Endpoint Hardening with Microsoft Intune

A Windows device fleet without centralized management is an operational and compliance risk. Inconsistent configurations, BitLocker not enabled, unpatched software and local access without MFA are concrete vulnerabilities. At Neos Air, the goal was to achieve measurable and maintainable compliance without operational overhead.

Security baseline deployment via Microsoft Intune with Autopilot enrollment for new devices and manual enrollment for existing ones. Configuration of compliance policies, automatic remediation and Entra ID Conditional Access that excludes non-compliant devices from cloud services.

The baseline is based on the CIS Benchmark for Windows 11, adapted to the corporate context:

- Encryption: BitLocker with TPM 2.0, mandatory PIN, recovery keys in Azure Key Vault

- Authentication: Windows Hello for Business, enforced MFA, no local accounts without complex passwords

- Updates: update ring configured with 7-day deadline for critical patches

- Firewall: Windows Firewall enabled and non-modifiable by users, baseline rules applied

- Antivirus: Defender for Endpoint with centralized policy, controlled exclusions

- UAC and privileges: standard user for all, elevation only via separate IT account

Entra ID Conditional Access ensures only compliant devices can access Microsoft 365 services:

- Device must be Intune-managed and compliant

- MFA required for all access from non-corporate networks

- Access blocked from unauthorized countries

- Session token limited to 8h, refresh token to 24h on unmanaged devices

New devices are pre-registered in Autopilot by the vendor. At first boot, the employee authenticates with corporate credentials and Intune automatically configures the device in 20-30 minutes: app installation, security policies, certificates, VPN client. No physical IT intervention required.