Three of twelve users had no MFA. Here is how that happens.
A twelve person firm, Business Premium, a sensible owner. Three accounts with no MFA at all. Nobody did anything wrong. Here is the sequence....
Read the note →01 / who we work with
Firms that have Intune, and nobody to run it.
Ten to a hundred people on Microsoft 365, a few hundred devices at most, an IT company that does helpdesk, and an Intune tenant that was set up once and never looked at again. Thousands of devices under management, thousands of hours of Microsoft endpoint work.
Microsoft Intune
Entra ID
Defender for Business
Windows Autopilot
Windows Autopatch
Conditional Access
BitLocker
Apple Business Manager
macOS
iOS and iPadOS
Android Enterprise
Microsoft 365
Exchange Online
SharePoint
Purview
Windows 11
across nine kinds of firm
Law firmsAccountantsFinancial servicesRecruitmentHealthcare practicesArchitects and engineersProfessional servicesSoftware and SaaSManaged service providers
Certified engineers, re-tested when Microsoft renews the certifications
Certified engineers across endpoint security, cybersecurity and AI automation.
The certifications are the floor, not the pitch. The engineer on the call is the engineer in your tenant, and the same baseline we deploy for clients runs in our own tenant. Ask to see it live on the first call.
Endpoint certifiedIntune, Autopilot and Defender for Endpoint
Endpoint security
Intune, Autopilot, compliance, app deployment, Defender for Endpoint and encryption across Windows, Mac, iOS and Android. What this means for you: the platform is run by people examined on it, not learning on your tenant.
Security certifiedMicrosoft 365 security, Entra and compliance
Cybersecurity
Identity, Conditional Access, Defender, Purview, email authentication and the CIS benchmark for Microsoft 365. What this means for you: the security layer and the device layer are handled by the same team.
Automation firstCopilot, Power Automate, Graph and PowerShell
AI automation
Copilot readiness, data access cleaned up before it is switched on, and the repetitive admin work (joiners, leavers, reports, drift checks) automated so it happens every time. What this means for you: fewer hands on your tenant, fewer mistakes.
02 / what we do
Six Intune practices, one accountable engineer.
Hover a practice to preview it, select it to lock it in, or step through with the arrow keys. Every one of the 43 services behind them is on the full Intune set.
01 / Autopilot, ABM and Android
Enrolment and provisioning
Zero touchnew laptops set themselves up, nobody in IT touches them
Built onExplore →
03 / case study · saas · 20 people
intune from nothing
Every device enrolled and encrypted in three weeks
A growing software company on Business Premium with laptops nobody managed and no MFA policy. EndKeep set up Intune enrolment, compliance, Conditional Access and BitLocker from a blank tenant, wrote the joiner and leaver process, and has run it month to month since October 2025.
3 weeksFrom blank tenant to every device enrolled
100%Of laptops encrypted, recovery keys escrowed
12 monthsRun month to month since, no lock in
0Standing Global Admin accounts left behind
04 / what we offer
The service lines
Managed Intune is the product. The Health Check, the Full Assessment and Hardening are how a tenant gets into a state worth managing, and AI Automation takes the repetitive admin work off people. Every one is a fixed price you see before you say yes.
01
Managed Intune
We run your Intune tenant every month: drift review against a documented baseline, app catalogue kept current, update rings and Autopatch, a compliance report, and small changes inside the fee.Best for: firms that have Intune and nobody whose job it is to look after it.
$6 / device / month→02Security Health Check
A quick, honest, read only look at the Microsoft 365 settings that matter most. One page of findings and a call.Best for: owners who suspect something is off and want a straight answer without a project.
$250 · 2 days→03Full Security Assessment
Your whole tenant scored against Microsoft best practice and the CIS benchmark, with a priced roadmap a director can read.Best for: insurance renewals, client questionnaires, or deciding what to fix first.
$750 · 1 week→04Hardening and Build
Intune built or fixed, security controls switched on, in an agreed order with a defined end. Report only first, then pilot, then everyone.Best for: getting to a tenant worth managing, then handing it to Managed Intune.
Fixed quote→05AI Automation
Copilot readiness, then the repetitive admin work automated: joiners and leavers, monthly reports, drift checks, licence cleanup. Built in your tenant with Power Automate, Graph and PowerShell.Best for: firms that want Copilot without oversharing, and admin work that happens the same way every time.
Quote · per workflow→05 / free self check
Ten questions. Two minutes. No email required.
Tick everything you know is true for your business. Be honest, nobody is watching.
0 of 10 in place
Tick what applies and we will tell you where you stand.
Talk it through, freeTick what applies and we will tell you where you stand.
06 / notes from the tenant
The thinking
behind the
practice.
Short notes written by the engineers who see these things every week. One real finding, with a number in it, and how it was fixed.
Six Business Premium licences nobody used, $130 a month, found in ten minutes.
The licence page in the Microsoft 365 admin centre is the most expensive page nobody reads. Six seats assigned to people who left, a shared mailbox...
Read the note →
The leaver who could still read email eight months on.
Disabled in the HR system. Laptop returned. Still signed in on a phone, still receiving every email to a shared mailbox they had been added to....
Read the note →Prefer the full list? Browse the notes →
07 / the people
The team behind the practice.
Microsoft certified engineers in Islamabad, working the hours their clients keep. Nobody is a ticket queue.
Named lead engineerOne engineer owns your tenant and answers your calls
Second engineerKnows your tenant too, covers leave and busy weeks
Peer reviewEvery change to Conditional Access or compliance is checked by a second pair of eyes