IT Automation · Microsoft 365 · Security

I build the automation that runs IT behind the scenes.

Microsoft 365 administration, automation, and security. Here's some of what I've built at work.

See the work → Resume ↓
Robin Pokharel
RPSave your photo as photo.png next to this file
Available for new roles

Work Projects

Shipped · 10

I build these end to end, from the Entra ID app registration and Graph API permissions through to the finished workflow. High-level overviews; client and tenant details are left out.

01

Identity · Lifecycle

Offboarding Automation

A Power Automate flow that handles offboarding from a single request: updating accounts and access, moving the user's files to their manager, and tracking the device back. Takes a long manual checklist off IT and keeps access removal consistent.

Power AutomateGraph APIEntra ID
Swipe through the workflow →
  1. Step 01Offboarding email received
  2. Step 02Employee details extracted
  3. Step 03Scheduled until offboarding date
  4. Step 04Entra ID updated
  5. Step 05Files transferred to manager
  6. Step 06Licenses removed
  7. Step 07Groups reviewed
  8. Step 08Mailbox converted
  9. Step 09Return label created
  10. Step 10Tracking saved
  11. Step 11Reminders sent
  12. Step 12IT notified on return
02

Identity · Lifecycle

Onboarding Automation

A Power Automate flow that sets up new hires from HR data: creating the account, applying department-based access, setting up email, and assigning licenses and groups. Cuts down the repetitive setup and keeps new accounts consistent.

Power AutomateEntra IDGraph APIExchange
Swipe through the workflow →
  1. Step 01HR data received
  2. Step 02Details validated
  3. Step 03Account created
  4. Step 04Department logic applied
  5. Step 05Email configured
  6. Step 06Licenses assigned
  7. Step 07Groups added
  8. Step 08Access routed
  9. Step 09IT notified
03

Compliance

OIG Compliance Screening

A scheduled Power Automate job that runs a Python runbook in Azure Automation to check staff against the OIG exclusion list, then emails compliance any potential matches. Replaces a manual, list-by-list comparison.

Azure AutomationPythonPower Automate
Swipe through the workflow →
  1. Step 01Power Automate runs on schedule
  2. Step 02Exclusion data downloaded
  3. Step 03Workforce records loaded
  4. Step 04Python comparison runs
  5. Step 05Potential matches identified
  6. Step 06Results logged
  7. Step 07Email sent to compliance
04

Operations

Microsoft 365 License Tracking

A Power Automate flow that tracks Microsoft 365 license usage and flags when licenses are running low or sitting unused. Gives the team a heads-up before it turns into a problem.

Power AutomateGraph APISharePoint
Swipe through the workflow →
  1. Step 01License data pulled
  2. Step 02Counts calculated
  3. Step 03Thresholds checked
  4. Step 04Low / excess flagged
  5. Step 05IT notified
  6. Step 06Tracking list updated
05

Collaboration

Teams & Group Provisioning

A Power Automate flow that spins up Microsoft 365 groups and Teams channels for new contracts with consistent naming and access. Saves setting each one up by hand.

Power AutomateTeamsEntra ID
Swipe through the workflow →
  1. Step 01Contract request received
  2. Step 02Workspace details captured
  3. Step 03M365 group created
  4. Step 04Teams channel created
  5. Step 05Access groups configured
  6. Step 06Owners assigned
  7. Step 07IT notified
06

Integration

Third-Party Account Provisioning

A Power Automate flow that keeps a third-party platform's accounts in sync: each day it compares the current users against the day before, builds a change file, and uploads it over SFTP. Keeps accounts current without manual updates.

Power AutomateSharePointSFTP
Swipe through the workflow →
  1. Step 01Current user list loaded
  2. Step 02Prior-day records checked
  3. Step 03New users detected
  4. Step 04Changed users detected
  5. Step 05Removed users detected
  6. Step 06Change file generated
  7. Step 07Tracking list updated
  8. Step 08Results logged
  9. Step 09Accounts uploaded to platform over SFTP
  10. Step 10IT notified
07

Endpoint Management

Endpoint App Deployment

Packaging and deploying app updates to Windows endpoints through Intune, using detection scripts and supersedence so devices stay on current versions. Keeps the fleet consistent without chasing updates by hand.

