it-service@brocent.com
Intune Device Management Audit
A one-off audit of every device that reaches company data: who owns it, whether it is enrolled, compliant, encrypted and up to date, and how personal phones should be protected. This sample uses the same fictitious 14-person UK firm as the Microsoft 365 audit.
Read the full sample on this page
This page is the online preview: the same fictitious client and the same figures as the files. To download the PDF and Excel versions, tell us who you are.
Thank you — your downloads are ready
Windows is sound; Apple devices and personal phones carry the risk
Acme Capital's 13 Windows laptops are in good order: Autopilot, BitLocker, Defender and a compliance policy are all in place, and 10 of 13 are compliant today.
The weaknesses are on the Apple and mobile side. Two Macs were bought outside Apple Business Manager and are not managed; FileVault is not enforced on the Macs that are; and the 7 personal phones that open client mail and files have no app protection at all.
The recommended model keeps personal phones out of device management. They get app protection only (PIN, no copy to personal apps, selective wipe), which staff accept more readily and which satisfies the Cyber Essentials v3.3 BYOD requirements for the work apps.
Corporate Macs move to Apple Business Manager with Platform SSO (Secure Enclave), FileVault and Defender, so that they match the Windows estate.
The device estate at a glance
Collected from a read-only scan on 12 Oct 2026 and re-checked on 14 Oct 2026. Compliance, encryption and patching are measured on the 19 enrolled devices; the other 9 are not managed at all.
The critical finding and four high findings
Evidence. 7 personal phones (4 iOS, 3 Android) sync Outlook, Teams and OneDrive. No iOS or Android app protection policy exists; the CA policy 'Mobile — require app protection' is Off.
Impact. Client data on these phones has no app PIN, can be copied into personal apps (WhatsApp, Gmail) and cannot be removed when a phone is lost or the person leaves. Cyber Essentials v3.3 treats these phones as in scope because they access organisational data.
Recommendation. (1) Create an iOS and an Android app protection policy targeted to all users (settings in section 7). (2) Turn on the CA policy 'Mobile — require app protection' in report-only for 7 days, then On. (3) Send staff the one-page guide: install Outlook / Teams / OneDrive from the store, sign in, set the app PIN.
Evidence. 3 personal phones use the iOS Mail app and 1 uses Samsung Email through ActiveSync. These apps cannot carry app protection.
Impact. Even with I-01 in place, these clients would keep unprotected copies of mail.
Recommendation. (1) Block Exchange ActiveSync clients through Conditional Access (client apps: Exchange ActiveSync — block) once Outlook is installed.
Evidence. Two MacBook Pro laptops (bought from a retailer in 2025) are not in Apple Business Manager and are not managed. They are used for client work.
Impact. No encryption enforcement, no Defender, no update control and no remote wipe on two laptops holding client files.
Recommendation. (1) Ask the reseller to add the devices to Apple Business Manager, or add them with Apple Configurator for iPhone (requires erase). (2) Assign the ADE enrolment profile with Platform SSO; schedule a 45-minute slot per user to back up and re-enrol.
Evidence. The 5 enrolled Macs have Defender, but full disk access and network extension approvals are missing on 2 of them (status 'Not fully protected'). The 2 unenrolled Macs (I-03) have no Defender.
Impact. Real-time protection and EDR telemetry are incomplete.
Recommendation. (1) Deploy the Microsoft-provided system extension, full disk access and background service profiles. (2) Deploy Defender to the 2 Macs after I-03.
Evidence. The macOS compliance policy checks OS version and password only. 2 of 5 managed Macs report FileVault off.
Impact. A lost or stolen Mac exposes client files on disk.
Recommendation. (1) Deploy a FileVault configuration (escrow recovery key to Intune); add 'Require encryption' to the compliance policy with a 3-day grace period.
Management model, device and CIS results, findings register
Recommended management model, by who owns the device
Company laptops are fully managed. Personal phones are not enrolled and get app protection only. Personal computers get browser-only access with no downloads.
