~/quentin-williams

Dallas-Fort Worth, TX

Quentin Williams

Senior Cloud Engineer Azure Infrastructure Microsoft 365 Security

I design, migrate, and secure Microsoft cloud environments. As a Senior Microsoft Infrastructure Consultant at CloudServus, I'm the final technical escalation point for a portfolio of 13 clients and more than 5,000 end users.

View work LinkedIn
13
Clients in my current portfolio
5,000+
End users across those clients
100s
VMs migrated to Azure so far
6
Years in IT, since October 2020

// 01

About

I've worked in IT since October 2020. I started on a Fortune 500 help desk, moved into hands-on Microsoft 365 and Azure administration in 2021, and have done senior security and infrastructure consulting since 2023.

My work sits where infrastructure and security meet: moving workloads to Azure without taking production down, hardening identity and privileged access, and writing reports and runbooks that both executives and technicians can act on.

I scope work directly with clients and author the standards and documentation the work runs on.

How I work

  1. Evidence before conclusions

    When something breaks or a breach is reported, I go to the sign-in, audit, and device logs before agreeing on what happened.

    In practiceOn one incident the logs showed five enrollment attempts, not the 20+ in the first report, and pointed to a missing enrollment restriction as the real gap.

  2. Sequence change so nothing breaks

    I order a migration so each layer is stable before the next one depends on it: network before identity, file shares last, and a pilot site before the full rollout.

    In practiceA 137-server migration plan that moves all 32 domain controllers in the first wave.

  3. Write for whoever has to act on it

    Executives need the risk and the decision. Technicians need the steps. Everyone else needs plain rules they can follow.

    In practiceExecutive summaries on incident reports, runbooks for the people doing the work, and an AI acceptable use policy written for field crews.

  4. Understand it before changing it

    Most environments I inherit have history nobody wrote down. I work out why something behaves the way it does before I touch it.

    In practiceTracking down machines that kept rejoining a domain after removal, and deprecated network teaming hidden under Hyper-V virtual switches.

  5. Fit the design to the license

    The right control depends on what the client already owns, so I design around their actual Microsoft licensing rather than a wish list.

    In practicePrivileged access designs that work for a 3-admin small business and for a tenant with 40+ Conditional Access policies.

  6. Script what repeats

    If a check comes up at more than one client, I turn it into a script so every tenant gets the same audit, run the same way.

    In practiceA license-gap report run across 3 customer tenants, plus reusable RBAC and mailbox permission exports.

// 02

Selected work

Client names are withheld. Engagements are described by industry and size.

Environmental services recycling and wastewater

Datacenter to Azure with zero unplanned production downtime

As lead architect and primary technical contact, I led the company's move out of its on-premises datacenter and into Azure. I still own day-to-day operations for the environment.

  • ~2,000users
  • 6+U.S. sites
  • 25+VMs
  • 0unplanned production downtime
Scope and outcomes

The scope covered physical servers, domain controllers and core identity, ERP and line-of-business app servers, and file servers moved onto Azure Files and File Sync, across multiple Azure subscriptions. Identity is hybrid: on-premises AD synced to Entra ID, with domain controllers running in Azure.

  • Zero unplanned production downtime across every cutover
  • End-of-life hardware risk eliminated
  • Working, tested cross-site disaster recovery
  • Consistent access and performance at every site
  • Azure
  • Hybrid identity
  • Entra ID
  • Azure Files
  • File Sync
  • Disaster recovery

Enterprise virtualization

VMware to Hyper-V exit

I'm the Hyper-V, SCVMM, and failover clustering lead. I designed the production cluster, and the migration so far includes a full-cluster cutover over a single weekend.

  • ~500VMs in scope
  • 100+VMs migrated so far
  • 0unplanned downtime
Details

The 6-node production cluster runs dual 10 GbE per host. The work covers StarWind V2V conversions, Dell PowerStore storage, Cluster Shared Volumes, and quorum and witness design.

