— Practice / Managed IT
Every company laptop enrolled, encrypted, and patched.
Most small businesses run on Windows laptops and Microsoft 365 that nobody actually manages — devices bought retail, signed in with personal accounts, updated whenever someone clicks the button. We set the fleet up properly and run it: zero-touch enrollment, a security baseline, controlled patching, and a Microsoft 365 tenant that is administered and backed up.
— Why us
The tooling we publish is the tooling we run.
We built and published a one-command Windows Autopilot enrollment tool — a new laptop registers to your tenant as corporate, waits for its deployment profile, and powers off ready to ship. We also wrote the field guide on running that kind of tooling safely, down to supply-chain hardening. Device management is engineering work, and we treat it that way.
Zero-touch onboarding in practice: a new hire’s laptop is registered, profiled, and shipped — they sign in on day one and land on a managed corporate device.
— What we run
The fleet, handled.
Zero-touch enrollment
Windows Autopilot and Intune: new devices enroll as corporate through the out-of-box experience, pull their deployment profile, and arrive managed. No hand-built laptops, and no personal-account accidents that take a wipe to undo.
Security baseline and patching
Disk encryption, screen lock, enrollment restrictions, and controlled operating-system and application updates on a schedule that respects business hours. The unglamorous settings that prevent most incidents.
Microsoft 365 administration
Licences, Entra ID, mailboxes, sharing policies, multi-factor enforcement. Joiners, movers, and leavers handled promptly — including the departed employee whose account would otherwise quietly keep working.
Microsoft 365 backup
Retention policies are not a backup. We back up mail, OneDrive, and SharePoint to independent storage and test the restores — because a deleted mailbox or a ransomware event is exactly when you find out whether anyone did.
Email trust
SPF, DKIM, and DMARC configured and monitored, so your invoices reach inboxes and mail spoofing your domain gets rejected before a client pays a fake one.
Helpdesk and reporting
A named place to send problems, remote-first, with response expectations agreed in writing. Monthly reporting on what happened, what changed, and what is coming.
— The full catalog
What a managed fleet includes.
- Device enrollment, replacement, and end-of-life wipe
- Employee onboarding and offboarding — accounts, devices, and access, all of it
- Password manager rollout and shared-credential cleanup
- Vendor and licence management — one place that knows what you pay for and why
- Network and wifi that separates guests from the business
- Backups that have actually been restored, on a schedule
- Security awareness basics for staff — phishing, payment fraud, device hygiene
- A documented environment the next person can pick up
— How it works
The engagement.
Same five-step method as every SetKernel engagement — Brief, Architect, Sprint, Ship, Operate — each with a written artefact you review. For device management the shape is usually: a short assessment of what exists, a setup project that brings the fleet to a baseline, then an ongoing relationship that keeps it there. Start with a short written brief: how many people and devices, what you run today, and what worries you. You get a scoped price and a fit / no-fit answer within one business day.
— Questions
Before you write.
Does a small business actually need Intune and Autopilot?
Below a handful of devices, probably not — a checklist and discipline can carry you. The moment you are issuing laptops, handling staff turnover, or holding client data you would have to report losing, unmanaged devices become the biggest risk in the business. Enrollment, encryption, and patching are how that risk gets boring.
Is Microsoft 365 backed up automatically?
No. Microsoft runs the service; recovering your data is your problem, and Microsoft’s own guidance is to back up the content you store in its services regularly. Retention policies and the recycle bin help with small accidents — not with ransomware, a compromised account, or a mailbox deleted past its retention window. We back up mail, OneDrive, and SharePoint independently and test the restores.
What does device management include?
Enrollment and a security baseline for every company device, controlled patching, Microsoft 365 administration and backup, email authentication, onboarding and offboarding, and a helpdesk with agreed response expectations. The exact scope is written down per engagement, so you know what is covered before anything starts.
Our devices are already set up — can you take over as-is?
Yes, gradually. We start with an assessment: what is enrolled and how, what is encrypted, where the admin accounts live. Devices enrolled as personal cannot be converted to fully managed corporate devices in place — that takes a re-enrollment, which we schedule around real work, device by device. Nothing gets wiped without a plan and a verified backup.
How do we start?
Send a short written brief — people count, device count, what you run (Microsoft 365, any servers, line-of-business software), and what is not working. We reply in writing within one business day with fit / no-fit and, if fit, a scope and price.
— Engage
Nobody managing the laptops?
Tell us how many people and devices, and what you run. We reply in writing within one business day.