The challenge
- Phishing. Passwords and standard MFA. An MFA code can be stolen on a fake site, and from there an attacker reaches mail and files directly.
- No device management. No view of the company’s devices, third-party apps such as browsers and PDF readers went unpatched, and a lost laptop couldn’t be wiped remotely.
- Data on phones. Mail, Teams and files on personal phones with no data protection.
- Everyone was an admin. Every employee had full local admin rights, so one malicious file got full control.
- Uncontrolled downloads and browsing. Employees could download and install any software, malware included, and browse any site.
- Basic antivirus. It only recognizes known threats.
- External contractors. Each contractor worked on an unmanaged personal computer. The challenge was to give them a secure workspace where sensitive data can’t be copied, downloaded or printed out.
What we did together
1Sign-in that can’t be phished
Passkeys and hardware security keys instead of MFA codes.
The benefit: Even an employee who clicks a fake link doesn’t hand the attacker access.
2Every device centrally managed
All 300 devices are managed in Intune. New laptops ship straight to employees and are ready after sign-in, with Windows Autopilot.
The benefit: A full view of every device, remote wipe for lost laptops, and new machines without an office visit.
3Automatic updates for all software
Windows and apps such as Chrome, Zoom and Adobe update in the background, with Patch My PC.
The benefit: Software holes get closed without employees doing anything.
4No standing admin rights
We removed admin rights from every device with Admin By Request. Employees who need elevation request it for a limited time; each request is reviewed and logged.
The benefit: Malware can’t take over the machine, people keep working, and every elevation is on record.
5Download and browsing control, with Admin By Request Web Access Management
We built a whitelist of approved software. Anything else needs a request from the employee, which is reviewed and approved or denied. The same applies to browsing sensitive websites.
The benefit: Malware doesn’t land on a laptop just because someone clicked “Download”. Employees still get the tools they need, and the company controls and records everything that comes in.
6Company data protected on phones
Outlook, Teams and OneDrive run inside a protected container on phones, without touching personal data.
The benefit: Company data can’t be copied to personal apps, and a lost phone or a leaver gets a selective wipe of company data only.
7Advanced endpoint protection
Defender for Endpoint instead of basic antivirus. It detects suspicious behavior and can automatically isolate a device from the network during an active attack.
The benefit: A ransomware attack is contained early, so it doesn’t spread to other machines.
8Windows 365 for external contractors
All 60 contractors work in an Intune-managed Cloud PC instead of on their own computers. We blocked clipboard, drive, printer and USB redirection between the Cloud PC and the personal device. Company data is reachable only from inside the Cloud PC.
The benefit: Contractors get a full workspace without a company laptop, and sensitive data can’t be copied, downloaded or printed out of the Cloud PC. When the work ends, their Cloud PC is closed.
9Rolled out in waves, with no downtime
Architecture design first, then a pilot with the IT team, then department-by-department deployment with short guides and close support.
The benefit: Every change was tested before it reached everyone, and employees never felt a stoppage.
What changed
Want to close these gaps in your organization? Start with a technical intro meeting.
Book a meeting