// based in dortmund · open to conversations

Tamer Candic.

Building solutions for real-world problems.

I work at the intersection of endpoint security, cloud identity, and the infrastructure that quietly keeps organizations moving. Hybrid is where I'm most at home — half the fleet on-prem, half in the cloud, all of it has to actually work for the people using it.

IntuneDefenderSCCMSASEHybrid CloudEntra ID

See what I'm building→Get in touch

scroll↓

01This is what I'm doing

What I do, day to day: get Windows fleets and identity systems to behave under pressure. Not in lab conditions — in the messy reality of mergers, legacy GPO sprawl, half-finished cloud migrations, and the one critical app nobody documented.

My real interest is the craft of making security usable. Conditional Access that doesn't lock people out of their lives. Intune baselines that hold up to audit and to the actual humans behind the keyboards. Detections that fire on the right thing, at the right time, with the context to act.

Hybrid environments are where it gets interesting — you can't pick a side. Identity has to traverse, policy has to converge, and someone has to understand what breaks when AAD Connect skips a sync at 3am. I like being that someone.

02Things I've built

Things I build because they should exist — and because real-world problems need real-world solutions.

featured · 01

kiosk-xml-generator

active

A browser-based generator for Windows 11 AssignedAccessConfiguration XML — purpose-built for multi-app kiosk devices. Pick your apps, set your profiles, get a deployable XML file. No PowerShell required.

Visual editor for multi-app kiosk profiles — allowed apps, start layout, taskbar config.
Handles Win32, UWP, and Edge kiosk modes in one schema-valid output.
Validates against the current Windows 11 Assigned Access schema before you ship it to Intune.
Runs entirely in the browser — no data leaves your machine.

Windows 11IntuneAssigned AccessKiosk ModeXML

open the tool→

kiosk-profile.xml

1<?xml version="1.0" encoding="utf-8"?>
2<AssignedAccessConfiguration
3  xmlns="http://schemas.microsoft.com/AssignedAccess/2017/config">
4  <Profiles>
5    <Profile Id="{a302d9...}">
6      <AllAppsList>
7        <AllowedApps>
8          <App AppUserModelId=
9            "Microsoft.Edge_8wekyb..."/>
10          <App DesktopAppPath=
11            "C:\Apps\Reception.exe"/>
12        </AllowedApps>
13      </AllAppsList>
14      <!-- + StartLayout, Taskbar -->
15    </Profile>
16  </Profiles>
17</AssignedAccessConfiguration>

03Tools & docs · for everyone

Open tools, scripts, and documentation I've made publicly available. Built to solve real problems. Free to use.

// public · MIT

kiosk-xml-generator

live

Generate Windows 11 multi-app kiosk XML in your browser. Pick the apps, set the profiles, configure the start layout — download a schema-valid AssignedAccessConfiguration file ready to ship through Intune. No PowerShell, no install, no data leaves the page.

Windows 11IntuneAssigned AccessFree · MIT

open the generator→

// in the works

More tools landing here as I build them.

Small, focused utilities for the kind of endpoint and identity work that doesn't have a clean UI yet. Got a problem you keep solving manually? Tell me about it.

If something here resonates — say hi.

hello@tamercandic.com