Skip to content

Intune and Autopilot clean-up: laptops set up and kept in line

Make device enrolment, compliance, baselines and exceptions match the estate you actually operate. £2,000 to £4,500; usually 5 to 10 working days.

What the work covers

  • Where endpoint control drifts

    Devices may appear enrolled while join state, compliance, baseline assignment, local admin and exception groups tell a different story. Inventory comes before stronger enforcement.

  • Scope, output and handover

    Review join state, Autopilot profiles, enrolment, compliance, baselines, app deployment, local admin and exceptions. Output: conflict map, pilot groups, rollout order and support notes.

The device lifecycle, end to end

What managed devices changed in-house

Sequencing Intune compliance so the helpdesk could support it took the estate from 72% to 96% compliant.

What changed when I ran IT in-house
Intune device compliance
  • Before72%
  • After96%
From my in-house IT roles before Magrathean, where I also took the organisation through Cyber Essentials Plus first time. More about my background.

Malware still reaches devices

Larger estates report malware on devices more often, and it is the third most common attack overall.

7%of UK businesses had devices targeted by malware in the last 12 months
Malware on devices, by size
  • 7%All businesses
  • 12%Medium
  • 23%Large
Source: Cyber Security Breaches Survey 2025/2026 (opens in a new tab), DSIT and Home Office, April 2026. UK businesses.

Small firms are moving to company devices

More micro businesses now allow access only from company-owned devices, which is what Intune compliance enforces.

Micro businesses, 2024/25 and 2025/26
Two-factor authentication
  • 2024/2535%
  • 2025/2643%
Company-owned devices only
  • 2024/2558%
  • 2025/2664%
External cyber security provider
  • 2024/2539%
  • 2025/2644%
Source: Cyber Security Breaches Survey 2025/2026 (opens in a new tab), DSIT and Home Office, April 2026. UK businesses.

The handover

The work ends with written outputs you keep.

Not ready to book?

Try the free Microsoft 365 self-check first. It starts with 12 questions.

Run the Microsoft 365 security self-assessment

Questions teams ask before the work

Can you fix an existing Intune setup rather than rebuild?

Yes. Most drift is fixable without a full rebuild.

What does the clean-up plan cost and take?

The Intune and Autopilot clean-up is £2,000 to £4,500 and usually takes 5 to 10 working days, depending on device and policy complexity. Defender for Endpoint work can be added to the same plan or scoped on its own.

Related work

Ready when you are.

Scope the endpoint plan