Project / Delivered
SharePoint, Azure Functions & permissions engineering
Central document library for resident records across a multi-site care provider on an aggressive M&A growth plan, with permissions that change as residents move through referral, settling, transfer, and discharge. Sole engineer, end to end, 2023-2024. SharePoint Online, Azure Functions, and a third-party control plane — Dynamics had been ruled out at the outset.
- Status
- Delivered
- Group
- Client Work
- Stack
- SharePoint Online, Azure Functions, Azure Storage Queues, Entra ID, Application Insights, Azure DevOps, PowerShell, REST APIs
- Repo
- Previous employer — private (Azure DevOps)
- Related writing
- Check Your SharePoint Scope Count Before It Bites You
Architecture
- Custom REST API surface (Azure Functions HTTP triggers) consumed by the third-party control plane. Azure Storage Queues move permission operations into background processing, keeping request response times inside the 2-minute timeout while inheritance breaks and re-applies run separately.
- Lifecycle-driven permissions across ~5,000 dynamic Entra groups (per-service, per-role, departments, and bolt-on services). Group strategy designed in collaboration with SharePoint and Entra engineers.
- Get-state-first verification pattern — discrepancies are raised back to the control plane rather than assumed correct. Self-service ResetPerms endpoint for support to remediate edge cases without engineer involvement.
- Diagnosed the 50,000 unique permission scope ceiling in production via Application Insights. Ran a half-million-record audit, re-engineered the status model to consolidate scopes, projected a 2029 runway, and added a 90% threshold alert so future remediation has lead time.
- Document Sets for child-file metadata inheritance; ID-firstname-lastname folder naming so name changes flow through without breaking references.
- Azure DevOps CI/CD: commit-message-driven release gates ([dev]/[UAT]/[PROD]), Pester unit tests on UAT/PROD path, deployment slots with slot-specific environment variables.
- Alongside a parallel 20TB file-server migration: spotted Azure File Sync on the source and pivoted to pull from the Azure side, sidestepping the slow WAN.
Evidence
- Sole engineer, end-to-end, from architecture through as-built documentation.
- Follow-on contract won; a successful change request delivered under budget and under time.
- Production system running across ~200 sites and ~5,000 residents.
- 50,000 scope ceiling diagnosed, audited, and remediated in production — alerting threshold added for next time.
Postscript
Scoped before I'd built the muscle for assumption surfacing at scale. Reshaped how I scope today — explicit assumption validation upfront, early variance flagging, and structured peer review on SOWs and HLEs before commitment.