Questions owners actually ask.

For this kind of work, no. Microsoft 365 is configured through a browser with an account you create and can switch off, whether your provider is across town or across the world. We work hours that overlap yours, we speak on video, and everything we change is documented. If you need someone physically in the office, that is not us, and we will say so on the first call.

Keep them. Most local IT firms are good at helpdesk and hardware and stretched thin on Microsoft security and Intune. We do that layer, hand them the documentation, and stay out of their way.

Microsoft certified engineers on the EndKeep team, with a named lead engineer for each client. The person on the call is the person in your tenant. There is no separate sales team and no offshore handoff, because we are the team.

Companies of roughly 10 to 100 people on Microsoft 365. Below 10 the fixed prices still work but the Health Check is usually enough. Above 100 we still take the work, and the assessment price is $750 plus $10 per user over 50.

A Health Check usually starts within a week of the call. Assessments and projects are scheduled on the first call, normally within two weeks. Managed Intune starts as soon as access is approved; the baseline takes the first 30 days.

Yes. The $250 and $750 services are fixed for the scope described. Hardening is quoted as a fixed price with a defined end before anything starts. If the scope grows, we quote the extra in writing first; we do not bill hours.

Bank transfer, Wise or Upwork, in US dollars, within 14 days of invoice. One off services are invoiced on completion, projects half on order and half on completion, monthly plans in advance.

No initial term. It is month to month at $6 per enrolled device, minimum $300 a month, and you can stop any month after paying the invoices already approved. Everything we configure belongs to you, so there is nothing to unwind if you leave.

No. Licences stay billed by Microsoft or your existing reseller. We tell you what you are paying for and not using, which often covers our fee, but we do not take a margin on licences.

For an assessment, a read only account (Global Reader plus Security Reader) with MFA, created by you and deleted afterwards. We never ask for Global Admin to look. For hardening or monthly work we agree the access up front, use named accounts with MFA, and log what we do.

Not if it is done in order. Every change goes to report only first, then a pilot group, then everyone, with a break glass account in place that you hold and we do not.

No. We work inside your tenant. The only things that leave it are the reports and configuration exports we produce for you, which are yours.

You keep everything: the report, the configuration, the documentation, the runbooks. Nothing we set up is proprietary to EndKeep and there is no exit fee.

All of it. Managed Intune runs the tenant month to month, and the projects cover enrolment and Autopilot, configuration and compliance, application packaging, updates and patching, endpoint security, and migrations from SCCM or another MDM. The full list is on the Intune page: 43 services in six groups.

Yes. Apple Business Manager and Automated Device Enrolment, FileVault escrow, Platform SSO on macOS, supervised iPhones and iPads, and Android Enterprise for the rest.

Yes. Win32 packaging with silent switches, detection rules that check a real version, requirement and supersedence rules, tested on a clean machine and an upgrade before rollout by ring.

Yes. Co-management with workloads moved in order, then SCCM retired, or a clean cut over where that is simpler. It is one of the six Intune groups we deliver.

Yes. The controls we put in map onto Cyber Essentials in the UK, the ACSC Essential Eight in Australia and the CIS Microsoft 365 benchmark. The assessment report doubles as the evidence pack most questionnaires and insurers ask for.

Usually the report answers every question on the renewal form: MFA, patching, encryption, backups, admin control, email protection. We write it so the answers are easy to lift, and we are happy to talk to the broker.