A mixed device fleet needed consistent protection. I designed and rolled out Defender for Endpoint with Intune-driven compliance.
Context
The manufacturer ran a mix of corporate and shop-floor devices with inconsistent protection and limited visibility.
Challenge
Endpoints were managed unevenly, baselines varied, and there was little central visibility into endpoint risk.
Scope
- Design endpoint security baselines
- Roll out Defender for Endpoint
- Integrate Intune compliance
- Centralize endpoint visibility
Constraints
- Operational technology constraints on the shop floor
- Devices that could not tolerate disruptive changes
- A geographically spread fleet
Approach
- 01Defined baselines that fit both corporate and operational devices
- 02Rolled out Defender for Endpoint in controlled waves
- 03Used Intune to enforce compliance and remediate drift
- 04Centralized signals into one view of risk
Technologies
Defender for EndpointIntuneDefender XDR
Defender for Endpoint
IntuneOutcome
- Less endpoint noise and stronger centralized visibility
- Improved response readiness across the fleet
- Standardized endpoint baselines across regions
Lessons
Endpoint rollouts live or die on respecting operational reality. Baselines have to fit the devices, not the reverse.
What made it complex
Securing operational devices that could not absorb the disruption a standard rollout assumes.
Azure Landing Zones
Entra ID
Azure Policy
Microsoft Sentinel
KQL
Conditional Access