| Device group | How it is managed | Controls | Conditional Access |
|---|---|---|---|
| Corporate Windows laptops | Full management | Autopilot + Entra join; compliance + security baseline; Defender for Business; Windows Update for Business rings; LAPS | Require compliant device |
| Corporate Macs | Full management | Apple Business Manager + ADE; Platform SSO (Secure Enclave key); FileVault with escrowed key; Defender; macOS update enforcement (DDM) | Require compliant device |
| Personal iPhones | App protection only (MAM without enrolment) | App protection policy for Outlook, Teams, OneDrive, Word, Excel, Edge; no device profile installed | Require approved app + app protection policy |
| Personal Android phones | App protection only (default); work profile optional | App protection policy as above. Offer Android Enterprise personally-owned work profile if a user wants separation of notifications and contacts | Require approved app + app protection policy |
| Home and personal computers | Browser only | SharePoint / OneDrive web-only access; no download, print or sync | Browser session controls (limited access) |
Devices that reach company data (28)
| Platform | Ownership | Devices | Enrolment | Managed | Compliant |
|---|---|---|---|---|---|
| Windows 11 | Corporate | 13 | Autopilot (user-driven), Entra joined | 13 | 10 |
| macOS | Corporate | 7 | 5 via Apple Business Manager (ADE), 2 not enrolled | 5 | 4 |
| iOS / iPadOS | Corporate | 1 | ADE (reception iPad, shared) | 1 | 1 |
| iOS | Personal | 4 | Not enrolled (no app protection) | 0 | 0 |
| Android | Personal | 3 | Not enrolled (no app protection) | 0 | 0 |
| Windows (home PCs) | Personal | — | Browser access only, unmanaged | 0 | 0 |
19 of 28 devices are enrolled (68%). Compliance is measured on enrolled devices only.
CIS Benchmark results by platform
| Platform | Benchmark | Assessed | Pass | Fail | Manual | Pass rate |
|---|---|---|---|---|---|---|
| Windows 11 | CIS Intune Windows 11 v5.0.0 L1 | 96 | 78 | 14 | 4 | 81% |
| macOS | CIS Intune macOS 26 v1.0.0 L1 | 54 | 31 | 19 | 4 | 57% |
| iOS / iPadOS (corporate) | CIS Intune iOS/iPadOS 26 v1.0.0 L1 | 22 | 18 | 3 | 1 | 82% |
| iOS / Android (BYOD) | App protection baseline (Microsoft level 2) | 18 | 0 | 18 | 0 | 0% |
Proposed app protection policy for personal phones
| Setting | Configuration |
|---|---|
| Apps targeted | Outlook, Teams, OneDrive, Word, Excel, PowerPoint, Edge, Microsoft 365 Copilot |
| Access requirements | App PIN 6 digits; biometrics allowed; re-check after 30 minutes inactivity |
| Data transfer | Send / receive data only with policy-managed apps; save copies only to OneDrive and SharePoint; restrict cut, copy and paste to managed apps (paste in allowed) |
| Encryption | Encrypt org data (iOS: device encryption required; Android: app-level encryption) |
| Conditional launch | Max PIN attempts 5 then reset PIN; offline grace 720 minutes then block, 90 days then wipe data; jailbroken / rooted: block; min OS iOS 18.0, Android 14 |
| Selective wipe | On leaving or device loss: IT lead wipes org data only, personal photos and apps untouched |
| Conditional Access | Grant: require approved client app OR app protection policy (iOS, Android) |
Cyber Essentials v3.3 mapping (devices)
| Requirement area | Control tested | Status today |
|---|---|---|
| Secure configuration | Change default passwords; disable auto-run; device unlocking | Windows: Met. Macs: Not met (I-12). Phones: Not met (I-01). |
| Secure configuration | Remove unnecessary software and accounts | Partial (I-08 local admin, I-13 stale records) |
| User access control | Least privilege; separate admin accounts | Not met (I-08); LAPS planned |
| Malware protection | Anti-malware enabled and updated on all in-scope devices | Partial (I-04, I-03) |
| Update management | Supported OS; critical / high updates within 14 days | Partial (I-06: 5 devices) |
| BYOD scope | Personal devices accessing organisational data are in scope | Not met (I-01, I-02); app protection model closes it |
Findings register (15)
Every finding with its domain, severity, effort (S under half a day, M up to 3 days, L more) and the roadmap phase that closes it.