I also rebuilt the host networking from deprecated LBFO teaming to Switch Embedded Teaming with per-traffic VLANs, resolved RDMA, RoCE v2, and DCB/PFC validation failures, and supported Citrix VDI through the move, including MCS test VMs and VDI domain-rejoin issues.

  • Hyper-V
  • SCVMM
  • Failover Clustering
  • Switch Embedded Teaming
  • RDMA
  • Citrix VDI

Datacenter estate migration planning

Three-wave Azure migration plan

Built a three-wave plan to move the estate to Azure, with all 32 domain controllers in the first wave.

  • 137servers
  • 14AD domains
  • 754vCPUs
  • ~78TB
Details

I cleaned duplicate Azure Migrate inventory, split the servers into waves of 73, 37, and 27, and flagged 36 servers with no discovered storage. The vCPU count is as provisioned.

I also modeled disaster recovery with Azure Site Recovery and wrote the client's sequence: lift and shift first, then Entra Domain Services, then Azure Files.

  • Azure Migrate
  • Azure Site Recovery
  • Active Directory
  • Migration planning

Aerospace and defense networking

Azure Virtual WAN shared services

Designed and costed Virtual WAN shared services over site-to-site VPN, with Azure Firewall, Bastion, and DNS Private Resolver in a secured hub.

  • 17sites
  • 152servers
Details

The client received an editable cost model with the design, so they could test their own assumptions.

  • Azure Virtual WAN
  • Azure Firewall
  • Bastion
  • DNS Private Resolver
  • Site-to-site VPN

Microsoft 365 Copilot 3 clients

Copilot readiness and AI governance

Delivered Copilot readiness assessments that map oversharing, labeling, and identity gaps into phased remediation plans.

  • 3clients assessed
  • 32findings, 5 Critical
  • ~86,900files in one scope
Details

For a 224-seat construction firm, I turned 32 findings, 5 of them Critical, into a phased plan. For a government services client, the scope covered about 86,900 files and about 1,060 anonymous sharing links.

I also wrote the construction firm's AI Acceptable Use Policy, tied to Purview labels, DLP, and prompt-security controls. It covers jobsite imagery, embedded AI features, HR use, disclosure in bids, and an approved-tools register. I then packaged the assessment as a reusable offer with a governance statement-of-work skeleton for the consulting team.

  • Purview DSPM for AI
  • SharePoint Advanced Management
  • Sensitivity labels
  • DLP
  • AI governance

Incident response

Investigations that hold up

Root-caused an account compromise to adversary-in-the-middle session token theft and delivered an executive incident report with prioritized controls.

  • AiTMroot cause found
  • 90user tenant rebuilt
Details

The compromise was traced through Entra sign-in, Purview audit, and message trace data.

Separately, I reconstructed a device enrollment incident from Entra and Intune audit logs for a 90-user tenant, correcting the original incident narrative and identifying a missing enrollment restriction as the systemic gap.

  • Entra ID
  • Purview Audit
  • Intune
  • Message trace

Identity and access

Hardening identity and access

Privileged access, phishing-resistant sign-in, and Kerberos work sized to each client's licensing, from 3-admin small businesses up.

  • 40+CA policies in the largest tenant
Details
  • Designed privileged access controls with PIM, FIDO2 break-glass accounts, and Intune Multi Admin Approval.
  • Planned phishing-resistant authentication rollouts with passkeys, Windows Hello for Business, and authentication strengths, sequencing enforcement around Azure Files Kerberos and VDI dependencies.
  • Migrated Azure Files authentication from Entra Domain Services to Entra Kerberos for cloud-only identities, scripting ACL remediation and deploying Kerberos settings through Intune.
  • Published private access to Azure SQL through Entra Private Access and wrote the multi-phase onboarding runbook with prerequisite checks.
  • PIM
  • Conditional Access
  • Passkeys
  • Entra Kerberos
  • Entra Private Access

Automation

Tooling I've built

PowerShell, Graph, Azure CLI, and KQL tools for audits, reporting, and diagrams, including a license-gap report run across 3 customer tenants.

