Microsoft Intune and Conditional Access: a device-compliance rollout for a 300‑person firm, with Autopilot, Apple Business Manager and a phased cutover
A professional services firm with about 300 staff, a mixed fleet of Windows laptops and Macs, and Microsoft 365 as its main workspace.
- Scale
- About 300 users, Windows and macOS laptops, 1 Microsoft 365 tenant, 4 rollout waves
- Engagement
- 12 weeks, in four waves, with a report-only period before any block
The challenge
Staff signed in to Microsoft 365 from any laptop, managed or not. Devices were set up by hand, patching depended on the user, and nobody could say how many laptops had disk encryption or a current operating system. The firm's insurer and two large customers had begun asking for proof that only managed, healthy devices reach company data.
A professional services firm with about 300 staff let people sign in to Microsoft 365 from any laptop. The client is not named on this page, and this is an illustrative engagement that describes the kind of work our team does; details are composite. The firm's insurer and two large customers had started asking whether only managed, healthy devices could reach company data, and the honest answer was that nobody knew how many laptops were encrypted or up to date.
Our team began with the devices. For Windows, we set up Windows Autopilot so a new or reset laptop configures itself at the employee's first sign-in, with no one at the help desk imaging it by hand. For Macs, we linked Apple Business Manager to Intune, so each Mac enrolls at setup and receives the same baseline. Both paths ended at the same place: a device that is enrolled, named, encrypted and reporting its health.
Next came compliance policies, one set per platform. A device counts as compliant when disk encryption is on, the operating system version is supported, a screen lock is set, the firewall is on and endpoint protection is running. We kept the list short on purpose, because every rule is a reason a person can be locked out, and each one had to match something the firm could explain to its insurer.
Conditional Access turned those policies into a gate. A sign-in to Microsoft 365 from a device that is not compliant is blocked or sent to enrollment. We ran every policy in report-only mode first, read the results with the firm's IT lead and fixed the cases it would have broken: shared devices, a legacy scanner account and a few contractors. Rollout then went in four waves, from the IT team to a pilot group, to departments, to partners and executives, with a help-desk runbook ready before each wave.
Exceptions were written down, each with an owner and an end date. After the last wave, the firm could show the policy, the device list and the compliance rate on request. This is the work our team does under managed IT services and cybersecurity, and it builds on the Microsoft Entra ID and Active Directory work in our Microsoft service line. It is a modeled outcome, not a guarantee or a compliance certification.
What our team delivered
- Windows Autopilot for new and reset Windows laptops, so a device ships from the reseller to the employee and configures itself at first sign-in
- Apple Business Manager linked to Intune, so Macs enroll automatically at setup and receive the same baseline
- Compliance policies per platform: disk encryption, a supported operating system version, a screen lock, the built-in firewall and endpoint protection running
- Conditional Access policies that require a compliant device for Microsoft 365 apps, tested in report-only mode first
- Four rollout waves, starting with the IT team and a pilot group, then departments, then partners and executives
- A written exception path for shared and legacy devices, with an owner and an end date for each exception
- A help-desk runbook and a short guide for staff, so a blocked sign-in has a clear next step
Result
In this modeled engagement, every laptop that reaches company data is enrolled, encrypted and reports its health, and the firm can show the policy and the device list to its insurer and customers on request. Blocked sign-ins were the main cost of the change, and the report-only period kept them low. This is an illustrative engagement and a modeled outcome, not a guarantee or a compliance certification.
Get this for your company
Related services with fixed prices and a written scope.
Managed IT and security (MSP)
One monthly price per team member: help desk, device management, patching, backup monitoring and security basics.
Onboarding starts within 10 business days
$100 per team member, per month
Emergency package: security engineer in 1 hour
Is your company in a cybersecurity crisis? Purchase this package and a security engineer will call you within 1 hour.
Callback within 1 hour, 24 hours a day, 365 days a year
$1,950 per incident
Initial assessment of public endpoints
What an attacker can see and reach from the internet: your domains, mail, websites, remote access and cloud exposure.
Report within 5 business days of kickoff
$1,000 per assessment
Show 3 more
Managed security monitoring
Endpoint detection and response watched by our analysts, priced per device.
Agents deployed within 7 business days
$18 per endpoint, per month
Active Directory health check
Find the misconfigurations that let an attacker go from one stolen password to full control of your domain.
Report within 5 business days
$1,800 per domain
Microsoft Exchange emergency recovery
Mail is down or an Exchange server is compromised. We stabilize, restore and secure it.
Engineer engaged within 2 hours
$2,900 per incident
After you purchase, we contact you within 1 hour, any time of day or night, to start onboarding.
No payment is taken online. When we call you within the hour we confirm the scope and send an invoice (ACH, card or crypto).
Access to one app, not to the network
Zero trust network access replaces the all-or-nothing VPN. The identity provider proves who you are, the device agent proves the laptop is healthy, the policy engine decides, and the enforcement point opens a tunnel to that single application and nothing else.
Every sign-in, verified
Staff sign in once, but behind the scenes the device, the identity, a phone approval and your access policy are all checked before any app opens, and strangers are turned away.
Five million events, three escalations
What a managed SOC does to a day of log volume for a 250‑seat organisation. Collection produces millions of events; correlation rules turn them into a thousand or so alerts; triage merges and dismisses most of those into dozens of incidents; only a few need a human on the customer side. Bar length is the logarithm of the count, so each step is orders of magnitude. Illustrative figures.
Facing something similar?
Tell us about your environment. We will tell you plainly what we would do and what it would take.