Typical scope
MFA for everyone and Conditional Access that blocks legacy sign in. Intune enrolment, compliance policies and security baselines. BitLocker with recovery keys escrowed and verified. Windows Autopilot so a new laptop sets itself up. Defender for Business onboarded and tuned. Joiner and leaver runbooks your team owns. Email protection tightened. Documentation and a handover session.
What it costs
Most 10 to 50 person firms land between $2,500 and $6,000 depending on how many devices and how much is already in place. The quote is fixed once agreed. A break glass account is in place before anything is enforced.
What it is not
Printers, networks, migrations or on site visits. Keep your local IT company for those. We hand them the documentation and stay out of their way.