An industrial organization moves device control to Microsoft Defender, without losing a single block

The challenge

• Moving off another EDR. The organization replaced a third-party EDR with Defender for Endpoint and needed to keep control over removable drives, USB devices and phones.
• Complex policies. In Intune, allowing a device only exists as an exception inside a block policy. A wrong assignment raises no alert; nothing gets deployed.
• No view of enforcement. There was no way to tell whether a policy had actually landed on a computer, or had only been sent.

What we did together

An OnCloud cloud architect built a dedicated management interface on top of Intune and Defender and worked with the organization’s IT team in short rounds: each of their requests became a new version within days.

1. 1One interface for rules

   Build a "block" or "allow" rule in a few clicks, and the interface generates the Intune policies.

   The benefit: The IT team doesn’t need to master Device Control policy logic.

2. 2What each computer really enforces

   An enforcement view that reads what actually changed on each computer, not what Intune reports it sent.

   The benefit: Computers that are in a rule’s scope but not enforcing it show up right away.

3. 3A scan before rollout

   The scan found that the Security Baseline already blocked one class of storage devices on every computer, and that the first new rule would have silently overwritten that block. The existing block was folded into the new rules.

   The benefit: Not one existing block was lost in the move.

4. 4Rules that deploy nothing are flagged

   An allow rule that creates nothing in Intune is flagged immediately.

   The benefit: A device never shows as approved while nothing actually happened.

5. 5Locked to a user and a computer

   An approved device can be limited to a specific user on a specific computer, at the same time.

   The benefit: An approved drive works only for the employee who needs it, and only on their computer.

6. 6Where every decision came from

   Every blocked device links to the rule that blocked it, and every approved device to the rule that approved it.

   The benefit: When an employee asks "why was I blocked?", there’s a quick answer.

7. 7The interface is protected too

   Access is allowed only from the organization’s addresses, on top of Conditional Access. Every new version is tested first in a read-only environment, on the real data.

   The benefit: The tool that manages the blocks doesn’t become a weak spot, and changes are tested without risk.

What changed