- Based in Switzerland
- Moving to Singapore
Microsoft 365, identity & security engineer. Microsoft Certified Trainer. Ready for Singapore.
I'm Nils Lappenbusch, an IT engineer from Germany, based in Switzerland. I modernise Microsoft 365 environments, roll out Conditional Access and Intune, trace mail flow problems to the root cause and automate the work with PowerShell and Microsoft Graph. Email security, up to DMARC p=reject, is one of my specialisations. I also build my own software, with AI where it actually helps.
Open to roles in Singapore
I have spent several weeks living in Singapore and want to build the next chapter of my career and life there, on the foundation I have built in Switzerland. Why Singapore
- Permanent positions: senior Microsoft 365 or security engineer, Modern Workplace consultant or architect, regional workplace responsibility
- Also open to contract work for Microsoft partners, MSPs and in-house IT teams
What I do
Six areas I can own from day one
In IT since 2012, focused on Microsoft 365 since 2020. Every area below is something I have planned, built, migrated and documented in production environments.
Exchange & mail flow
Exchange Online and hybrid, connectors, MX cutovers, decommissioning the last Exchange server, SMTP relay replaced with Microsoft Graph.
Email security
SPF, DKIM and DMARC to p=reject, MTA-STS, mail gateways, Defender for Office 365 policies that are tested, not assumed.
Identity & access
Entra ID, Conditional Access rolled out in phases, app registrations, managed identities and least-privilege Graph permissions.
Endpoint management
Intune and Windows Autopilot, compliance and configuration profiles, moving devices and profiles from on-premises AD to Entra ID.
Automation & AI
PowerShell and Microsoft Graph, REST APIs, and AI agents that propose while a human approves. Business processes, not just scripts.
Training
Microsoft Certified Trainer. I explain Microsoft 365 to administrators, help desks and management in a way that sticks.
Proof
Two things I built, and what they prove
The M365 Control Plane runs Microsoft 365 operations for many tenants without handing a certificate to its automation. DokAudit is my own product: it makes PDFs accessible with a local layout model and an LLM only where needed, and proves the result in veraPDF and PAC.
M365 Control Plane
Multi-tenant Microsoft 365 operations with baselines, change evidence and a runner that never sees a certificate.
Problem, build, proof Own product · AI · accessibilityDokAudit: accessible PDFs with AI, proven
A SaaS that makes PDFs accessible (PDF/UA, WCAG, EN 301 549) and proves it, with a local layout model and an LLM only where needed.
Problem, build, proofWhat would you hand me on day one?
How I work
Every change has a way back
My scripts and tools follow the same pattern, whether it is mail routing, Conditional Access or a profile migration. It is boring on purpose. Production systems are no place for surprises.
- Read-onlyLook first. Nothing changes by default.
- BackupExport the current state before touching it.
- PilotA small, deliberate group first.
- Explicit applyChanges only with an explicit switch.
- EvidenceLogs, runbook and a restore path for your team.
Initiative
Products I built and run
Besides client work, I build software on my own initiative. These products are live, you can use them, and they show how I think about email, compliance and automation.
DMARC Geeks
DMARC report analytics, DNS check, mail tester and a Microsoft 365 threat-policy test.
More on DMARC Geeks
DokAudit
Makes PDFs accessible (PDF/UA, WCAG, EN 301 549) with a local layout model and an LLM only where needed, and proves it in veraPDF and PAC.
More on DokAudit
VibeBoxes
Hosting for web apps built with AI: one container per app, versions, rollback, plus vibe-code audits.
More on VibeBoxes
Kursbox
Booking and administration software for university sports: courses, payments, facilities, statistics.
More on KursboxLatest insights
Notes from the work, with the commands
Practical articles on Microsoft 365, identity and email security: steps, PowerShell, typical mistakes and a checklist.
Making 1,000-page PDFs accessible with AI: what worked and what did not
Lessons from building DokAudit: rules first, a local layout model, an LLM only for uncertain pages, a cross-check against the page image and a cost budget.
Email authenticationDMARC for Singapore companies: what Cyber Essentials asks for, and how to reach p=reject
What CSA Cyber Essentials (2025) clause A.4.4 says about SPF, DKIM and DMARC, and a step-by-step path to p=reject that does not break legitimate mail.
Email securityBusiness email compromise in practice: what DMARC stops, what it does not, and what Defender for Office 365 adds
DMARC stops exact-domain spoofing. Lookalike domains, display names and compromised vendor mailboxes need Defender for Office 365 and a payment process.
Time-zone bridge
Singapore and Europe in one working day
Many teams in Singapore report to a headquarters in Germany or Switzerland. I have worked in both countries and speak the language of the people on the other end of the call, in German and in English. Here is how the hours line up, live.
Singapore
--:--
SGT · UTC+8 · no daylight saving
Office hours Mon–Fri 09–18Germany
--:--
Danndorf · Lage · CET/CEST
Office hours Mon–Fri 09–18Switzerland
--:--
Buchs ZH · CET/CEST
Office hours Mon–Fri 09–18Singapore is currently 6 hours ahead of Germany and Switzerland (7 hours from late October to late March, when Europe is on winter time). A 09:00–18:00 day in both places overlaps from 15:00 to 18:00 Singapore time, which is 09:00–12:00 in Germany and Switzerland.
Working from Singapore, I cover your full business day and can still reach a European headquarters in its morning. Working from Europe, your afternoon is my morning.
Hiring for Microsoft 365, identity or email security in Singapore?
Permanent role, contract or a first conversation: write to me. I answer personally.