Identity and endpoints
Microsoft 365, Entra ID, Conditional Access, Intune, Windows Autopilot and Azure Virtual Desktop for enterprise clients. Joiner-mover-leaver, device compliance, application deployment, and the access review nobody wants to do.
San Rafael, Argentina
Santiago Páez
I run Microsoft 365 and Azure for enterprise clients, and build the software that operates them. Most of it comes down to one question: where does a control belong, and what happens when it sits in the wrong place.
- Now
- ITaaS Consultant at Possumus, since January 2026
- Focus
- Identity, cloud platforms, and the software that runs on them
- Daily stack
- Entra ID, Intune, Azure, TypeScript, Python, PostgreSQL
- Also
- Incident response, CVE remediation, and whatever breaks at 2 a.m.
01
What I actually do all day.
Cloud and platform
Azure Container Apps, Redis, PostgreSQL and Docker. Scheduled sync pipelines that keep the source system out of the request path, real time across replicas, and deployments that survive their own restarts.
Build and automate
TypeScript and Python. Next.js services with tests and CI, integrations with Microsoft Graph, and internal tools that replace a spreadsheet somebody maintains by hand every Monday.
Incident response
Ransomware on endpoints, a cryptocurrency miner on a shared server hosting five web properties, and WordPress compromises that re-infected the database. Containment first, CVE remediation after, and a write-up before closing.
- 11months in production IT
- 300+API endpoints in service
- 6Microsoft credentials
- 2public projects, both tested
02
A control can be correct and still sit in the wrong place.
Position A
Filter after ranking.
The answer disappears as soon as documents the caller cannot read fill the top of the list.
Position B
Filter before ranking.
The same query returns the same answer, for every caller, at the same cost.
The difference
Nothing about the rule changed.
Only where it sits. Most of the work is choosing the position.
03
Three investigations, each with a number behind it.
37%
Recall, filtering after ranking
Sixty topics, 40 shuffles per point, 2,400 trials. The measured values reproduce the closed form, which is the only reason to trust them. My first two versions of this benchmark showed a flat 100% and were both wrong: tie-breaking, token length and digits in the topic names were deciding the result instead of relevance.
49/100
Security score, first run on my own domain
Passive checks only: mail policy, TLS, headers, cookie flags and files that should never be served. It refuses to scan without an explicit authorization flag and a recorded reason, because the difference between a posture check and an incident report is a signature.
1bit
Holds the whole feature
Found the device on the local network, mapped the 22-byte control frame, and tested five program ids against the physical machine while watching water, drum and heater. The offsets are documented, and the finding was reported to the vendor, who confirmed the decision is made globally rather than regionally.
04
Where the infrastructure habit came from.
-
2026 — now
Possumus · ITaaS Consultant
Microsoft 365, Entra ID, Intune, Autopilot and Azure Virtual Desktop for enterprise clients. Designed the internal operations platform the IT area runs daily.
-
2025
miservicio · GEPE Sport · Tornaxo
A services marketplace as co-founder, an e-commerce platform with an offline-first mobile app, and an embedded Shopify app for a Dutch client.
-
2023 — 2024
PowerAPP · monolith to services
Containerisation, Redis, and a reverse proxy that taught me more about failure than any tutorial.
-
2021 — now
Universidad de Mendoza
Computer Engineering. Final year, six examinations from the degree.