SAMPLE-INTUNE-01 · FICTIONAL DATE 2026-01-12
Example Workshop Ltd · Intune and Endpoint Management Review
Status: Fictional format sample · Domain label: example.test (reserved fictional domain; no real organisation) · Method: read-only review of supplied evidence; no live access.
Scope
Windows and iOS enrolment, compliance, configuration profiles, update rings and app deployment for one fictional Intune tenant.
Executive summary
Enrolment is organised and Autopilot works as designed, but compliance is weak where it matters: devices without an assigned compliance policy are treated as compliant, two profiles configure the same BitLocker settings differently, and there is no pilot update ring.
Evidence reviewed
| ID | Source | Coverage | Status |
|---|---|---|---|
| E-01 | Compliance policy export | Windows and iOS policies | Provided in full |
| E-02 | Configuration profile and settings catalog export | 48 profiles with assignments | Provided in full |
| E-03 | Update ring export | 3 Windows rings | Provided |
| E-04 | Device list summary | Counts by platform, ownership and compliance state | Provided; summary only |
| E-05 | Autopilot profile screenshot | 1 deployment profile | Provided |
| E-06 | Required app assignment export | Win32 and store apps | Provided |
What was not checked
- Android and macOS (none in scope)
- Individual device logs
- App packaging quality
- Conditional Access policies (reviewed separately)
Findings
Severity: High means fix first; Medium means plan soon; Low means tidy up.
| ID | Severity | Finding | Evidence | Recommended next step |
|---|---|---|---|---|
| F-01 | High | Devices with no compliance policy are marked compliant | E-01, E-04: tenant-wide setting; 37 devices with no assigned policy | Mark devices without a policy as not compliant, after assigning a policy to the 37 devices. |
| F-02 | High | Two profiles set BitLocker options differently for overlapping groups | E-02 | Merge into one policy and assign it once; confirm the result on a test device. |
| F-03 | Medium | No pilot ring: all devices receive quality updates on the same schedule | E-03 | Add a small pilot ring ahead of the broad ring with a short deferral. |
| F-04 | Medium | Personal iOS devices can enrol as corporate-managed devices | E-04 | Restrict enrolment types, and use app protection policies for personal devices. |
| F-05 | Medium | 12 required apps have no detection rule that checks the installed version | E-06 | Add detection rules that check the installed version, and review dependencies and supersedence. |
| F-06 | Low | 214 device records not seen for over 90 days | E-04 | Review and retire stale records on a schedule. |
Fix first
- Change the setting for devices with no compliance policy (after assigning policies) Effort: Low.
- Resolve the duplicate BitLocker profiles Effort: Medium.
- Add a pilot update ring Effort: Low.
- Restrict personal iOS enrolment Effort: Low.
- Improve detection rules for required apps Effort: Medium.
30/60/90-day plan
- First 30 days: Assign a compliance policy to all 37 gaps and switch the default; resolve the BitLocker duplicates.
- By 60 days: Add the pilot ring; restrict personal enrolment; improve app detection rules.
- By 90 days: Retire stale records, then re-export for a follow-up check and document an ownership list for each policy.
Customer decision
- Approval: this sample authorizes no changes; no remediation was performed.
- Limit: findings reflect only the evidence listed above, as supplied at the time.
Limitations
This fictional sample demonstrates format, not a real assessment. It contains no real customer data, gives no security or compliance guarantee, and made no change to any system.