Over the last decade I've helped hundreds of companies build and scale on cloud.

But, in 2020, I felt something was missing.

I wanted to share everything I learned in my tech career with you.

So, I created ThoughtfulTechy Cloud.

My mission is to inspire millions of techies to follow their dreams through building a tech career.

I help technologists break into cloud, break free from IT support, and grow in an existing cloud role.

My results:

→ 72K+ people following on LinkedIn
→ 54K+ people following on TikTok
→ 15K+ people subscribed on YouTube
→ 12K+ people read my weekly newsletter
→ 19M+ Impressions (LinkedIn)

If you want to learn more about booking a 1:1:

→ GO HERE: https://topmate.io/thoughtfultechycloud/

If you want to learn more about ThoughtfulTechy Cloud join our community:

→ GO HERE: https://www.youtube.com/@ThoughtfulTechyCloud

Testimonials:

"I would like to thank you for the valuable insights you provide almost every day on your channel. It's really motivating!"

"I just watched one of your YouTube videos and it's what I was looking for. Your thoughts are amazing. l'd love to keep in touch with you and learn more."

"Great video Greg! Awesome way of breaking down the path into achievable goals. Thanks for the content."

Socials:

X: @ThoughtfulTechy
TikTok: @ThoughtfulTechy_Cloud
Instagram: @Thoughtfultechy_Cloud
YouTube: @ThoughtfulTechyCloud

Views are my own and do not reflect my employer

Greg Powell

Today is my last day at AWS


After almost a decade I decided it’s time for a new adventure.

No words can really capture what an incredible journey it has been, from the pace of innovation to the brilliant people I’ve worked alongside. I grew and stretched myself in every dimension of my life.

There are too many people to thank individually but I want to acknowledge everyone that helped me grow along the way, all my colleagues that I helped to mentor throughout the years, and to all my amazing customers that I had the honor of serving.

Thank you all from the bottom of my heart ❤️

Looking back, one of the most powerful takeaways from this experience is the confidence that comes from thriving at AWS for almost a decade. It has shown me I can succeed at whatever I set my mind to, no matter the challenge.

Regarding what’s next, in the near term I’ll be diving into some passion projects, reading, and visiting my Mama.

And I’m taking a close look at what’s next for me professionally. I’m beyond excited about the possibilities!

If you’re working on something interesting or just want to catch up, I’d love to hear from you.

Cheers to new adventures!

Creator, ThoughtfulTechy Cloud | Helping You Easily Navigate Your AWS Cloud & Tech Journey

No alternative text description for this image

Someone needed to say it


Might as well be me.

♻️ Share this with your network

Creator, ThoughtfulTechy Cloud | Helping You Easily Navigate Your 🤖AI ☁️Cloud 👨🏽‍💻Career Journey

In case you haven't realized this yet


Your quest to learn tech will only lead to more unknowns.

Tech is always changing and what you know will have to change too.

♻️ Share this with your network

How could someone with no AWS Certifications land a role as an AWS Solutions Architect? The secret is

-They knew how to build things 
-They had experience breaking things 
-They understood how to troubleshoot things

And they were able to share those experiences clearly in STAR format.

That's how.

undefined undefined

📌Join 20K Navigating Their AI, Cloud & Career Journey:
https://lnkd.in/gVKek9iG

The hardest part of being a Solutions Architect isn't what you think.


It's not the technical depth or the business acumen.

It's staying credible when you're constantly switching between both.

Monday: whiteboarding cloud ROI with the CTO.

Tuesday: optimizing API response times with the dev team.

The SAs who struggle over optimize for one audience and become useless to the other.

They become technical experts who can't talk business.

Or business consultants who can't build anymore.

The best ones don't try to be the smartest person in every room. 

They ask better questions than everyone else.

They know when to zoom out and when to zoom in.

No matter who is in the room.

♻️ Share this with your network

✅ Google Certified Cloud Digital Leader


Up Next: Google Cloud Generative AI Leader

graphical user interface, text, application

✅ NVIDIA Certified Associate AI Infrastructure and Operations

Up Next: NVIDIA Certified Associate
Generative AI LLMs

Repeat after me


“I will NEVER stop learning”

Say it out loud everyday.

