Intune and Autopilot device setup
Company laptops set up the same way, managed from one place.
Configure the agreed enrollment process, policies, applications and update groups. Test them on pilot devices before the wider rollout.
- What you get
- Configured Intune enrollment, device policies, application deployment and update rings, with an administrator runbook.
- How it starts
- A free scope call. The price is fixed in writing before anyone is given access.
- When it is done
- The agreed pilot devices pass compliance, installation and user-task checks; remaining deployment groups and exceptions are recorded for handover.
Illustrative sample · constructed example
Assigned is not the same as installed.
Pilot laptop · application delivery
Selected check
Does the installation detection rule match the installed application?
SAMPLE / PILOT APPLICATION PACKAGE
- 01 · AssignmentPilot device groupAssignment exists
- 02 · InstallationApplication packageInspect install result separately
- 03 · DetectionApplication reported missingHold the next deployment group
- 04 · User taskPilot user launches appTask result still required
The assignment alone cannot release a wider deployment.
| Dependency | What has to be established | Sample review |
|---|---|---|
| Enrollment | Bring the pilot device into the intended management scope. | Pilot enrolled |
| Install and detection | Make the installed application match its detection rule. | Detection failed |
| User task | Launch and use the application in the intended user context. | User test pending |
| Removal and rollout | Test uninstall and review the next deployment group. | Acceptance review required |
Assignment is not evidence of installation; detection is not evidence the user’s task works.
- Evidence
- Constructed record: assignment exists; detection reports the application missing.
- Decision
- Hold wider deployment
- Next action
- Correct the package or detection rule and repeat the pilot test.
Illustrative sample. Application validation does not prove every device policy is compliant.
The related record on the Results page is kept separate from this sample, with its own limits stated beside it.
Inspect the related recordWhy now
The work starts here.
Devices are unmanaged, or set up differently from each other. Some need a controlled move into Intune before the Windows 10 paid update rate rises on October 14, 2026.
Scope at a glance
- Windows-first standard scope
- Cloud-native Entra join
- Client owns fleet-wide coordination
If nobody acts
What waiting costs
A departing employee’s laptop keeps its cached mail and downloaded files until the hardware comes back. The date offboarding was signed off and the date company data actually left their hands are two different dates.
Where a BitLocker recovery key was saved on the machine it protects, a forgotten PIN or a failed update leaves the disk locked. Somebody then hunts for where that key was written down, because no copy was saved into the tenant.
Windows and application updates apply on each machine’s own schedule. A published fix installs whenever that machine next checks, and whenever the user next agrees to restart. Nothing shows centrally which machines are still missing it.
A configuration change decided today has to be made on each machine by hand. A device switched off, away, or sitting in someone’s bag that week keeps the old settings until somebody catches it.
Check your own environment
Sounds like you?
- Nobody can say how many devices reach company data, or which are managed
- A new laptop takes hours of manual setup, differently each time
- Updates happen when users allow them, which is sometimes never
- A departing employee’s device cannot be wiped the day they leave
Save yourself the call
Not for you if
- Devices are already enrolled and you can see which are compliant
- You have a handful of laptops, all set up the same way, and can wipe one if it is lost
- Every machine is being replaced within months, so set the new ones up properly instead
The work
What is different when we hand over
The device fleet is inventoried: what exists, what is enrolled, and what reaches company data unmanaged.
The enrollment path is built so a new device arrives already configured, with Autopilot where the design calls for it.
Compliance and configuration policies, the required application set, and update rings are deployed as one bounded standard.
A pilot ring enrolls first, and the defects that only appear with real users are found and closed there.
The administrator takes over a documented standard with the rollout plan for the remaining fleet.
Acceptance
Checks before handover
Done when pilot devices enroll, receive the expected configuration and applications, report the agreed compliance state, and pass user tests.
Compliance, configuration, and security baseline policies are deployed
BitLocker and recovery-key escrow are configured
Update rings and the standard application set are in place
The pilot group is enrolled and passes the named compliance tests
The administrator has been walked through the handoff documentation
A fair question
The laptops work fine. Why add management software to them?
The day-to-day is not the argument. The argument is the laptop left in a taxi, the new starter who needs to be working by Monday, and the machine nobody can confirm is encrypted. Each one is an afternoon of improvisation today. This makes each one a routine action, and the setup is tested on a pilot group before it reaches everyone.
Price and calendar
Scope, price and project calendar
Engagement price
Price fixed after a short scope call.
The price is agreed in writing before any work starts and before anyone is given access. The call itself costs nothing. What moves the number:
What determines the scope
- Device count and platform mix
- Number of applications in the standard set
- Existing management dependencies to check before a cloud-native deployment; migration from another MDM is quoted separately
- Enrollment complexity and number of Autopilot profiles
Scope & responsibilities
What is and is not included
The exclusions, what we need from you, how change is staged and reversed, and what is handed over at the end.
Exclusions
- Custom application packaging is separately scoped by application, installer, dependencies and acceptance tests
- Individual device repair
- Onsite support
- Broad user training
- Ongoing endpoint management
- SCCM, GPO, or third-party MDM migration is separately scoped after dependency review
What we need from you
- Own fleet-wide user coordination and scheduling
- Provide the standard application list and installers
- Own end-user support and help-desk activity
- Approve the pilot group and change windows
Change and rollback method
- A pilot group is set up before any wider rollout, and each policy is tested there first.
- Policies are staged by assignment group; rollback is unassignment, per policy, within one change window.
- Update rings are configured so the business chooses its exposure to each release, and nothing forces a reboot mid-shift.
What you keep at handover
- A System guide: the configuration as delivered, the checks that were run and the unresolved list
- The device inventory with enrollment and compliance state, before and after
- The agreed policies and device settings, as applied
- Pilot test results, including the user tests
- The rollout runbook for the remaining fleet
Access, acceptance and support arrangements
How you know the work is good
Judge it by what you can inspect.
The method is written down, the sample records open and the demo can be broken on purpose. Read it the way your technical owner would.
- 01How a project runs
A first conversation, free. An agreed scope with a named technical lead in the proposal. The price fixed in writing before we are given access. Checks before handover.
How we work- 02What is checked
Release checks, access test matrices and ownership maps. Constructed inspection records on the service pages show the standard before you buy.
See sample deliverables- 03What you keep
A System guide: what was agreed, what changed, what was tested and what remains open. With it, the scripts and check results behind the work.
Next step
Start with a free scope call.
Tell us what needs to change, what must keep working and the deadline. The call is free, and the price is fixed in writing before anyone is given access.
Price the Intune rolloutOr write to [email protected]