Emil Dosen
blog / projects / github

Writing about Microsoft infrastructure, identity, and security, from Active Directory and Intune to Sentinel and Entra ID.

Latest posts
See all posts
  • Searching the Unified Audit Log by SharePoint or OneDrive URL
    How to use the ObjectId field in Microsoft Purview to filter audit log events by SharePoint or OneDrive URL.
  • Convert Entra ID ObjectID to SID
    PowerShell one-liners to convert between Entra ID ObjectID (GUID) and SID formats for Intune local admin group membership.
  • Configuring Microsoft Sentinel with Entra ID and UEBA
    Step-by-step guide to setting up Microsoft Sentinel, connecting Entra ID logs, and enabling UEBA for behavioral anomaly detection.
Recent projects
See all projects
  • Beacon
    Multi-tenant security alerting for Microsoft 365 powered by Azure Functions and Log Analytics.
© 2026 Emil Dosen