IntunePowerShellWin32 apps
Swipe through the process →
  1. Step 01Update identified
  2. Step 02Package prepared
  3. Step 03Detection script written
  4. Step 04Supersedence configured
  5. Step 05Target group assigned
  6. Step 06Deployment monitored
  7. Step 07Issues remediated
08

Identity · Governance

Access Reviews

A scheduled Power Automate flow that pulls the members of sensitive groups via Graph and sends each group's owner a Teams adaptive card to confirm who should keep access. Removals are applied and logged, so access doesn't quietly pile up over time.

Power AutomateGraph APITeamsSharePoint
Swipe through the workflow →
  1. Step 01Power Automate runs on schedule
  2. Step 02Sensitive groups pulled via Graph
  3. Step 03Group owners identified
  4. Step 04Adaptive card sent in Teams
  5. Step 05Owner marks keep or remove
  6. Step 06Removals applied
  7. Step 07Changes logged
09

Security Operations

Alert Response Playbook

When a high-severity Sentinel or Defender alert fires, a playbook enriches it with the user's recent sign-ins, device, and group memberships via Graph, then posts a clean summary to the security channel. Critical alerts can disable the account or revoke sessions; lower-severity ones are logged for triage.

SentinelDefenderLogic AppsGraph API
Swipe through the workflow →
  1. Step 01High-severity alert fires
  2. Step 02Playbook triggered in Logic Apps
  3. Step 03Sign-ins pulled via Graph
  4. Step 04Device and groups gathered
  5. Step 05Summary posted to security channel
  6. Step 06Critical alerts auto-contained
  7. Step 07Outcome logged for triage
10

Identity · Reliability

Secret Expiry Monitor

A scheduled Azure Automation runbook that checks every Entra app registration for client secrets and certificates nearing expiry via Graph, and alerts IT weeks ahead. Keeps an expired secret from quietly breaking an integration, including the other flows here.

Azure AutomationPowerShellGraph API
Swipe through the workflow →
  1. Step 01Runbook runs on schedule
  2. Step 02App registrations pulled via Graph
  3. Step 03Secrets and certs checked
  4. Step 04Expiring ones flagged
  5. Step 05IT alerted ahead of expiry
  6. Step 06Results logged

Administration

Day to day

The day-to-day administration work I do.

Microsoft 365 administration

Managing users, licensing, and mailboxes, and keeping SharePoint, OneDrive, and Teams running for the org.

Identity & access

Provisioning and deprovisioning accounts, managing access and MFA, and role-based permissions across Entra ID and Active Directory.

Endpoint management

Enrolling and managing Windows devices through Intune and Autopilot, including device policies and app deployment.

Security operations

Monitoring Sentinel and Defender, and investigating and remediating security incidents.

Scripting & reporting

Using PowerShell and Graph for ad-hoc admin tasks, bulk changes, and reporting across the tenant.

What I do

I work primarily with automation, Microsoft 365 administration, and security. AI is part of my workflow for researching and solving unfamiliar problems, but I always validate its output against the underlying technology. Sensitive and tenant data stays out of AI tools.

How I work

On the job
01

Handling escalations

I'm comfortable handling the escalations the help desk passes up, the tickets that need more digging.

02

Clear communication

Able to communicate technical things to non-technical people: leadership, end users, and new hires.

03

Documentation

I document procedures and workflows so the team has something to follow and isn't relying on memory.

04

Compliance-minded

I've worked in clearance-required and healthcare environments, so least privilege, auditability, and careful handling of data are habits.

Contact

Let's talk

Open to new roles in IT, automation, and security.

Email
Phone 202-413-0061
LinkedIn linkedin.com/in/robinpokh
Resume Download PDF