  • 3tenants on the license-gap report
See the tools
  • A multi-tenant PowerShell and Microsoft Graph license-gap report comparing paid vs. active Entra ID P1/P2, Purview, and Microsoft 365 Apps seats.
  • An Azure RBAC export across all subscriptions that flags direct vs. inherited assignments and orphaned principals.
  • An Azure Resource Graph to draw.io to Visio environment diagram pipeline.
  • A SharePoint file inventory with version-size reporting, and an Azure Files broken-inheritance ACL scan.
  • A mailbox delegated-permissions export and a message trace loop for per-user sent counts over 90 days.
  • KQL for Conditional Access change history and Data Factory pipeline change auditing, plus Fabric REST sweeps for item ownership.
  • PowerShell
  • Microsoft Graph
  • Azure CLI
  • KQL
  • Resource Graph

// 03

Day to day

The recurring work at CloudServus, beyond the projects above. Pick an area.

Azure infrastructure

  • Making Private Endpoints, Private DNS zones, DNS Private Resolver and conditional forwarders, NVAs with TLS inspection, UDRs, and NSGs work together across hub-and-spoke networks and multiple subscriptions.
  • Recovering and rebuilding VMs and SQL VMs from snapshots and restore points (the largest so far 16 vCPU and 128 GiB), fixing AVD host pools, and right-sizing VMs with Azure Monitor, VM Insights, and Advisor.
  • Fixing Azure PaaS and data platform issues: Function Apps (Flex Consumption, GitHub Actions OIDC deploys), Key Vault RBAC and App Service Certificates, a Git-integrated Data Factory with about 112 pipelines, Logic Apps, and Microsoft Fabric item ownership.
  • Choosing Defender server SKUs and onboarding mixed on-premises and Azure servers through Azure Arc and the client's RMM.

Identity and devices

  • Fixing Entra join, hybrid join, PRT, and MDM enrollment failures on laptops, Azure VMs, and AVD session hosts (dsregcmd, SCP, Entra Connect and Cloud Sync, AADLoginForWindows).
  • Hardening privileged access and rolling out phishing-resistant authentication, including passkey enforcement order, registration campaigns, and side effects on Azure Files Kerberos and VDI.
  • Sorting out cross-tenant and partner access: guest MFA dead ends, GDAP consent gaps, third-party app registrations, and app credential expiry monitoring.
  • Running Intune enrollment and ownership controls (enrollment and platform restrictions, CA device filters, MAM-WE, Autopilot) and packaging Win32 and LOB apps with Settings Catalog and OMA-URI, including an RMM agent rollout through N-able N-central.
  • Setting up RADIUS Wi-Fi with Entra MFA: NPS with the Entra MFA extension, PEAP, and Intune Wi-Fi profiles.

Security and compliance

  • Investigating security incidents from sign-in, audit, and mail logs, revoking sessions, reviewing inbox rules, and writing client-facing reports.
  • Tuning detection and mail-flow security in Defender XDR, Defender for Office 365, Defender for Cloud Apps, and Advanced Hunting: finding why expected alerts didn't fire, inventorying alert rules, and locking down external forwarding.
  • Scoping Purview licensing and roles: DSPM, SharePoint Advanced Management, Defender server SKUs, and read-only Purview access without data visibility.

Exchange and Microsoft 365

  • Exchange Online and on-premises Exchange: transport rules, archives, message trace, delegation reporting, and forwarding controls.
  • Tenant and domain migrations, at least three so far, including a tenant-to-tenant move with a domain rebrand and hybrid join cleanup, and a commercial to GCC High domain move with on-premises AD.
  • Distributing Teams apps and Copilot agents through setup policies and app-centric management.
  • Pushing company holidays to every mailbox with a Graph app-only runbook scoped through Exchange RBAC for Applications.

