Evaluate Microsoft identity, endpoint management, security policy, authentication, and rollback as one operating system rather than isolated features.
Case Study - Microsoft Endpoint Engineering
Microsoft Endpoint Management Proof of Concept
A controlled Windows 11 Enterprise evaluation connecting Microsoft Entra identity, Intune policy, endpoint security, validation, and rollback.
Privately maintained enterprise-style proof of concept; not a production fleet deployment.
Evaluation StatusValidated Lab Baseline
- EnvironmentPrivate proof of concept
- EndpointWindows 11 Enterprise
- ManagementEntra ID + Intune
- PilotGRP-Test-Devices
- FocusEndpoint Security
Pilot before production, validate locally, isolate exceptions, and correct configuration through centrally managed policy.
Why This Project Matters
Hands-on validation closes the gap between documentation and operating behavior.
Engineering Context
Modern endpoint management is a connected system.
As a former Head of Infrastructure Engineering, I built this proof of concept as part of my transition into modern Microsoft cloud endpoint management. Rather than relying only on documentation or certification material, I wanted to validate how Microsoft Entra ID, Intune, endpoint security, identity, and policy enforcement behave together in a controlled enterprise-style environment.
Engineering Principles Applied
Bound the change, prove the state, and preserve management authority.
Pilot before production
Use a controlled assignment boundary before considering broader scope.
Trust endpoint evidence
Correlate portal status with the effective operating state.
Separate policy concerns
Keep security baselines distinct from service exceptions.
Correct the source
Remediate managed configuration in Intune instead of creating local drift.
Minimize exceptions
Restrict temporary access by protocol, direction, and network scope.
Validate each layer
Test transport, resolution, authentication, and identity independently.
Architecture Overview
Identity and policy converge on one controlled endpoint, then endpoint evidence closes the loop.
Scope and Constraints
The environment reproduced enterprise operating patterns without claiming production scale.
Single pilot endpoint
One Windows 11 Enterprise evaluation VM joined to Entra ID and managed through Intune.
Tenant-available capabilities
Microsoft 365 E3 licensing and relevant capabilities were verified in the tenant at the time of testing.
Private environment
No corporate fleet, production rollout, migration outcome, ROI, or Defender for Endpoint onboarding is claimed.
Policy Design
The baseline established posture; separate policies documented each exception.
GRP-Test-Devices
Bounded initial assignment and created a known validation target.
BitLocker
TPM 2.0 protection, numerical recovery password, and Entra recovery escrow.
Defender Firewall
All profiles enabled, inbound blocked, outbound allowed, logging configured, and merge restricted where appropriate.
Managed firewall rules
Dedicated TCP 3389 rule and temporary subnet-scoped UDP 137 lab exception.
Defender Antivirus
Real-time, behavior, cloud, script, attachment, network, and PUA protections without broad exclusions.
Settings restriction
A separate user-targeted policy exposed the operational difference between user and device assignment.
| Policy | Protocol / Control | Scope | Purpose |
|---|---|---|---|
| Firewall baseline | Default inbound block | Device pilot | Establish host posture |
| RDP rule | Inbound TCP 3389 | Required management path | Permit Remote Desktop transport |
| Lab exception | Inbound UDP 137 | Local lab subnet | Temporarily restore legacy short-name resolution |
Documented Technical Debt
UDP 137 was a lab exception, not the target architecture.
NetBIOS is legacy. The temporary rule was restricted to the local lab subnet while the dependency was investigated. It is not a production recommendation; the long-term improvement is managed DNS and removal of the exception.
Implementation
The build moved from identity and enrollment through security policy, validation, and managed recovery.
Identity and enrollment
Joined CL-WIN11-002 to Entra ID and enrolled it in Intune.
Pilot assignment
Assigned the endpoint through GRP-Test-Devices.
Encryption
Deployed BitLocker and confirmed local protection and Entra escrow.
Host firewall
Deployed the default-block baseline and isolated required exceptions.
Antivirus
Deployed and inspected the Defender Antivirus baseline.
Rollback
Corrected the user-targeted Settings policy at the management source.
Validation and Evidence
Configuration status and effective endpoint state were treated as different forms of evidence.
Validation Standard
Administrative status was used to understand assignment and processing.