♻️ Share this with your network

✅ Google Certified Cloud Generative AI Leader


Up Next: NVIDIA AI Infrastructure and Operations

The idea is simple.


Any specific tool, platform, or skill you learn in tech has a shelf life. 

What felt cutting edge two years ago might be irrelevant now.

The real advantage isn't your current knowledge. 

It's your learning speed. 

For you to be successful longterm your focus shouldn't be on clinging to what you already know. 

Your differentiator is being able to dive into something unfamiliar and get up to speed fast.

Treat learning itself as your main skill because everything else is temporary.

♻️ Share this with your network

If you’re seeing this post it means


It’s your sign to prepare and pass:

NVIDIA-Certified Associate: AI Infrastructure and Operations

Not all will take action, but you will.

Today is my Birthday!!! 🎂


Another year wiser 🤓

I bet you can’t guess what my beautiful wife Leila got me for my birthday gift!

Your Go To Attorney When Family Court and Immigration Intersect.

Stop collecting certifications. Start building systems.


I see this pattern constantly with aspiring Solutions Architects. Talented people investing hundreds of hours into certifications believing they're the golden ticket to landing their dream role.

Then they hit the interview, specifically the system architecture portion and struggle.

Why? Because certifications teach you what exists, not why you'd choose one approach over another. They don't prepare you for the probing questions that reveal whether you truly understand the trade-offs.

The interviewer isn't looking for someone who memorized services. They want someone who can:
🔸 Justify architectural decisions 
🔸 Navigate constraints and trade-offs
🔸 Explain the "why" behind their choices 
🔸 Demonstrate they've built real systems

Certifications have value. They're great for filling knowledge gaps and learning fundamentals. But they're a supplement, not a substitute for hands-on experience.

If you're early in your career this is where you invest your focus and energy: 
🔸 Build projects
🔸 Break things
🔸 Fix them
🔸 Deploy something real

Your resume gets you in the room.  What you've actually built AND your ability to articulate it gets you the offer.

If you’re studying hard and earning certs, that takes real dedication. Be proud of that.

And when you’re ready build something. 

Anything. 

It doesn’t have to be perfect.

That little project might just be the thing that changes everything for you.

First stop following last day at AWS after almost 10 years?

Disneyland!

When you choose to close a chapter this big you must celebrate 🤩

Early in my career I knew I wanted to work in tech. I just didn’t know how to get my foot in the door.

Pursuing and earning my first cert is what built that confidence. 

It gave me something tangible to stand on. 

But the real learning didn’t kick in until I was actually in the thick of it making mistakes and solving real problems along the way.

The cert got me started. 

The tech industry taught me everything else.

I wish somebody had told me this when I first got started


Now you know.

The world is changing


And we need to change with it.

Learn NVIDIA tech ASAP.

After ~10 years of focusing almost exclusively on AWS, I’ve started diving into Google Cloud and I’m kicking it off with the Cloud Digital Leader certification prep.

What I like about this cert is that it’s not just “which service does what.” It’s about how Google Cloud approaches digital transformation, data, AI/ML, security, and cost governance from a business-outcomes perspective. It forces you to think less in terms of instances and clusters and more in terms of value, agility, and impact.

If you’re coming from an AWS background like me, exploring Google Cloud is a great way to stretch your thinking in a new direction, see different design patterns, and expand your knowledge. Cloud careers are only getting more multi-cloud, so it makes sense to lean into it.

📌 Train for FREE:
https://lnkd.in/dD_mGedw

♻️ Share this with your network

Google Cloud - Cloud Digital Leader

I wish I had discovered this sooner.


I'm finalizing prep for the NVIDIA AI Infrastructure & Operations Fundamentals Certification. I'd already taken NVIDIA's training course, which gave me a solid foundation.

But Ashish Prajapati's Udemy course is what's really connecting the dots. I'm about halfway through, and I appreciate the detailed breakdowns of exam concepts and the creative analogies that make it easier to understand, synthesize, and remember key details.

If you're working on this cert I'd recommend adding this course to your overall prep.

