Project — M365 WATCH (Microsoft 365 Apps fleet monitoring)

Overview

Monitoring a 50,000-seat Microsoft 365 Apps fleet rested on a manual gesture: every morning, a CSV export downloaded from Microsoft's admin portal, pushed through a chain of Python scripts and dumped into SQL Server. No interface, no usable history, no detection of at-risk machines — and monitoring that stopped the moment the person stopped.

M365 WATCH — Workplace Apps Telemetry, Compliance & Health — replaces that chain with two deliverables: a headless collector driven by a scheduled task, and a ten-view desktop application that gives the state of the fleet, the history of every machine and the populations to fix. Version v0.10.0 in production, daily collection running, 73,555 machines in the database.

From the dropped export to a fleet under control: the collector ingests, the database records only changes, the application replays history and isolates at-risk machines.

◆ What the tool makes visible

What the tool makes visible

A

Where does the fleet stand?

A dashboard gives the spread of Office and Windows versions, the overall health of the fleet and its trend — instead of a CSV file that had to be opened and sorted by hand.

B

What happened on this machine?

A search by machine or user name opens the full history: Office and Windows versions, channel changes, disk space — replayed from the intervals, with no depth limit.

C

Which machines are in trouble?

Six rules isolate the populations to deal with: critical disk space, Office behind its channel, unpatched Windows, machine out of support, stale data. Every population is clickable and exportable to Excel.

D

What is about to expire?

An end-of-support calendar cross-references Windows builds and Office versions with Microsoft's real servicing end dates: what expires, when, and across how many seats.

◆ Key features

Key features

01

Headless collector

An executable with no interface, driven by a scheduled task: it watches a drop folder and ingests the exports, CSV or ZIP read in place. Idempotent and replayable — ingesting the same export twice creates no duplicates.

02

Interval-based history

Rather than stacking one snapshot per day per machine, the schema records only changes. Measured in production, a machine writes just one to three movements per collection — full history across 50,000 seats without a volume explosion.

03

At-risk machine detection

Six health rules, each population clickable and then exportable. Thresholds are display parameters, never collection parameters: changing one replays the whole history already in the database, with nothing to re-collect.

04

Watch groups

A list of machines to keep an eye on — a migration wave, a site, a batch of laptops. Created today, a group immediately shows its entire past: the history is already in the database, it does not have to be built up afterwards.

05

Hand-drawn charts

Migration curves by build wave, fleet trend, disk space of a machine over time — rendered directly in WPF with no charting library: nothing to license, nothing to keep up with across versions.

06

Legacy history migration

More than two million rows from the legacy database migrated to the interval model, in memory-bounded batches: the fleet arrives with its past on day one, rather than after a year of collection.

Architecture & engineering

M365 WATCH is a WPF desktop application (.NET 10) in MVVM, styled with MahApps.Metro and built on a multi-project solution: a core of entities and pure services, an access and orchestration layer over Entity Framework Core, source readers, an Excel export module (ClosedXML), the desktop application and the command-line collector. The visual identity is GUARD's, so the tools delivered to the team form a coherent family.

The heart of it is the SQL Server schema: nine tables and sixteen indexes designed for interval-based history. It is driven by versioned SQL migrations — readable and replayable from the repository, applied to the production database — together with post-deployment verification scripts that check tables, indexes and invariants. Reading the exports relies on an RFC 4180-compliant delimited parser and on streaming ZIP archives, with no extraction to disk.

Delivery is industrialised: two self-contained win-x64 packages — the application and the collector — built by PowerShell scripts, and a tag-driven GitLab CI pipeline chaining tests, packages, package registry and release. 348 automated xUnit tests hold the safety net, including integration tests that really ingest a 44,545-row export against a SQL Server database recreated on every run.

What this project demonstrates

M365 WATCH brings together two kinds of expertise rarely held by the same person: full .NET engineering — architecture, relational modelling, testing, industrialisation — and expertise in the monitored domain itself: Microsoft 365 Apps update channels, Windows builds and servicing, end-of-support calendars, admin-portal telemetry. The six detection rules did not come from a specification: they came from the field.

Above all, it shows the ability to deliver for real: migrations applied to the production database, daily collection running as a service, and the application used every day on the fleet's real data.

Technologies

.NET 10 C# WPF MVVM MahApps.Metro EF Core SQL Server ClosedXML CSV / RFC 4180 PowerShell xUnit GitLab CI/CD Python

M365 WATCH