BenAnderson-Brown

Managing 138 separate tenants as one estate

Most endpoint engineers look after one tenant. An MSP looks after a lot of them, and they drift apart. Every client turns up with its own history, its own licensing and its own list of exceptions someone agreed to years ago. Left alone, that's 138 different problems.

So most of the work is standardising — baselines for device compliance, Conditional Access and identity that hold up across businesses of very different sizes, and keeping the exceptions deliberate instead of accidental. Enrolment, policy and remediation get handled as one estate of 1,122 devices rather than 138 unrelated jobs.

The awkward part is that these are separate businesses. A change that suits one client can't be allowed to break another, and there's no single maintenance window to do it all in.

• Microsoft Intune
• Entra ID
• Conditional Access
• Compliance policy
• Multi-tenant administration
• Datto RMM

Essential Eight hardening in healthcare

Dental and medical practices hold sensitive data and get held to external standards for it — the ACSC Essential Eight, and RACGP requirements for general practice. It isn't internal policy you can quietly deprioritise.

The hard part isn't the config. Hardening is disruptive on purpose. MFA and Conditional Access change how every clinician logs in, and patching and application control take away software people have used for years. Doing that across a lot of small businesses means the conversation is usually harder than the change.

What I've built is a repeatable way to get a tenant from unhardened to defensible — MFA and Conditional Access enforced, Secure Score gaps closed, and the documentation to show it was done. Applied the same way each time, instead of reacting once something goes wrong.

• ACSC Essential Eight
• RACGP alignment
• MFA
• Conditional Access
• Microsoft Secure Score
• Access governance

DentalKB — a self-hosted AI search tool

A personal project, and the thing I've learned the most from. It builds a searchable knowledge base of dental equipment and vendor documentation — it finds and crawls the sources itself, pulls the text out of PDFs and web pages, does semantic search over them, and has a language model answer using what it retrieved rather than what it remembers.

The interesting constraint was hardware. Instead of paying for hosted inference I ran the whole thing locally on two Intel Arc B60 cards, which meant serving a quantised 32-billion-parameter model under vLLM split across both GPUs, on Intel's XPU runtime instead of the usual CUDA path. There's a lot less written about doing it that way. Search runs on vector indexes inside SQLite, so there's no separate database to run.

The bit I'm most pleased with is boring. Leaving the GPUs loaded wastes power and the fans are loud, so a watcher shuts the inference container down after fifteen minutes of real inactivity and starts it again on demand — and separately wakes it for the overnight batch jobs, which can't start it themselves. Most of the work was making sure "idle" meant actually idle. An earlier version measured it in the wrong place and killed the model mid-request.

Built with AI assistance. The architecture and the operational decisions are mine.

• Python
• FastAPI
• vLLM
• Qwen3-32B (AWQ Int4)
• Intel Arc / XPU
• SQLite + sqlite-vec
• Playwright
• Docker Compose
• nginx
• systemd