When you need it
Your Microsoft 365 tenant grew with the company. Some users still sign in without MFA, legacy protocols are still open and several people are permanent Global Administrators. Nobody can say for sure whether every laptop is encrypted, patched and covered by endpoint protection, new laptops are still set up by hand, and phones reach company email with no controls at all.
What sets the quote
- One Microsoft 365 tenant, sized from counts you read in the Microsoft Entra and Intune admin centers: users, admins, devices per platform, enterprise applications and guests.
- Identity controls alone take 1–2 weeks for up to 500 users, 15 admins and 50 enterprise applications.
- Identity and endpoints together take 2–3 weeks and add up to 500 Windows and macOS devices already enrolled in Intune.
- Device management adds 1–3 weeks: devices not yet in Intune enrolled automatically, iPhone, iPad and Android phones, and app protection for personal phones, for up to 500 devices and 25 apps.
- More users or tenants, devices co-managed with Configuration Manager, or devices moving from another device management tool such as Jamf or Workspace ONE are quoted after sizing.
What changes
- Every sign-in passes Conditional Access, legacy authentication is blocked and admins sign in with phishing-resistant MFA.
- Nobody holds standing admin rights. Roles are activated just in time through PIM, and tested break-glass accounts give you a way back in.
- Only compliant, encrypted Windows and macOS devices reach company data, and each of them reports to Defender for Endpoint.
- Apps reach company data only through consent rules you approve, and guests only through access settings you choose.
- New laptops and phones set themselves up when the user signs in. On personal phones, work data stays in protected apps that can be wiped without touching anything personal.
What you get
- Conditional Access policies, run in report-only mode first and then enforced in stages
- Phishing-resistant MFA for admins (passkeys, FIDO2 security keys or Windows Hello for Business), MFA for every user and legacy authentication blocked
- PIM for admin roles with approvals and time limits, a least-privilege role model and two break-glass accounts with sign-in alerts
- User consent settings, an admin consent workflow, guest access settings and a review of the permissions your apps already hold
- Endpoint security: Intune security baselines and compliance policies linked to Conditional Access, Defender for Endpoint with attack surface reduction rules moved from audit to block, BitLocker and FileVault with escrowed recovery keys, Windows LAPS and update rings
- Device management: automatic enrolment with Windows Autopilot, Apple Automated Device Enrollment through Apple Business Manager and Android Enterprise, Wi-Fi, email and app settings, apps through the Company Portal, and iOS and Android update policies
- App protection policies (MAM) for Outlook, Teams and the Microsoft 365 apps on personal phones, with a one-page notice for employees on what the company can and cannot see
- A settings workbook with the reason and rollback step for each policy, device runbooks (new joiner, leaver, lost device, and the yearly Apple certificate and token renewals), and a 90-minute handover with your admins
What we cover on each platform
| Area | Windows | macOS | iPhone and iPad | Android |
|---|---|---|---|---|
| Enrolment | Windows Autopilot | Apple Automated Device Enrollment | Apple Automated Device Enrollment for company devices; app protection for personal devices | Android Enterprise, fully managed for company phones; app protection or a work profile for personal phones |
| Security settings | Intune security baselines for Windows, Defender for Endpoint and Microsoft Edge; Windows LAPS with passwords backed up to Entra ID | Intune endpoint security and settings catalog profiles for the firewall, Gatekeeper and screen lock | Passcode, restrictions and managed app settings | Passcode, restrictions and managed app settings |
| Compliance | Compliance policies linked to Conditional Access | Compliance policies linked to Conditional Access | Compliance policies linked to Conditional Access | Compliance policies linked to Conditional Access |
| Disk encryption | BitLocker, recovery keys stored in Entra ID | FileVault, recovery keys escrowed in Intune | Built in, enforced with the passcode | Built in, checked by compliance |
| Threat protection | Defender for Endpoint (or Defender for Business) onboarding; attack surface reduction rules, audit first, then block | Defender for Endpoint on Mac onboarding | — | — |
| Updates | Update rings and feature update policies | Software update policies | Software update policies | System update policy on company phones |
On Google Workspace, the Google Workspace security baseline covers the same ground with Google endpoint management.
Not included
- Device purchasing, imaging and on-site support
- Wi-Fi and VPN certificates (see private PKI and certificate automation)
- Email filtering (Exchange Online Protection, Defender for Office 365) and Purview data protection
- Watching and responding to Defender alerts; we do not offer 24/7 security monitoring
- Microsoft licences. The design states which licence each control needs, such as Entra ID P2 for PIM.
What we need from you
- Entra Global Reader for the review. For the rollout: time-limited admin roles such as Conditional Access Administrator, Authentication Policy Administrator, Privileged Role Administrator, Security Administrator and Intune Administrator, through PIM where you have it.
- A named IT owner who approves each rollout stage, about 2 hours a week.
- Pilot users with Windows and macOS devices, and their phones, from each main team.
- For device management: an Apple Business Manager account, which needs your company's D-U-N-S number (we guide you through it), and your device reseller's ID for automatic enrolment.
How it works
Free 30-minute call, then the counts that size the work and a written fixed quote.
Review of the tenant, licences, sign-in logs and device state, then target policies, exclusions and rollout groups agreed with your team.
Conditional Access in report-only mode and attack surface reduction rules in audit mode, then enforcement for a pilot group and in stages.
Devices not yet in Intune move over in waves, starting with the IT team's devices.
Handover of the settings workbook, the break-glass procedure and PIM in a 90-minute session with your admins.
At a glance
- Duration
- 1–6 weeks
- Price
- Fixed quote after a free 30-minute call
- Delivered by
- Our lead architect
Related services
PKI review
A one-week review of your PKI and certificates, covering the CA hierarchy, certificate inventory, TLS settings and revocation, rated red, amber or green, with an expiry risk list and a roadmap.
Domain and external attack surface check
A one-week, non-intrusive check of your domains, DNS, email authentication and internet-facing endpoints, with every finding tied to evidence and a fix. It is not a penetration test.
Google Workspace security baseline
2-Step Verification with security keys for admins, separate super admin accounts, control over third-party apps, safe Gmail and Drive defaults, and Google endpoint management for phones and computers, in 1–5 weeks.