Intune and endpoint management
reviewed against how you work.
We review how your devices are enrolled, configured, updated and tied to sign-in rules in Microsoft Intune, using exports you choose to share, and give you a written report of what is working, what conflicts and what to fix first.
Who it is for
Organisations that use Intune for Windows, macOS, iOS or Android devices and want an independent check of enrolment, policy sprawl, patching and app deployment, for example after growth, a tenant merge or a move from on-premises device management.
What we review
- Enrolment restrictions. which device platforms, versions, manufacturers and ownership types can enrol, and any per-user device limits. Microsoft notes that enrolment restrictions are not security features, so the report treats them as a first filter only.
- Windows Autopilot. deployment profiles and their deployment mode, how devices are grouped for profile assignment, and the Enrollment Status Page, as configured.
- Compliance policies. the settings checked per platform, the actions taken for non-compliance, and how devices with no compliance policy assigned are treated (Intune documents a tenant setting for this; its default is Compliant).
- Configuration profiles and endpoint security policies. overlap and conflict between profiles, settings catalog policies and security baselines, and coverage of disk encryption, firewall and antivirus settings.
- Update rings and feature updates. Windows Update ring design, deferral periods, deadlines, whether a pilot ring exists and how feature updates are controlled.
- App deployment. required versus available assignments, Win32 detection rules, dependencies and supersedence, and failed install patterns in the data you share.
- Link to Conditional Access. whether a Conditional Access policy requires a compliant device, how that policy treats devices with no compliance policy, and that emergency access accounts are excluded as Microsoft advises, so you cannot lock yourself out.
- BYOD and mobile app protection. app protection policies for personal devices, what they cover, and how data is separated from personal use.
- Assignment design and device hygiene. group and filter design, stale or duplicate device records and ownership of each assignment.
- Administration. role-based access control, scope tags and who can change policy.
What you get
A written report, delivered through the channel agreed in the quote. It contains:
- An executive summary in plain language
- A matrix of platforms against enrolment, compliance, configuration, updates and apps
- Findings with severity and the evidence behind each one
- A fix-first list with effort for each item
- A 30/60/90-day plan
- A list of what was not checked and why
See the format in the fictional report sample (sample, fictional data).
What we need from you
- A named contact with authority over Intune
- Exports or screenshots of the policies, profiles, assignments and device lists named in the scope, shared through an agreed channel
- Your device platform mix and whether personal devices are in use
How it works
- Send an enquiry. Tell us the question. Keep credentials and customer data out of it.
- Agree the written scope. We propose scope, fee and timing in writing. Nothing starts until both sides accept it.
- We review what you choose to share. We read only the exports and screenshots in the agreed scope. We do not sign in to your Intune tenant or touch any device.
- You get a written report. It says what was checked, what was not, and suggested next steps.
- Any change is approved separately. A report does not authorize changes; anything that changes needs its own written approval.
See what the report looks like: Read a fictional report sample (sample, fictional data). How we handle your information: Trust and data handling.
What we need from you. A named contact with authority, and a small set of evidence you choose to share through a channel we agree in writing first. Please do not send credentials, access tokens or customer exports through the enquiry form.
What we do not do. We do not sign in to Intune, enrol or wipe devices, push policies or apps, or test on live devices. We give no security guarantee.
What needs separate approval. Any change to policies, profiles, rings or apps, any pilot on live devices, and any follow-up check after changes.
Questions before an enquiry
Do you need access to Intune?
No. Your administrator shares exports or screenshots named in the scope, and we review those.
Will you change policies or push updates?
No. The review recommends changes. Applying them, testing on a pilot group and rolling back are yours to approve, or a separate written scope.
Does it cover Mac, iOS and Android as well as Windows?
Yes, for the platforms and policies you include in the scope. The report states which platforms were not covered.
Why link this to Conditional Access?
A Conditional Access rule that requires a compliant device depends on how compliance is evaluated, including what happens to devices with no compliance policy. The review checks that join. Check current Microsoft documentation, as Intune and Conditional Access settings change.
Is Intune included in our Microsoft 365 licence?
It depends on the plan. The report notes which features your current licences cover; check current Microsoft licensing documentation.
Free tools, reading and vendor documentation
- Conditional Access policy reviewer (free)
- Overview of Windows Autopilot
- Troubleshoot Microsoft Entra join failures
- On-premises AD, hybrid join and Entra join: key differences
Microsoft documentation (opens in a new tab). Product behaviour and licensing change, so check current Microsoft documentation before acting:
Ready to start?
Tell us what you need. We reply to confirm fit and to propose scope, fee and timing in writing.