Microsoft Modern Workspace · Intune · Entra · Graph

Modern Workspace,
decoded in the open.

I'm Ketan — a Microsoft Modern Workspace architect. I build endpoint-management tooling in the open, and write about how it actually works underneath the portal.

Read the blog → Browse projects
IntuneEntra IDMicrosoft GraphAutopilotDefenderAzure AutomationPower BI
Ketan Kamble
Ketan Kamble
Microsoft Modern Workspace Architect
Finland
Currently building Zero-Access Agent — open source (MIT)
Flagship project

Zero-Access Agent

The project I'm best known for — an AI agent that answers questions about an endpoint fleet while holding no access to any live system.

Open source · MIT

Give the AI the reports, never the systems

Scheduled read-only jobs export sanitized, pre-aggregated snapshots. The agent answers only from those — the permission boundary is enforced by architecture, not by asking a model to behave.

  • ✓ Read-only by construction — the agent holds no tenant scopes and no keys.
  • ✓ Run the whole pattern with no tenant, via a synthetic fleet generator.
  • ✓ Ten real read-only collectors, each with a plain-language teardown.
Explore the project →GitHub
zero-access-pattern.flow
1Source — Intune / EntraGET-only
↓
2Collect — runbooksread-only
↓
3Store — snapshotssanitized CSV
↓
4Retrieve — AI SearchRBAC read
↓
5Answer — AI agentno scopes · no keys
Explore

Everything I'm building

Posts, tools and projects — all in one place, added as I go.

Writing

The blog

"The Graph call behind the portal click" — decoding what the portal actually fires, and the permission it needs.
Flagship

Zero-Access Agent

The read-only AI agent pattern — full docs, ten collectors, and a synthetic fleet you can run with no tenant.
Reusable

Scripts library

Battle-tested PowerShell for Intune, Entra and Graph — each script standalone, each explained.
Reporting

Power BI reports

The endpoint reports I build on top of the read-only snapshots — screenshots, templates and how they're wired.

 Soon Signal, not noise

Newsletter

An occasional note when something's worth your time — new posts, new tools, lessons learned.
Who

About me

What I work on, how I work in the open, and how to get in touch.
From the blog

Latest writing

First posts landing soon — here's what's on deck.

Series · Zero-Access

The Sites.Selected 403 that started it all

How one stubborn permission error led to an architecture where the AI never touches a live system.

Coming soon
Series · Behind the portal

The Graph call behind the portal click

Decoding what the Intune / Entra portal actually fires against Microsoft Graph — and which permission it needs.

Coming soon
How-to · Power BI

An endpoint report from read-only snapshots

Building a Power BI report on sanitized CSVs — no live tenant connection required.

Coming soon
Working in the open

Let's build endpoint tooling that's honest about how it works

Everything here comes from a personal lab, reproduced before it's published — including what I got wrong. Follow along on GitHub, or subscribe for the occasional signal.

Read the blog →GitHub