UK Biobank

UK Biobank holds health data on half a million volunteers and makes it available to approved researchers under strict controls. Ahmed owned the Intune and Autopilot configuration for a secure output-checking environment: virtual desktops that researchers' results pass through before they leave the controlled environment.

The brief

Deliver managed, compliant Windows 11 virtual desktops on AWS WorkSpaces for a new secure workflow, on a dedicated identity directory separate from the corporate tenant, so that every machine is enrolled, encrypted, monitored and running approved software before a user ever signs in — and repeatable for the next environment.

What was delivered

Identity and enrolment

• Dedicated Entra ID directory for the environment, with security groups scoping every policy and assignment
• Windows Autopilot user-driven enrolment of AWS WorkSpaces, so a freshly provisioned desktop joins, enrols and configures itself without hands-on build steps
• Enrollment Status Page that blocks user access until the security agents and baseline are installed and healthy

Device management

• Intune compliance and configuration baselines for the virtual desktops: encryption, firewall, update rings, local admin control
• Win32 application packaging with detection scripts and a shared packaging layout, so research tools install silently and verifiably
• Third-party application patching automated through a catalogue integration rather than manual repackaging

Operations

• Diagnosed an enrolment-time loss of user access on cloud desktops and traced it to network egress rather than policy — fixed at the firewall
• Validation runbook for each new WorkSpace image, and assessment of Linux subsystem manageability and patching for research users

Talk to us about similar work