. I work in English and Polish.
Malta VAT registered sole trader. The number is in the footer.Check me on the EU VIES register(opens in a new tab)
Ways to work with me.
- Hiring an Entra and Microsoft 365 engineer by the dayRemote, invoiced monthly in arrears. Starts with a 30-minute call.
- Hardening one Microsoft 365 tenant of up to 150 users10 business days, with the written scope agreed first.
- Getting a written view of your tenant before you commitTwo hours live, written pack within 5 business days.
- Buying Microsoft licences through a partnerThrough the Pax8 marketplace, billed per seat.
Services, by problem
Get the tenant under control
- Operate retainerTen hours a month for changes, reviews and questions on what I built or reviewed.
- Device baseline and Windows 11 moveIntune enrolment, compliance and update rings set up once, Defender onboarded on the plan you hold, and a plan for the last Windows 10 laptops.
- Licensing and renewalsMicrosoft licences bought and renewed through Pax8, with a free licence review before anything changes.
- Migrations to Microsoft 365Tenant moves and mailbox cutovers planned in waves, with a rollback point at each step.
Secure the cloud and prove it
- Tenant hardening for Microsoft 365Conditional Access, privileged roles, break-glass accounts, device compliance and mail authentication set up in stages, with an evidence pack and an Exit Kit at handover.
- Data access review before CopilotA fixed review of who can open what in SharePoint, OneDrive and Teams before Copilot can surface it, ending in a go or no-go recommendation and a 30-day cleanup list.
- Detection and response for Microsoft 365Defender set up and tuned for Business Premium and E5 tenants, with response paths tested and written down.
- Backup and recoveryThird-party backup for Microsoft 365 with a restore drill as evidence, and Azure workload recovery as an option.
- Cloud infrastructure on AzureAzure landing zones built as code, with policy guardrails and a runbook library.
What you keep when I leave.
exit-kit/
baselines/
The configuration as delivered, exported so you can compare drift later.
iac/
Terraform in your repository, with the state in your own storage account (Azure engagements).
runbooks/
The procedures for what was changed, written for your own administrators.
credential-map.md
Where each credential is kept and who holds it. Never the secrets themselves.
Every deliverable is licensed to you perpetually and irrevocably, and you may pass it to a successor supplier without asking us.
One engineer from first call to handover
Every request is read by me, and the first call is with me.
Book 30 minutes
Tell me what you run and what has to change. I will say whether I can help and what the first step would be.