---
title: "Module 1 — Endpoint Management Foundation"
description: "Device inventory, Intune enrollment, compliance baseline, shadow IT discovery, and ASTRAL deployment for drift detection. Full device visibility in 30–45 days."
eyebrow: "Consulting Module"
lead: "You cannot govern what you cannot see. Endpoint management is almost always the right first module after the Diagnostic — it produces immediate visibility across every device and creates the foundation every other security control depends on."
actions:
  - label: "Get in Touch"
    url: "/about/#contact"
    primary: true
  - label: "View All Modules"
    url: "/consulting/skills/"
---

## What It Delivers

<div class="feature-list">
  <div class="feature-item">
    <div class="feature-item-icon">📱</div>
    <div class="feature-item-body">
      <h4>Complete Device Inventory</h4>
      <p>Every managed device enrolled in Intune: OS version, patch level, encryption status, compliance state. Shadow IT devices flagged. You leave with a real picture of your fleet — not what should be there, but what is.</p>
    </div>
  </div>
  <div class="feature-item">
    <div class="feature-item-icon">✅</div>
    <div class="feature-item-body">
      <h4>Compliance Baseline</h4>
      <p>Encryption enforced, OS minimum versions set, antivirus required, screen lock configured. Devices that fail compliance are flagged in red and blocked from data access via Conditional Access integration.</p>
    </div>
  </div>
  <div class="feature-item">
    <div class="feature-item-icon">🔀</div>
    <div class="feature-item-body">
      <h4>ASTRAL Deployment for Intune Drift</h4>
      <p>ASTRAL captures your Intune configuration as versioned snapshots in Git. Any policy change opens a pull request with a human-readable diff. Unauthorised changes are detected before they become incidents.</p>
    </div>
  </div>
  <div class="feature-item">
    <div class="feature-item-icon">🔍</div>
    <div class="feature-item-body">
      <h4>Shadow IT Discovery</h4>
      <p>Application inventory across all enrolled devices surfaces sanctioned and unsanctioned software — including consumer AI tools running on corporate devices. Every unsanctioned application is a potential data exfiltration or malware entry path.</p>
    </div>
  </div>
  <div class="feature-item">
    <div class="feature-item-icon">🔐</div>
    <div class="feature-item-body">
      <h4>Conditional Access Integration</h4>
      <p>Device compliance state wired into Conditional Access so non-compliant devices cannot reach email, SharePoint, or Teams. The device check becomes a real enforcement signal, not just a dashboard metric.</p>
    </div>
  </div>
</div>

## Why Endpoint Management First

Endpoint management is the entry vector that reveals everything else. Once enrollment runs, the consultant can see orphaned AD accounts (devices with no owner), unencrypted disks (the compliance gap nobody admitted), and consumer AI apps installed on devices that access regulated data. Every one of these becomes a natural conversation about what comes next.

**The Trojan horse:** the client asks to manage their laptops. You deliver that in 30 days. You also hand them a map of what you found — accounts that should not exist, devices that are not encrypted, applications leaking data. The device problem is solved. The picture that follows it is what turns a bounded engagement into a programme.

## Scope and Prerequisites

| | |
|---|---|
| **Duration** | 30–45 days |
| **Environment** | M365 E3+ (Intune included) |
| **Prerequisites** | Global Administrator access; device enrollment feasibility confirmed |
| **Natural follow-on** | Module 2 (Identity Security) — identity gaps surface during enrollment |

<div class="cta-strip">
  <h2>Ready to see your fleet?</h2>
  <p>Full device visibility in 30 days. The foundation every other security control depends on.</p>
  <div class="actions">
    <a href="/about/#contact" class="btn btn-primary">Get in Touch</a>
    <a href="/consulting/skills/" class="btn btn-outline">View All Modules</a>
  </div>
</div>