Device baseline and Windows 11 move
Laptops enrolled, patched and encrypted.
Year 1 of Windows 10 Extended Security Updates ended on 13 October 2026. I set up Intune once for the whole fleet: enrolment, compliance, update rings and Microsoft Defender, with a plan for the last Windows 10 laptops and a lifecycle you can run yourself.
- BitLocker disk encryption
- Secure Boot
- Code integrity
- TPM
- Firewall
- Defender real-time protection
- Minimum OS build (Windows 10 22H2)
- Password length
- Lock after inactivity, minutes
- Device threat level allowed
- For
- An office or IT lead whose tenant has up to 100 devices, with Windows 10 laptops still on Extended Security Updates, or laptops nobody manages.
- Size
- One tenant, up to 100 devices, Windows and Mac.
- Who does it
- Michal Jatczak, directly.
- After the call
- A written scope and a fixed price before any device is touched.
You leave with
Enrolment configured once
Windows Autopilot for hands-off enrolment, Apple Automated Device Enrollment where you have Macs, and Conditional Access that asks for an enrolled, compliant device before data access.
Compliance and configuration policies
Disk encryption enforced with the recovery keys kept, a minimum OS and patch level where non-compliant means no access, remote lock for Macs, and selective wipe of company data on Windows and Mac.
Update rings and app delivery
Updates and managed apps delivered through a pilot ring and then a broad one, with one device profile per role so every joiner gets the same setup.
Microsoft Defender onboarded
Every enrolled device reporting to Defender for Business on Business Premium, or to Defender for Endpoint on Microsoft 365 E3 or Microsoft 365 E5, with the alerts that matter routed to a named person. Endpoint detection and response (EDR) is in Defender for Business and in Defender for Endpoint Plan 2 on Microsoft 365 E5, not in Plan 1 on Microsoft 365 E3.
A Windows 11 move plan
The Windows 10 devices that remain, which can upgrade in place, which need replacing, and the order and dates to move them before Extended Security Updates run out.
Intune policy export and evidence pack
Every compliance and configuration policy as JSON, plus the state before and after for each control, with its owner and approval.
A device lifecycle runbook
Inventory kept against the Intune record, a return and wipe step, access blocked on the leaving day with a record of who did it and when, and the evidence at retirement. Then the Exit Kit.
How it runs
Read the fleet
Every device, its OS, its owner and whether it is enrolled, read without changing anything.
Pilot
The policies go onto a pilot group first, including your own laptop if you want it.
Roll out
The rest of the fleet moves in rings, with a check after each one.
Hand over
The Intune policy export, the evidence pack, the runbook, the move plan for the remaining Windows 10 devices and the Exit Kit.
What is not included
Hardware
I do not buy, ship or repair devices. The move plan says which ones to replace; you buy them where you like.
End-user support
Helpdesk work, on-site break-fix and mobile phone management beyond the baseline are not part of it.
The rest of the tenant
Conditional Access beyond the device rule, privileged roles and mail are in the hardening engagement.
Check it before you book
Microsoft publishes the end dates of Windows 10 Extended Security Updates: Year 1 ended on 13 October 2026, Year 2 ends on 12 October 2027.
The free tenant security scorecard asks about device compliance among its controls, so you can see where you stand before the call.
Pricing
Fixed in writing before any work starts, from a 30-minute call. The price depends on the rows below.
- Contract days
- From €600 a day
- Scope
- One tenant, up to 100 devices.
- What changes the price
- The number of devices, the mix of Windows and Mac, how many Windows 10 devices remain and whether an Intune setup already exists.
- Licences
Intune Plan 1 and Defender for Business come with Business Premium; Microsoft 365 E3 has Intune and Defender for Endpoint Plan 1, and Microsoft 365 E5 has Intune and Defender for Endpoint Plan 2. On another plan, the scope names the licence gap before work starts. Year 2 of Windows 10 Extended Security Updates ends on 12 October 2027. Joining now means paying for year 1 and year 2.
- Currency
- EUR, excluding VAT.
- VAT
- Reverse charge for EU businesses outside Malta whose VAT number validates in VIES. Malta VAT otherwise.
- Invoiced by
- Michal Jatczak, sole trader registered in Malta.
- Service level
- No SLA and no on-call duty. Dates are written into the Statement of Work.
Questions
Do we need Business Premium?
Not necessarily. This work uses Intune, Microsoft Defender and Conditional Access, which needs Entra ID P1. Business Premium includes Intune Plan 1, Defender for Business and Entra ID P1. Microsoft 365 E3 includes Intune, Entra ID P1 and Defender for Endpoint Plan 1, and Microsoft 365 E5 includes Intune, Entra ID P2 and Defender for Endpoint Plan 2. On another plan, the scope lists what is missing and what it costs before you sign.
What happens to our Windows 10 laptops?
The move plan sorts them: upgrade in place, replace, or keep on Extended Security Updates for a set time. Year 2 of Windows 10 Extended Security Updates ends on 12 October 2027. Joining now means paying for year 1 and year 2.
Will users lose their work during enrolment?
A laptop already joined to your Active Directory domain can stay in it and enrol in Intune without a reset, as a Microsoft Entra hybrid joined device. Moving such a laptop to Microsoft Entra join alone needs a reset, according to Microsoft, so I do that at a replacement or a reinstall unless we agree otherwise for that device. The pilot group finds the problems first, and each ring starts only after the one before it is checked.
Do you handle personal phones?
App protection for company data on personal phones can be part of the baseline. Full management of phones is a separate scope.
Move the last Windows 10 laptops before the next deadline.
A 30-minute call sets the scope. The fleet is read before any device changes.
Every consulting engagement ends with an Exit Kit.