Intune device management, designed and run properly

What we build

• Enrolment of every company laptop and computer, with new Windows devices arriving through Windows Autopilot.
• Configuration profiles built from small, single-purpose policies: endpoint security policies for encryption, antivirus, firewall and attack surface reduction, the settings catalog for the rest. Each one is named, described and piloted. Our configuration profiles guide explains the approach.
• BitLocker encryption applied silently, with recovery keys held centrally, so a lost laptop is a hardware cost.
• Windows LAPS, so every device's local administrator password is unique, rotated and backed up to Entra ID.
• Compliance policies that check the result: encryption on, firewall on, antivirus current, Windows patched. See our compliance policies guide.
• Windows updates in rings, with deadlines and a pause when something goes wrong. That is its own service: Windows update management.
• Remote wipe and retire when a device is lost, stolen or handed back.

How a rollout runs

1. A read-only look at what exists: devices, policies already assigned, conflicts, old Group Policy.
2. The device baseline built and assigned to a pilot group of a few people who cover your key applications and laptop models.
3. Fixes from the pilot, then enrolment in stages, one team at a time, with a one-page note for staff.
4. Compliance reports watched until they are clean, and only then device-based access switched on through Conditional Access.

Security on every managed device

Every managed device runs Microsoft Defender for Endpoint P2, watched by our 24/7 cybersecurity remediation SOC (see managed detection and response). Attack surface reduction rules are part of the device baseline, so the common malware tricks are blocked. App Control for Business, which lets only trusted code run, is a longer piece of work: we audit what your devices run, formulate a policy and work towards enforcing it over time.

What you can see

Your custom client portal is open 24/7. It shows your asset register, security scores, active user count and licence assignments, so the information is there whenever you need it. Every change we make goes into the configuration record you keep if you ever leave.