Modern Workplace engineer in Belgium, focused on endpoint management and automation

I build the tools that admin work keeps asking for.

Internal tools, agents and platforms for Microsoft 365, Intune and Linux fleets. One engineer, from data model and background workers to the interface people use every day.

Email meSee the tools

tools list --all

NameAreaState
msp-platformMicrosoft 365 for MSPsPrivate product
patch-and-deployIntune app packagingLive
patchportalLinux patchingRunning my fleet
wannabe-adminEndpoint privilege managementPublic demo
nis2checkNIS2 evidenceOpen source CLI
intune-mateIntune assessmentLive, read-only
naming-studioIntune and Entra ID namingLive, free
moneyfieldHousehold financeLive

8 tools, 6 running in production or as a public demo

Tools

Most of these started as a problem in my own work with Microsoft 365, Intune and Linux servers.

Private productMicrosoft 365 for MSPs

Microsoft 365 management platform

Tenant standards, drift monitoring and safe change across many customers.

Problem
Across dozens of tenants, standards drift quietly: a temporary exception becomes permanent, a policy changes during an incident, and later nobody can explain the difference.
What it does
Baselines are deployed from one place, drift is detected and scored, and every change is reviewed and logged.
  • Baselines compared against scheduled tenant reads, expected and actual side by side
  • Assessments for NIS2, CIS and Copilot readiness
  • Snapshots and restores of tenant configuration
  • An isolated instance per customer, provisioned from an admin portal
  • Public API with a PowerShell module, plus n8n and Jira integrations
Tenancy
Isolated instance per customer
Secrets
Azure Key Vault
Plans
Three editions, feature-gated modules
  • Python
  • FastAPI
  • Next.js
  • PostgreSQL
  • Microsoft Graph
  • Azure Key Vault

Private product. The name and link are intentionally left out.

baseline  Windows / Compliance / Encryption  v2026.09
tenant    contoso-legal                    read 03:00

  requireBitLocker:        true
  requireSecureBoot:       true
- minimumOsVersion:        10.0.22631
+ minimumOsVersion:        10.0.19045
- storageRequireEncryption: true
+ storageRequireEncryption: false

2 settings drifted, severity high
changed during incident INC-2291, no exception on record
[ review change ]  [ record exception ]  [ restore baseline ]
The product is private, so this is a mock-up of the comparison it makes.
LiveIntune app packaging

Patch&Deploy

From installer to deployed, continuously patched application.

Problem
Packaging one application for Intune is repetitive, fragile work, and it starts again for every version, application and customer.
What it does
A controlled path from uploaded installer or catalog entry to a published, assigned and kept-current application.
  • Builds .intunewin packages in pure Python, so no Windows machine is needed
  • Optional PSADT v4 wrapping, plus macOS .dmg and .pkg uploads
  • Deploys from the WinGet, Microsoft Store and Homebrew catalogs
  • Continuous patching with staged rollout rings
  • Flags installed apps with known exploited vulnerabilities (CISA KEV)
Tenancy
Many Intune tenants, certificate auth
Isolation
Optional dedicated customer instances
Roles
Admin and reader
  • Python
  • FastAPI
  • Next.js
  • PostgreSQL
  • Microsoft Graph
  • Cloudflare Tunnel
Open Patch&Deploy
Tenant overviewapp.darthadmin.com · 1/8
Running my fleetLinux patching

PatchPortal

Patch and vulnerability visibility for a Linux and Proxmox fleet.

Problem
On a mixed Linux fleet, nobody can tell you which servers need updates, which of those updates close real vulnerabilities, and which hosts are waiting for a reboot.
What it does
Every host reports in, vulnerabilities are matched in the distribution's own ecosystem, and patches roll out in rings with approvals and a way back.
  • A small outbound-only agent written in Go; servers never accept inbound connections
  • Vulnerabilities matched against OSV, so backports are not false positives
  • Deployment rings with deferrals, maintenance windows and approvals
  • Rollback and livepatch support, including Proxmox clusters and guests
  • Eight architectural invariants, enforced by a test that may never be skipped
Patching
Debian, Ubuntu, Proxmox VE
Visibility
Alma, Rocky, Oracle, CentOS Stream, Fedora
Agent
Go, version 0.3.0
  • Go
  • Python
  • FastAPI
  • React
  • PostgreSQL
  • Valkey
  • Traefik
  • Docker Compose

Runs my own homeserver fleet; that portal is not public. Screens show a seeded demo fleet.

Fleet dashboardpatchportal · demo fleet · 1/8
Public demoEndpoint privilege management

Wannabe Admin

Admin rights on Windows and Mac, only when needed and only for as long as needed.

Problem
Taking away local admin rights is the right call, until someone needs to install a driver at 16:55 and the helpdesk is gone for the day.
What it does
People ask for admin rights on their own device, a signed policy or an approver decides, and the rights remove themselves when time is up. Every elevated action is on record.
  • .NET 8 agents for Windows (service and tray app) and macOS (LaunchDaemon)
  • Each device gets its own client certificate after a Microsoft Graph check
  • Signed policies, approval flows and an append-only audit log
  • Offline one-time codes for devices that cannot reach the server
  • Sign-in with Entra ID across directories, or local accounts with FIDO2 keys
Tests
352 Python, 106 C#
Transport
Mutual TLS via Cloudflare Tunnel
Installers
MSI and .pkg, both built on Linux
  • .NET
  • C#
  • Python
  • FastAPI
  • PostgreSQL
  • Redis
  • Docker Compose
  • Cloudflare Tunnel
Try the live demoProduct site

Work in progress. The demo uses a mock company and resets every hour.

