About
NBPTech is me — Jurre Janssens. I build identity platforms on Microsoft Entra and Azure, and chase the security questions that sit between them.
By day I’m Senior Cloud Infra IAM Engineer at Enexis, and Lead IAM Engineer on Veranet — the shared IAM platform of the Dutch regional grid operators (a collaboration between Alliander, Enexis and Stedin) that gives partner organisations and their contractors controlled, auditable access to shared sector applications. I built that platform, from the Entra tenant down to the Azure environment underneath.
Everything is managed as code, DevSecOps style: the whole Entra tenant in Terraform — access packages, PIM, Conditional Access, administrative units, down to tenant settings — and the Azure environment it runs on the same way. Pipelines run on workload identity federation with scanning gates on every pull request, so there are no stored secrets in the chain. It also means the environment a finding came out of is reproducible and reviewable, not clicked together in a portal and forgotten.
This site is where findings from that work get written down: configurations that behave unexpectedly, permission models that don’t match their documentation, and the occasional genuine security gap.
On accuracy
Everything here is something I encountered directly and verified. Where a conclusion is provisional, the post says so. Identity platforms change frequently — a post that was accurate when published may not stay that way, and materially revised posts carry an updated timestamp.
Corrections are welcome and get credited.
On disclosure
Customer identifiers — tenant IDs, object IDs, domain names, account details — are removed or replaced with placeholders throughout, including in screenshots and command output. Nothing here is meant to identify a specific customer or partner organisation. Where a finding is a genuine vendor vulnerability rather than a configuration gap, I raise it with the vendor before writing it up.
Contact
Reach me on LinkedIn.
For anything security-sensitive, say so in the first message and we’ll move to an appropriate channel before any details are exchanged.