Endpoint

Endpoint policy and Windows hardening, managed as code

Made endpoint policy, Windows hardening, device provisioning, and fleet-wide patching reviewable and repeatable across the managed device estate.

The problem

The client platform engineering team had inherited years of Intune configuration from engineers who had moved on from the environment. There was no way to audit the current Intune estate, and no single authoritative location for Intune configuration.

How we worked

  1. Assess. We reviewed the inherited Intune estate to establish what was actually deployed. Configuration had accumulated across compliance, device configuration, scripts, and updates with no version history and no authoritative source, so the first task was an accurate picture of the live tenant.

  2. Codify. We imported the existing Intune configuration as-is into Terraform using the Microsoft365 and Microsoft365wp providers, creating a version-controlled representation of the live environment against the device-management surface of the Microsoft Graph beta API. The scope covered:

    • Device compliance policies and compliance scripts
    • Settings Catalog configuration policies, templates, and assignment filters
    • Windows platform and remediation scripts; macOS platform and custom attribute scripts
    • Windows Update rings: driver, feature, and quality update profiles
    • Windows enrollment status page
    • RBAC role definitions and role scope tags
    • Categories and terms and conditions

  3. Operationalize. We worked through each policy and migrated it into an updated, best-practice implementation based on Microsoft guidance. Changes deployed through CI/CD with GitHub Actions, targeting Entra ID user and computer groups, and were reviewed through pull requests against a development Intune tenant before promotion.

  4. Enable. The platform engineering team received the pull-request workflow and documentation for proposing, testing, and promoting Intune changes, so configuration stayed reviewable as the estate continued to evolve.

The outcome

All changes to Intune configuration now move through pull-request review, applied first to a development tenant before promotion. The estate is a version-controlled, best-practice representation of the tenant instead of undocumented portal state, with change history and ownership visible in one place.