☀️ By day, I secure systems. 🌙 By night, I design.

I’m a Cloud & Microsoft 365 Administrator with a strong focus on 🔐 identity, 🛡️ security, 📜 compliance, and ☁️ cloud infrastructure. My day-to-day covers Entra (Azure AD), Intune, Microsoft 365, AWS, Azure, IAM, and PAM — all with one mission: keep businesses secure, compliant, and productive.

💻 I’ve managed 500+ endpoints (Windows, macOS, iOS, Android, cloud VMs) and streamlined onboarding with Intune Autopilot, cutting setup time by ⚡40%. I maintain 100% patch + encryption compliance with Intune, Defender ATP, BitLocker, and firewall baselines.

🔑 On the identity/security side, I work with CyberArk, BeyondTrust, JumpCloud, Okta, and Varonis to enforce privileged access, secure accounts, and run compliance-driven access reviews. I combine that with Cyberhaven (DLP), Microsoft Purview (insider risk/eDiscovery), and Drata (SOC 2 automation) to deliver end-to-end governance that aligns with SOC 2, ISO 27001, and NIST.

🗄️ Beyond users and devices, I’ve handled database commissioning & decommissioning (SQL Server, Azure SQL, MySQL) — cleaning up legacy systems, migrating workloads, and ensuring compliance during transitions. This ties into larger infrastructure projects across Azure VNets, NSGs, VPNs, firewalls, and AWS (EC2, S3, IAM, CloudWatch).

⚙️ My secret sauce? Automation. From PowerShell scripts that sync and patch to Power Automate workflows that keep compliance reporting flowing — I cut down repetitive work and boost accuracy.

🎨 And then, when the day ends, I switch hats — I’m a designer by night. Using Figma, Framer, Shopify, and WordPress, I deliver landing pages, brand identities, and creative assets that make tech look good and easy to understand.

👨🏽‍🏫 On top of all this, I teach. At Conestoga College, I mentor 150+ students annually in Microsoft 365, Azure, IAM, and compliance — with over 80% passing certifications like MS-102, SC-300, and AZ-104 and breaking into IT roles.

🔥 What drives me? Security that empowers. Compliance that scales. IT that works for both people and business.

Michael Shabi

Someone asked me yesterday 

Whether Microsoft 365 security was "good enough" out of the box. 

I told them it depends on what problem they think they're solving.


Default security settings protect against common attacks.

They don't protect against your specific risks. 

Every organization has unique exposure based on industry, 
user behavior, third-party relationships, and data sensitivity.


The mistake is treating Microsoft 365 like a product you buy and deploy. 

It's a platform you configure based on decisions you make about risk tolerance and business requirements. 
Those decisions can't come from a vendor or a framework. They have to come from you.

I've audited tenants where default settings were fine and others where they left massive gaps. 

The difference wasn't Microsoft's security features.

 It was whether leadership 
understood their environment well enough to know what needed to change.

🔐 Cloud Identity and Security Engineer - Azure | AWS | Microsoft 365 | Endpoint | Compliance

I hear "best practices for securing a cloud business" 
in every conversation about Microsoft 365. 

Here's the problem with that phrase. 

Best practices assume your business looks like everyone else's. It doesn't.

A manufacturing company with frontline workers has different security needs than a law firm with remote attorneys. The controls that work for one create friction for the other. 
Copying someone else's security model gets you their problems, not their outcomes.

Securing Microsoft 365 starts with understanding your business model first. 
Who are your users? 
What data do they create? 
Where do they work? 
Who do they collaborate with externally? 

Those answers define what controls actually matter.

I've seen companies deploy zero-trust frameworks 
that break legitimate business workflows 
because nobody asked how the business actually operates. 

Security that ignores business context doesn't protect anything.

It just creates shadow IT.

Data compliance in Microsoft 365 fails 
when it's treated as an IT project instead of a business decision. 

I see this pattern constantly.


IT gets handed a compliance requirement.

 They deploy sensitivity labels, configure policies, and report back that it's done. 

Six months later, an audit reveals that users aren't labeling anything 
because they don't understand what the labels mean or why they matter.

