Shaheer
Khalid.

Queries an Entra ID tenant via Microsoft Graph API and PowerShell. Flags accounts missing MFA, identifies stale users, and surfaces over-privileged role assignments. Outputs a structured JSON + HTML report.

Takes an IAM policy JSON as input. Cross-references it against known escalation paths and outputs which privilege escalation chains are achievable from that permission set — with CloudTrail detection rules for each.

Deployed Keycloak as an OIDC/SAML Identity Provider. Configured SSO federation across three service providers. Documented the full trust relationship model — token issuance, assertion validation, and what breaks if misconfigured.

Ran Prowler and AZQr against a live Azure environment. Triaged findings by severity, mapped each to the CIS Azure Benchmark, and produced a remediation report — the kind of output you'd hand to a client.

Reusable Terraform modules for Azure IAM — Conditional Access policies, PIM role assignments, and least-privilege RBAC definitions. Treats identity configuration as code with version control and peer review baked in.