About Merill Fernando
Founder · Builder · #1 Entra fan
I make Microsoft security practical.
I’m Merill Fernando. I spent years inside Microsoft as a Product Manager on Entra, helping the world’s largest organisations secure identity. In 2026 I left to found Jozra and work full time on Maester, the open source project tens of thousands of tenants rely on to keep Microsoft 365 secure.
- Melbourne, Australia
- Ex-Microsoft Entra PM
- Founder, Jozra
- Blogging since 2003
The short version
Twenty years of building things for the Microsoft community
I grew up in Sri Lanka, where the best tools were usually priced for someone else. I started this blog in 2003, was awarded Microsoft MVP in 2004, and built the Sri Lanka .NET User Group into one of the largest in the country. The habit of building things and giving them away never left.
At Microsoft I was a Principal Product Manager in the Entra product group. I worked directly with some of Microsoft’s biggest customers on identity strategy and deployment, then carried what I learned back to the engineering teams. Along the way I shipped Entra External Authentication Methods and Entra PowerShell, and co-created the Zero Trust Assessment and the Entra Security Hardening guide.
In 2026 I left to start Jozra, an independent Australian company that builds tools for the people who keep Microsoft 365 secure. Our first product is Maester Cloud, the evidence layer that sits on top of the open source framework. The deal is simple: the framework and its core tests stay free and open forever, and the paid services fund the work.
Security testing should be open, reusable, and available to everyone. Not just the teams with the biggest budgets.
From the Maester Manifesto
What I’ve built
Ten things people actually use
Free, practical tools for admins, developers, and security teams. Most are open source. All of them started as something I needed myself.
Maester
Open source test automation framework and security analyzer for Microsoft 365. Turns best practices into tests you can run every day.
Entra.News
The weekly briefing on Microsoft Entra for admins and security folks. Everything worth knowing, from Microsoft and the community, in one email.
Entra.Chat
My weekly podcast with the people who build and run Entra: Microsoft product managers and practitioners from IKEA, General Motors, McDonald’s and more.
Lokka
The MCP server for Microsoft 365. Lets AI agents like Claude and GitHub Copilot query and manage your tenant through Microsoft Graph in plain language.
Graph X-Ray
Fiddler for Microsoft 365. A browser extension that watches what the admin portals do and hands you the Graph PowerShell to do it yourself.
Graph Permissions Explorer
Browse every Microsoft Graph API and see exactly what data each permission exposes before you grant it.
cmd.ms
Your Microsoft Cloud command line. Type a shortcut, land on the right admin portal or docs page. No more bookmarks.
MSIdentityTools
PowerShell cmdlets for the everyday Entra tasks that Graph makes harder than they should be. Built at Microsoft, used everywhere.
Entra Exporter
Export the entire configuration of a Microsoft Entra tenant to JSON so you can version it, diff it, and know what changed.
Zero Trust Assessment
Microsoft’s PowerShell module that checks your tenant against Zero Trust guidance and tells you what to fix first.
Writing & conversations
Sharing what matters
Every week I publish Entra.News for 19,000 identity and security practitioners, and co-author MSAI Weekly, a roundup of Microsoft AI news worth your time.
On Entra.Chat I talk with the people building and operating identity at scale, including Martin Sandren from IKEA, Andrew Cameron from General Motors, and George Roberts from McDonald’s.
Speaking
On stage, around the world
I speak at identity, security, and workplace conferences across the United States, Europe, and Australia. Recent stages include Workplace Ninjas, Experts Live Denmark, and the HIP Conference.
My sessions are built to send people home with something they can do on Monday, whether they are new to Entra or running identity for hundreds of thousands of users. Want me at your event? Find me on Sessionize.
From the community
Kind words I’m grateful for
“Many of us can learn from your impressive drive and always positive and welcoming attitude.”
Claus Jespersen, former Principal Consultant, Security at Microsoft“Your content, insights, and especially your podcast have helped so many professionals better understand identity, Entra, and cybersecurity challenges in a practical and accessible way.”
Karl A., identity and security practitionerLet’s connect
Say hello
The fastest way to reach me is on LinkedIn or X. Email works too: merill at merill.net.
Cheers,
Merill