Compliance isn't technical. It's organizational. 
Users need to know what data is sensitive, why it matters, 
and what happens if they handle it wrong. 

Without that context, labels are just dropdown menus that people ignore.

The organizations that do this well treat compliance as a business capability, 
not an IT feature. 

Business units define what's sensitive.

IT provides the tools to enforce it. 

Training explains the why, not just the how. That alignment is what makes compliance stick.

Requirements for cloud tenant management 
always look straightforward until you try to enforce them. 

I worked with a company that documented 47 governance policies for Microsoft 365. 
Three months later, users were still doing whatever they wanted.


The gap wasn't communication. 

Leadership sent emails. 

IT held training sessions. 

The policies were available on the intranet. 
The problem was that the policies conflicted with how people needed to work.

Governance in Microsoft 365 only works if it aligns with actual business workflows. 

When policies block legitimate work, users find workarounds. 

Shadow IT isn't rebellion. It's an adaptation.

The teams that get this right start with business requirements 
and build governance around them. 

They don't write policies in isolation and expect compliance. 
They ask how work actually gets done, then create controls that support it. 

That's the difference between governance that sticks and governance that gets ignored.

A director asked me how to prepare their Microsoft 365 environment for AI models.

I asked what their data classification looked like. 
They said it was "in progress" for the last 18 months in Microsoft 365 isn't a feature problem. 

It's a data governance problem. 

When Copilot or any AI model can access everything a user can access, your oversharing problem becomes an AI exposure problem overnight.

Most organizations have sensitive data scattered across 
thousands of SharePoint sites and Teams with permissions nobody's reviewed in years.

Adding AI to that environment doesn't create the risk. 
It accelerates the discovery of the risk you already have.

The conversation about AI readiness should start with one question:
Do you know what data your users can access today?

 If the answer is no, AI models will just surface that gap faster and at scale.

Every Microsoft 365 security center update brings new recommendations and alerts. 
IT teams feel pressure to act on all of them.

Most of those recommendations don't matter for your environment.

I've seen security teams chase every "medium" severity alert 
while ignoring the fact that they have no visibility into external sharing across 800 Teams.

The security center is a tool, not a strategy.
The recommendations are generic. 

They don't know your business, your user base, or your actual risk tolerance.

Acting on every alert without prioritization is how you burn out your team and still miss what matters.
Senior IT leadership means filtering the signal from the noise.

Some recommendations are critical. 

Many are optional. 

A few are counterproductive for your specific environment. 

Your job is to know which is which and ignore the rest.

Email security settings in Microsoft 365 get more attention than they deserve. 
I see teams spend weeks tuning anti-phishing policies 
while ignoring the fact that their users still click every link they receive.


Technology can't fix behavior. 

Exchange Online Protection and Defender for Office 365 block a lot of threats, 
but determined attackers just shift tactics. 

The real exposure isn't the email gateway. 

It's user judgment under pressure.


I've seen companies with enterprise-level email security lose credentials to phishing attacks t
hat bypassed every control because the email looked legitimate enough and the user was in a hurry.

The answer isn't more email filtering. 

It's accepting that email will always be a risk vector and building your security model around that reality. 

Assume compromise. Limit lateral movement. 
Monitor privileged access. 

Email security is part of the strategy, not the whole strategy.

Microsoft 365 compliance tools are powerful.

 I've also seen them deployed in ways that create more risk than they prevent.


A company enabled retention policies across all SharePoint sites to meet a regulatory requirement. 

Six months later, critical project files were auto-deleted 
because nobody mapped the policy to actual business needs first.


Compliance features in Microsoft 365 are technical controls that enforce decisions. 

If the decisions are wrong, the controls just automate the problem. Retention, eDiscovery, and 
sensitivity labels—all of them require you to understand your data lifecycle before you configure anything.

Most teams skip that step. They turn on features because compliance frameworks say to. 

Then they discover the features don't match how the business actually manages information.

The fix is simple but slow. 
Map your data. 
Understand retention needs by business unit. 

Test policies in limited scope before rolling them out. 

Compliance is operational work, not a deployment checklist.

