Oxford City Council
Endpoint and security modernisation across 1,000+ devices
Ahmed led a broad endpoint and security modernisation programme across the council's Windows estate, working under NCSC Cyber Assessment Framework expectations.
1,000+devices modernised
90%Autopatch compliance reached
~9,800stale device records reviewed
The brief
Move a council estate of over 1,000 devices away from imaging, on-premises management and third-party tools towards cloud-managed Intune, Microsoft Defender and Conditional Access, while raising compliance and keeping front-line services running.
What was delivered
Device management
- Roadmap from SCCM co-management to Intune-only, and from Entra hybrid join to Entra join, with Windows Autopilot replacing task-sequence imaging
- Windows Autopatch compliance remediation across roughly 1,200 devices, reaching 90% compliance
- Enterprise App Catalog and Win32 packaging replacing PDQ Deploy
- Remote Help rolled out to replace TeamViewer, including unattended support for the service desk
Endpoint security
- Sophos to Microsoft Defender for Endpoint migration, with automated clean-up of leftover security-centre registrations
- Attack surface reduction rule analysis over 7,000+ audit events, with a documented exclusion set
- BitLocker compliance remediation and recovery-key escrow to Entra ID
- Secure Boot enablement and BIOS password standardisation across roughly 1,500 laptops
- Windows LAPS deployment with a staged retirement of the built-in administrator account
Identity and governance
- Phishing-resistant MFA enforced by Conditional Access for privileged administrators
- Entra ID device clean-up of around 9,800 records, 58% of them stale
- Browser extension governance: 213 extensions categorised for leadership approval
- SharePoint external-sharing governance for guest access
Not sure where your business stands?
Book a free 30-minute call. We will tell you the three things we would fix first — no report to buy, no hard sell.