Endpoint-side checks were used to validate effective state.
Entra join
dsregcmd /statusEncryption and protectors
Get-BitLockerVolume -MountPoint "C:"
manage-bde -status C:
manage-bde -protectors -get C:Profiles and rules
Get-NetFirewallProfile
Get-NetFirewallRule |
Where-Object DisplayName -Match "RDP|NetBIOS"Transport and resolution
Test-NetConnection -ComputerName "CL-WIN11-002" `
-Port 3389 -InformationLevel DetailedPreference and status
Get-MpPreference
Get-MpComputerStatusNoControlPanel
Get-ItemProperty `
-Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" `
-Name "NoControlPanel" -ErrorAction SilentlyContinueEvidence Plan
Authentic, redacted evidence may be added later; no screenshots are invented here.
Entra device record
Device identity and join evidence.
Intune device overview
Enrollment and management evidence.
BitLocker evidence
Escrow or protector state, carefully redacted.
Firewall assignment
Baseline and separate rule policies.
Antivirus policy
Selected Defender configuration.
PowerShell validation
Effective endpoint state without sensitive values.
Publication Safety
Sensitive identity and recovery data stays private.
Evidence must redact recovery passwords, recovery-key identifiers, tenant IDs, unnecessary device IDs, usernames, email addresses, and sensitive IP details.
Troubleshooting and Recovery
The failure path crossed transport, name resolution, authentication, and device identity.
| Step | Layer | Observation and action |
|---|---|---|
| 1 | Firewall posture | Default inbound blocking applied successfully. |
| 2 | RDP transport | RDP failed because TCP 3389 had no explicit allow rule. |
| 3 | RDP transport | A dedicated TCP 3389 policy restored the network path. |
| 4 | Connectivity | Testing by IP succeeded and proved the TCP path. |
| 5 | Authentication | Entra web-account authentication required the registered short device name. |
| 6 | Name resolution | The baseline blocked the lab's legacy short-name resolution path. |
| 7 | Lab exception | A subnet-scoped UDP 137 rule temporarily restored resolution. |
| 8 | Device identity | RDP succeeded using CL-WIN11-002 with “Use a web account to sign in to the remote computer.” |
Managed Rollback
The endpoint did not need to be rebuilt.
The user-targeted WIN11-CFG-Hide-Settings-App policy set NoControlPanel=1 and blocked Control Panel and Windows Settings. The setting was confirmed in HKCU, traced to Intune, corrected at the source, and verified through registry removal. Windows Settings returned without an unmanaged local override.
Engineering Decision Log
The strongest decisions controlled blast radius, policy ownership, and technical debt.
| Decision | Reason | Outcome |
|---|---|---|
| Pilot through GRP-Test-Devices | Bound access and user-experience risk. | Issues remained limited to the test endpoint. |
| Separate baseline and rules | Posture and exceptions have different lifecycles. | RDP and UDP 137 were independently reviewable. |
| Validate endpoint state | Portal status cannot show every local interaction. | Identity, encryption, firewall, antivirus, and registry state were confirmed. |
| Correct policy in Intune | Local changes create drift and hide the source error. | Settings returned with management authority intact. |
| Avoid broad exclusions | General exclusions weaken protection. | Broad Defender coverage remained in place. |
Operational Lessons
Endpoint engineering depends on understanding the full policy and authentication path.
Pilot before production
Bound the impact before expanding assignment.
Separate baselines
Make every exception visible and independently owned.
Validate the path
Transport, resolution, authentication, and identity are distinct layers.
Use endpoint evidence
Correlate reporting with effective state.
Fix the source
Preserve managed authority and avoid local drift.
Track technical debt
Keep legacy exceptions narrow and plan their removal.
Technologies & Engineering Skills
Microsoft endpoint controls paired with disciplined infrastructure practice.
Future Improvements
Remove the legacy name-resolution dependency and extend the management lifecycle deliberately.
- Managed DNS
- Autopilot
- Conditional Access
- Windows LAPS
- ASR Audit
- Update Rings
- Policy Versioning
Executive Takeaway
The value was understanding the system when things did not go as planned.
The value of this project was not that policies deployed successfully. It was understanding how identity, endpoint security, authentication, validation, and troubleshooting behave together when things do not go as planned.