Multi-tenant environments in Microsoft 365 
are where most governance frameworks fall apart.

 I see this every time a company goes through a merger or acquisition.
Leadership wants seamless collaboration between tenants. IT knows that cross-tenant access creates identity sprawl, unclear data ownership, and compliance gaps that nobody wants to own.

The technical solution exists. Cross-tenant synchronization, B2B collaboration, and shared channels all work. 
The operational problem is harder. 
Who governs shared data? 
Which tenant's policies apply?
Who pays for licensing? 
Who handles security incidents?
Most organizations skip these questions and just enable cross-tenant access. 

Six months later, they have duplicate accounts, conflicting policies, and no clear path to consolidation. 

The technical debt isn't in the technology. 

It's in the decisions nobody forced leadership to make.

The hardest Microsoft 365 conversations I have aren't technical. 

They're about accountability. 

Who owns a decision when SharePoint permissions break business processes? 
Who approves exceptions to security policies? 
Who decides when external sharing is acceptable?
Most organizations never answer these questions. 

They assume IT owns everything, which means IT gets blamed when business users make risky choices IT never knew about.
Governance without accountability is just documentation. 

It doesn't change behavior.
It doesn't prevent incidents. 
It just gives you something to point to after things go wrong.

The organizations that run Microsoft 365 well have clear ownership models. 
Business units own their data and access decisions. 

IT owns the platform and enforces standards. 

When those lines are clear, governance actually works.

When they're not, every incident becomes a political problem.

I get asked about Microsoft 365 security features more than anything else.

The real question people should ask is whether their team
has the capacity to manage what they're about to turn on.

Every security feature you enable adds operational overhead. 

Monitoring, tuning, responding to alerts, handling false positives, documenting exceptions. 

Most IT teams are already stretched thin.

I've seen companies enable advanced threat protection and then ignore 
the alerts because nobody has time to review them. 

That's worse than not having the feature. 

It creates a false sense of security while the actual threats go unnoticed.
The discipline is knowing your team's capacity
 and deploying controls you can actually operate. 

Start small. Prove you can manage it. 

Then expand. 

Security isn't about how many features you've turned on. 

It's about how well you respond to what they tell you.

I'm thinking ....

I'm thinking of running free Microsoft 365 audits starting second week of March.

If you're dealing with governance gaps, security questions, or just need another set of eyes on your tenant, I'm offering a few hours to help. No pitch. No upsell.

I want to connect with more IT leaders and see what problems you're actually dealing with. If I can help fix something in the process, even better.

If you're interested or know someone who could use this, let me know.

External sharing in Microsoft 365 is the governance issue most 
organizations ignore until it becomes a security incident. 

I've audited tenants where 40% of SharePoint sites were shared externally with no expiration, 
no review process, and no documentation.

The technical control exists. 
You can restrict external sharing at the tenant or site level. 
The operational problem is that business users need external collaboration to do their jobs,
 and IT doesn't always know when or why.


Blocking external sharing entirely breaks workflows. 
Allowing it without governance creates exposure. 
The middle ground requires clear policies, regular access reviews,
 and accountability when decisions go wrong.

Most teams avoid this conversation because it's uncomfortable. 
Business units want flexibility. 
IT wants control.

Leadership wants both. 

The only way through is deciding what level of risk is acceptable 
and enforcing it consistently, even when it's inconvenient.

taplio

The Battle

Greg Powell

Michael Shabi

Followers

Posts

Engagements

Likes

Performance ScoreGreg Powell's LinkedIn Performance

Performance ScoreMichael Shabi's LinkedIn Performance

Ready to grow your LinkedIn presence?

taplio

The Battle

Greg Powell

Michael Shabi

Followers

Posts

Engagements

Likes

Performance Score.css-goub6s{font-size:var(--chakra-fontSizes-md);font-weight:500;color:var(--chakra-colors-gray-600);display:block;margin-top:var(--chakra-space-1);}Greg Powell's LinkedIn Performance

Performance ScoreMichael Shabi's LinkedIn Performance

Ready to grow your LinkedIn presence?

Performance ScoreGreg Powell's LinkedIn Performance