| ID | Domain | Finding | Severity | Effort | Phase | Confidence |
|---|---|---|---|---|---|---|
| I-01 | App protection (BYOD) | No app protection policy for personal iPhones and Android phones | CRITICAL | M | P0 | Verified |
| I-02 | App protection (BYOD) | Native mail apps on personal phones are allowed through Exchange ActiveSync | HIGH | S | P1 | Verified |
| I-03 | Enrolment | Two corporate Macs are not enrolled; Apple Business Manager is not used for them | HIGH | M | P1 | Confirmed with client |
| I-04 | Endpoint security | Defender missing on 2 unenrolled Macs and not fully protected on 2 enrolled Macs | HIGH | S | P1 | Verified |
| I-05 | Compliance | FileVault is not required by the macOS compliance policy | HIGH | S | P1 | Verified |
| I-06 | Updates | 5 devices are more than 14 days behind on critical updates | MEDIUM | S | P1 | Verified |
| I-07 | Identity on devices | Macs use local accounts with separate passwords; Platform SSO not configured | MEDIUM | M | P2 | Verified |
| I-08 | Endpoint security | Local administrator rights on 4 Windows laptops; LAPS not configured | MEDIUM | S | P1 | Verified |
| I-09 | Compliance | Non-compliant devices are not blocked: no 'mark non-compliant' schedule | MEDIUM | S | P1 | Verified |
| I-10 | Configuration | Windows security baseline not assigned; 3 settings conflict with the custom profile | MEDIUM | S | P2 | Verified |
| I-11 | Enrolment | Enrolment restrictions allow personal Windows devices to enrol | MEDIUM | S | P1 | Verified |
| I-12 | Configuration | Screen lock on Macs set to 15 minutes; no password complexity | MEDIUM | S | P1 | Verified |
| I-13 | Inventory | 3 stale device records (no check-in for 90+ days) | LOW | S | P2 | Verified |
| I-14 | Apps | Company Portal not branded; no self-service apps published | LOW | S | P2 | Verified |
| I-15 | Recovery | BitLocker recovery keys escrowed for 12 of 13 laptops | LOW | S | P2 | Verified |
The phased fix plan
| Ref | Risk | Severity | Owner | Due | Status | Next action |
|---|---|---|---|---|---|---|
| P0 | Phase 0 — Stabilise — ≈ 1 day. I-01 App protection for personal phones + CA requirement. | CRITICAL | Brocent + Acme IT lead | Days 0–14 | Proposed | Success measure: 100% of mobile sign-ins through protected apps. |
| P1 | Phase 1 — Harden — ≈ 3.5 days. I-02 Block ActiveSync native mail; I-03 Enrol the 2 Macs through ABM; I-04 Complete Defender on Macs; I-05 FileVault enforcement; I-06 14-day update deadlines; I-08 Remove local admin; Windows LAPS; I-09 Non-compliance schedule; I-11 Block personal Windows enrolment; I-12 macOS passcode policy. | HIGH | Brocent + Acme IT lead | Days 15–60 | Proposed | Success measure: ≥ 95% compliant; 100% encrypted; 100% patched within 14 days. |
| P2 | Phase 2 — Govern — ≈ 1.5 days. I-07 Platform SSO for Macs; I-10 Windows security baseline and ASR in block; I-13, I-14, I-15 Hygiene. | MEDIUM | Brocent + Acme IT lead | Days 60–120 | Proposed | Success measure: CIS L1 ≥ 90% on Windows and macOS; verification re-audit issued. |
How this report was produced
| Source | Extracted | Records | Used for |
|---|---|---|---|
| CIS Microsoft Intune for Windows 11 Benchmark | v5.0.0 | — | Level 1 (corporate laptops) |
| CIS Apple macOS 26 Tahoe / 15 Sequoia Intune Benchmark | v1.0.0 / v1.1.0 | — | Level 1 (corporate Macs) |
| CIS Apple iOS & iPadOS 26 Intune Benchmark | v1.0.0 | — | Level 1, institutionally owned and BYOD profiles |
| Microsoft Android Enterprise security configuration framework | Current | — | No CIS Intune benchmark exists for Android |
| Cyber Essentials requirements | v3.3 (Danzell) | — | Secure configuration, malware protection, update management, BYOD scope |
Method and definitions
Related report. The tenant-wide view is the Microsoft 365 Security Audit (BCS-M365A-2026-0147); this report holds the full device findings that it summarises.
Scope. Windows, macOS, iOS, iPadOS and Android devices that reach company data, whether company-owned or personal. The audit reads configuration and metadata only.
Severity. Critical: Likely to be exploited and would give an attacker tenant-wide access or expose regulated data. Fix within 14 days; High: Realistic attack path or a control that insurers and Cyber Essentials test directly. Fix within 30 days; Medium: Weakens defence in depth or detection. Fix within 90 days; Low: Hygiene or best practice. Schedule with routine work; Info: Observation, no action required.
Effort. S: Under half a day, configuration only; M: Half a day to 3 days, may need user communication; L: More than 3 days or needs a project (devices, licences, process).
Confidence. Verified: Read from the tenant through Microsoft Graph or PowerShell and re-checked on the verification date; Confirmed with client: Configuration read automatically; business context confirmed with Acme Capital's IT lead; Manual review: No API exposes the setting; reviewed in the admin portal with the client on a screen share.
Acme Capital Limited is a fictitious client. Every name, device, user and figure in this sample is invented for illustration and describes no real tenant. The downloadable PDF and Excel workbook use exactly the same data.
BCS Support Center · it-service@brocent.com
Questions about this audit
- We have Macs, Windows laptops, iPhones and Android phones, some of them personal. How do you audit and secure that mix?
- What do you recommend for Macs?
- Can I see a sample audit report?
- What permissions does your read-only audit application ask for?
- Does the audit help with Cyber Essentials?
- Does remediation include staff guides and user support?
More Report Central samples
Want this for your own devices?
The audit is read-only and covers Windows, Mac, iPhone and Android, company-owned or personal. Ask us how it fits alongside a Microsoft 365 Security Audit.