Security overviewdemo.wannabe-admin.com · 1/6
Open source CLINIS2 evidence

Nis2Check

Read-only evidence for the technically verifiable parts of NIS2.

Problem
A screenshot from today proves little in an audit, and most NIS2 tooling hides what it could not check behind a single reassuring score.
What it does
An evidence dossier that shows, per control, what was read, what it proved and what still needs a human, with no overall score on purpose.
  • Reads Microsoft 365 through Graph with GET requests only
  • 36 controls covering all ten measures of article 21(2)
  • Classifies an organisation as essential, important or out of scope
  • Produces a self-contained HTML report and a PDF dossier
  • Free CLI and container that runs at the customer, or a hosted workspace
Controls
36
Tests
253 passing
Access
Application permissions, read-only
  • Python
  • FastAPI
  • Next.js
  • PostgreSQL
  • Microsoft Graph
  • Vercel
View on GitHub

Screens show a sample run against a fictional tenant.

Evidence reportnis2check · report.html · 1/3
Live, read-onlyIntune assessment

Intune Mate

What to fix first in an Intune tenant that has been running for years.

Problem
Assessing a long-running Intune tenant means clicking through several portals and still not knowing which findings deserve attention first.
What it does
A read-only assessment that turns a tenant into a prioritised list of what to keep, fix or investigate.
  • Checks identity, MFA, Conditional Access, app permissions and admin accounts
  • Maps real policy assignments and flags legacy or unassigned profiles
  • Generates Conditional Access JSON from plain English
  • Moves configuration from one tenant to another
Access
Delegated, read-only
Storage
No tenant data stored
Baseline
Microsoft and CIS guidance
  • Next.js
  • Microsoft Graph
  • MSAL
Open Intune Mate
Dashboardintune-mate.darthadmin.com · 1/6
Live, freeIntune and Entra ID naming

Naming Convention Studio

Consistent names for Intune and Entra ID objects, in the same order every time.

Problem
Security groups, policies, Conditional Access and update rings end up with five naming styles, because the convention lives in someone's head or a forgotten wiki page.
What it does
Pick the object type, fill in the parts, copy the name. The convention is customisable and can be shared as a file.
  • Patterns for groups, policies, endpoint security, Conditional Access, scripts, update rings and Autopilot device names
  • Every code list can be adapted to a customer
  • Settings export and import as JSON
  • Runs entirely in the browser, with no backend
Backend
None
Storage
Browser only
  • Next.js
  • TypeScript
  • Tailwind CSS
  • Vercel
Open the studio
Studionaming-convention-app-iota.vercel.app · 1/1
LiveHousehold finance

Moneyfield

A household budget built around what is still available.

Problem
Most budgeting apps tell you what you already spent. Knowing what remains after fixed costs, before the month gets difficult, is more useful.
What it does
A shared household workspace with bank sync, budgets, savings goals and a month plan that starts from the balance after fixed costs.
  • Automatic bank sync with Belgian banks through GoCardless
  • Budgets, savings goals, month planning and reports
  • Shared households with roles for each member
  • Native iOS app built with Expo
  • An MCP connection, so an AI assistant can answer questions about spending
Web
Next.js on Vercel, Neon Postgres
Mobile
Expo and React Native
Language
Dutch interface
  • Next.js
  • TypeScript
  • PostgreSQL
  • Drizzle
  • React Native
  • MCP
  • Vercel
Sign-inmoneyfield.vercel.app · 1/1

What they are built with

A small set of tools I know well, reused across projects. Most of it runs on my own homeserver behind Cloudflare Tunnels, the rest on Vercel.

M365 platformPatch&DeployPatchPortalWannabe AdminNis2CheckIntune MateNaming StudioMoneyfield
Languages
Python
TypeScript
Go
C#
Frameworks
FastAPI
Next.js
React
.NET
React Native
Data
PostgreSQL
Redis
Valkey
Platform
Microsoft Graph
Docker Compose
Cloudflare Tunnel
Vercel
MCP

How a project runs

A short scope, working software early and a clean handover. No mysterious dependencies on me afterwards.

  1. 01

    Discovery

    We spend an hour on what happens today, who does it and where the friction is. I will say plainly if I am not the right fit.

  2. 02

    One-page scope

    You get a short description of the work, a price and a timeline. No proposal binder.

  3. 03

    Working increments

    I build in usable pieces. Every two weeks there is something running that you can try and react to.

  4. 04

    Handover

    You get the source code, documentation and keys. The software belongs to you, even if you continue without me.

Send me the task you keep doing by hand.

Tell me what happens today and what should happen instead. I reply within two business days, including when the honest answer is that I am not the right person for it.

Email Svensven.degroodt@gmail.com