Copilot and AI governance

  • Copilot readiness work with Purview DSPM and DSPM for AI, Data Risk Assessments, SharePoint Advanced Management, DAG reports, Restricted Content Discovery, labels, DLP, and Compliance Manager.
  • Copilot agent governance: who can build and share agents, Teams distribution, pay-as-you-go billing policies, Copilot Credits, and Security Compute Units.
  • Evaluating AI tools for the firm (Claude Code vs. GitHub Copilot CLI, including data-handling terms), completing vendor security questionnaire attestations, reviewing the risk of a multi-tenant AI integration platform, and setting conditions on a contractor's AI mailbox access.

Consulting, cost, and partner work

  • Client-ready documentation: PDF guides, Word reports, runbooks, one-pagers, and decks, plus reviewing client and internal communications so they're accurate and safe to forward.
  • Presales: phased, hour-estimated plans with a recommended first phase, scoping-call prep, and battle cards.
  • Cost work: Contributor-only cost-savings export blueprints (Cost Management, Advisor, Azure Monitor, Power Platform pay-as-you-go attribution) and editable Azure cost models with stated assumptions.
  • License-gap reviews across the customer base (paid but unassigned, assigned but inactive) that also feed the firm's partner specialization metrics in Partner Center.
  • Handling scope and hours escalations on retainer engagements.

// 04

Experience

Select a role to expand or collapse it.

CloudServus Senior Microsoft Infrastructure Consultant Mar 2023 to Present Austin, TX (Remote)
  • Senior Microsoft Infrastructure Consultant2024 to Present
  • Microsoft Infrastructure ConsultantMarch 2023 to 2024
  • Final technical escalation point for the consulting team across a 13-client portfolio with more than 5,000 end users.
  • Deliver $50K to $150K a year in client licensing and Azure savings across the portfolio.
  • Led 10+ end-to-end projects since 2023: on-premises to Azure migrations, tenant-to-tenant Microsoft 365 migrations, Azure Virtual Desktop deployments, and Intune and Defender fleet rollouts.
  • Built security in production: the Defender suite and Intune compliance; Entra ID Conditional Access, PIM, and governance; Purview DLP, sensitivity labels, retention, and eDiscovery.
  • Integrated applications with Entra ID through SAML SSO enterprise apps, OIDC and OAuth app registrations with API permissions, and SCIM user provisioning to SaaS apps.
  • Automated identity lifecycle (joiner, mover, leaver), alerting and auto-remediation, system-to-system integration, and scheduled reporting with PowerShell, Microsoft Graph, KQL, Azure Logic Apps, Azure Functions, and Power Automate.
  • Restored on-premises Exchange OWA and ECP by renewing the Exchange Auth Certificate and repairing a partially applied cumulative update.
Hyliion IT Systems Engineer Jul 2022 to Mar 2023 Cedar Park, TX
  • Replaced the VPN with Cloudflare Zero Trust and rolled out Cisco Umbrella.
  • Worked on an Azure Enterprise Scale migration, including DNS A-record automation for private endpoints.
  • Reclaimed 200+ inactive SharePoint sites through a governance effort.
  • Deployed Azure Files and File Sync and supported 300 users.
R2 Corp IT Specialist Jul 2021 to Jul 2022 Austin, TX
  • Global admin for Microsoft 365 and Azure, supporting 50+ users.
  • Deployed a 45-camera IP surveillance system for R2v3 certification.
  • Built a hard drive wiping system with WipeQ and RazorERP that produced a $200K revenue increase in its first month.
Insight Global Help Desk Technician, contract with a Fortune 500 retailer Oct 2020 to Jun 2021 Austin, TX
  • Provided white-glove support for Fortune 500 corporate employees.
  • Served as the RSA token subject matter expert and wrote 2 knowledge base articles.

