Microsoft Intune. Configured beyond the defaults.

Device compliance rules that gate access to corporate resources. We assess whether your policies actually enforce the conditions your security team thinks they do.

Settings catalogs, templates, and custom OMA-URI policies. We audit every profile for conflicts, redundancy, and coverage gaps across your device fleet.

Win32 apps, LOB apps, Microsoft Store, and app protection policies. We evaluate deployment targeting, update rings, and unmanaged app exposure.

Microsoft-recommended security settings for Windows, Edge, and Defender. We check whether baselines are deployed, current, and not overridden by conflicting profiles.

Defender for Endpoint onboarding, ASR rules, firewall policies, and BitLocker encryption. We verify that protection is active — not just configured.

Entra ID Conditional Access policies that enforce device compliance before granting access. We map every policy to identify gaps and over-permissive rules.

Windows Update rings, feature update policies, and driver management. We assess patching cadence, deferral windows, and deadline enforcement.

Enrollment restrictions, device categories, and Autopilot profiles. We evaluate how devices enter your environment and whether rogue enrollments are blocked.

Entra ID integration, role-based access, and admin scope tags. We audit who can manage what — and whether least-privilege is actually enforced.

PowerShell scripts, proactive remediations, and custom detection rules. We review execution scope, error handling, and whether scripts are still relevant.

Built-in reports, custom Log Analytics queries, and alert rules. We assess whether your team actually has visibility into what Intune is doing.

Windows, macOS, iOS, and Android management parity. We identify which platforms are managed, which are partially managed, and which are blind spots.