CET moves to cloud-only management, with no local domain

The challenge

• Two device-management tools. Devices were managed in both SCCM and Intune, which doubled the team’s work.
• Outdated policy. Old GPOs had piled up, and some of them weakened security.
• Password-only sign-in. For users and admins alike.
• On-premises dependency. Domain controllers that limited flexibility and needed upkeep.

What we did together

1. 1Devices: fully on Intune and Autopilot

   All device management moved to Intune, and SCCM was retired. New computers enroll through Windows Autopilot.

   The benefit: One platform instead of two. The IT team manages all 800 devices from one place. A new computer reaches the employee and sets itself up with the organization’s settings, policies and apps, without IT having to touch it.

2. 2Hardening: old policy out, one standard in

   We cleaned up the old GPOs, applied Microsoft security baselines for Windows, Defender for Endpoint and Edge, and turned on BitLocker encryption.

   The benefit: Instead of settings that built up over years, with nobody sure why they were there, every device follows Microsoft’s recommendations. If a laptop is lost, its data is encrypted.

3. 3Access: only a compliant device and a verified user get in

   We set up device compliance policies and Conditional Access with MFA, compliant-device requirements and session controls.

   The benefit: A leaked password is no longer enough to sign in. A device that doesn’t meet the security requirements can’t reach company data.

4. 4Sign-in: fewer passwords, fewer helpdesk calls

   We enabled self-service password reset, Windows Hello for Business with a PIN, phishing-resistant MFA for admins, and passwordless sign-in for new employees.

   The benefit: Employees who forget a password reset it themselves, without calling IT. The PIN only works on the employee’s own computer, so a stolen PIN is useless anywhere else. Admin accounts, the first target of any attacker, are protected against phishing too.

5. 5Admins: fewer of them, and a defined emergency path

   Global Admins were cut to 2, and we set up break-glass emergency accounts.

   The benefit: Fewer accounts with full rights means fewer openings for an attacker. And if something goes wrong, the organization can’t lock itself out.

6. 6Apps: automatic updates

   We set up automatic application updates.

   The benefit: Security holes in software get closed without anyone chasing every computer.

7. 7Infrastructure: no on-premises servers

   At the end of the project we retired the domain controllers, and CET now runs cloud-only.

   The benefit: No more servers to maintain, back up and patch. People work from anywhere with the same level of security, and the environment grows with the organization without buying hardware.

What changed