Skip to content

Endpoint Security & MDM

Every device compliant with Intune from first start, with a report to prove it.

Only encrypted, current and monitored devices reach your company data, and you can prove it at any time. We set up Intune, Windows Autopilot, Defender for Endpoint and app protection for personal smartphones.

Book an introductory call How it works

Example of device evidence from Intune: BitLocker encryption on, updates current, Defender for Endpoint active, compliance policy met. The device is checked continuously; only compliant devices reach company data.

For
Companies with 50 or more employees and company devices
Scope
Intune, Windows Autopilot, Defender for Endpoint, app protection
Duration
4 to 8 months with a pilot group
Result
Device inventory, compliance and encryption report
Price
from €11,900 excl. VAT, fixed price after the baseline review

Sound familiar?

No complete device list

Laptops are set up by hand, personal smartphones have company email.

Auditors or insurers are asking

You need to prove every device is encrypted, up to date and protected.

Licences paid for, but not used

Business Premium or E5 include Intune and Defender, but little is set up.

Lifecycle

How does a device become verifiably secure?

Every company device runs through the same chain, from first start to the report for auditors. An example, step by step.

Step 1 / 5

Conditional Access

Which devices reach your company data?

Without checks, a valid password is enough. With Conditional Access, the condition of the device decides at every sign-in.

  • Personal smartphones only through protected work apps
  • Policies start in report-only mode, so nobody is locked out by mistake
Choose a state

No check Conditional Access

  • Company laptop

    Set up by hand, condition unknown Compliant: encrypted, up to date

    Access Access

  • Laptop without updates

    Updates overdue for a long time Non-compliant until updates run

    Access Blocked

  • Personal PC

    Unmanaged Not enrolled

    Access Blocked

  • Personal smartphone

    Work email in a personal app Work apps with app protection only

    Access Access

Company data

Every device with a valid password reaches email, Teams and SharePoint. Only compliant devices and protected work apps reach email, Teams and SharePoint.

Four example devices without and with Conditional Access. Without checks, all four reach company data, including the laptop without updates, the personal PC and work email in a personal app. With Conditional Access, only the compliant company laptop and the personal smartphone through protected work apps reach the data; the laptop without updates and the personal PC are blocked.

What do we set up?

Windows Autopilot

Policies, apps and encryption from first start.

Compliance and Conditional Access

Only encrypted, up-to-date devices reach your data.

Defender for Endpoint

EDR, attack surface reduction rules, vulnerability view and tamper protection.

Mobile devices

App protection for personal phones, full management for company devices.

Encryption and sign-in

BitLocker, Windows Hello for Business and Windows LAPS.

Updates

Update rings and, where licensed, Windows Autopatch.

How does the rollout work?

  1. 2 to 4 weeks

    Inventory

    Capture devices, licences and gaps, with a prioritised plan.

  2. 4 to 8 months incl. pilot

    Intune rollout

    Autopilot, compliance and app protection; Conditional Access in report-only mode first.

  3. 2 to 3 months, partly in parallel

    Defender activation

    Defender on every device, ASR rules in audit mode first, then block mode.

  4. Your choice

    Handover or operation

    Documentation and runbooks for your team, or operation through managed security.

How many of your devices are verifiably protected?

In 30 minutes we clarify devices, licences and the sensible starting point.

Book an introductory call

What changes?

Today

  • Devices set up by hand
  • No complete device list
  • Encryption cannot be proven
  • Company data in personal apps

After the rollout

  • Compliant from first start
  • Complete inventory from Intune
  • Encryption report per device
  • Company data only in protected apps

Frequently asked questions

Do I need Intune if we already have Microsoft 365 Business Premium?

Business Premium includes Intune Plan 1, but not its configuration. Without enrolment, compliance policies and Conditional Access it protects no device. Above 300 users, E3 or E5 usually apply.

What is the difference between MDM and MAM?

MDM manages the whole device, up to a full wipe, and suits company-owned devices. MAM protects only work apps such as Outlook and Teams; personal content stays invisible.

How do I prove to an auditor that every device is encrypted?

With the encryption report in Intune, which shows the BitLocker status of every device, together with the device inventory. A compliance policy blocks unencrypted devices.

What does Defender for Endpoint do differently from a traditional antivirus?

An antivirus compares files against known patterns. Defender for Endpoint also assesses behaviour, records activity and can isolate a device.

Which devices reach your data today?

Book an introductory call