// 05

Skills

Grouped by area and by depth. Search or filter to find something specific.

Azure infrastructure

Expert

  • Azure VMs, disks, and snapshots
  • Private Endpoints
  • Private DNS
  • DNS Private Resolver
  • Azure Files and File Sync

Working knowledge

  • Azure Virtual WAN
  • VPN Gateway
  • Azure Firewall
  • Bastion
  • Front Door
  • Azure DNS
  • Azure Virtual Desktop
  • Windows 365
  • FSLogix
  • Azure RBAC
  • Azure Migrate
  • Azure Site Recovery
  • Azure Monitor
  • Log Analytics
  • Cost Management
  • Key Vault
  • Resource Graph
  • Azure Functions
  • Logic Apps
  • Data Factory

Familiar

  • Microsoft Fabric
  • Purview Data Map

Virtualization and datacenter

Expert

  • Hyper-V
  • Failover Clustering
  • Switch Embedded Teaming

Working knowledge

  • SCVMM
  • RDMA and RoCE
  • VMware vSphere (as a migration source)
  • StarWind V2V
  • Citrix VDI support

Familiar

  • Dell storage arrays

Identity and access

Expert

  • Entra ID
  • Conditional Access
  • Entra join, hybrid join, and PRT
  • Entra Kerberos for Azure Files
  • Active Directory and DNS

Working knowledge

  • PIM
  • Passkeys and FIDO2
  • Windows Hello for Business
  • Entra Private Access
  • Global Secure Access
  • Entra Connect and Cloud Sync
  • Entra Domain Services
  • Cross-tenant access and B2B
  • GDAP
  • Identity Protection
  • SAML SSO
  • OIDC and OAuth
  • SCIM provisioning

Familiar

  • NPS with the Entra MFA extension

Security and compliance

Expert

  • Purview DSPM and DSPM for AI
  • SharePoint Advanced Management

Working knowledge

  • Defender XDR
  • Defender for Office 365
  • Defender for Endpoint
  • Defender for Business
  • Defender for Servers
  • Defender for Cloud Apps
  • Sensitivity labels
  • DLP
  • Retention
  • eDiscovery
  • Purview RBAC
  • Compliance Manager
  • Incident response

Familiar

  • SentinelOne Prompt Security

Frameworks: CIS Benchmarks and Secure Score, NIST 800-171 and CMMC, HIPAA, SOC 2, PCI, and cyber insurance questionnaires.

Microsoft 365 and endpoints

Expert

  • Exchange Online
  • Microsoft 365 admin and licensing
  • Microsoft 365 Copilot governance
  • Windows 11 and Windows Server troubleshooting

Working knowledge

  • Intune
  • Autopilot
  • Exchange Server
  • SharePoint and OneDrive
  • Teams admin
  • Cross-tenant mailbox migration
  • GCC High
  • Copilot agent governance
  • Copilot Credits and pay-as-you-go billing

Familiar

  • Mimecast
  • N-able N-central

Automation and tooling

Expert

  • PowerShell

Working knowledge

  • Microsoft Graph
  • KQL
  • Azure CLI
  • Bash
  • jq
  • Power Automate
  • draw.io and Visio
  • Partner Center and CPOR

Familiar

  • Git and Azure DevOps

// 06

Certifications

Microsoft

  • Azure Solutions Architect ExpertAZ-305
  • Identity and Access AdministratorSC-300
  • Azure Administrator AssociateAZ-104
  • Azure Virtual Desktop SpecialtyAZ-140
  • Data Engineer AssociateDP-203

CompTIA

  • Security+SY0-601
  • Network+N10-007
  • A+220-1001/1002
  • Project+PK0-005

AWS

  • Certified Cloud PractitionerCLF-C01

// 07

Contact

email qdw001@outlook.com
linkedin linkedin.com/in/quentin-d-williams
Esc