Endpoint modernization for mid-market manufacturers.

Intune and Entra migrations, Windows 11 fleet upgrades, passwordless rollout, and zero-touch provisioning — for manufacturers running 500 to 5,000 endpoints.

I'm Andrew Yeoman. I build and run Windows endpoint environments at manufacturing scale: Intune tenants from scratch, the Win32 application libraries behind them, and fleet upgrades measured in thousands of devices rather than dozens.

Most of that work is unglamorous — packaging, provisioning, compliance baselines, the specific reason a policy reports success while doing nothing. I do it once, properly, and document it well enough that your own team runs it afterward.

Track record

ScopeScaleDetail

Windows 11 fleet upgrade 4,500 devices Co-managed SCCM to Intune, zero-touch provisioning

Multi-site endpoint estate 3,500 endpoints Nine sites, two countries, single tenant

Win32 application library 600+ packages Detection rules, dependencies, supersedence

Conditional Access baseline 16 policies Phased enforcement, break-glass, PIM integration

Passwordless rollout Full tenant Windows Hello for Business, pilot through production

Hardware asset lifecycle Automated Warranty sync, device attributes, reporting

Client names on request. Open-source tooling from this work is published at github.com/YeomanLabs.

How I work

Endpoint Health Assessment

Two weeks · Fixed fee

A full audit of your Intune and Entra configuration, group assignments, and co-management overlap — delivered as a scored gap matrix, a sequenced twelve-month roadmap, and a licensing utilization review. Most engagements start here because it is the cheapest way to find out what you are actually dealing with.

Migration & remediation

Six to sixteen weeks · Fixed fee

SCCM or KACE retirement, Windows 11 fleet programs, Conditional Access design, passwordless rollout, or building the application packaging pipeline that everything else depends on. Milestone-billed, with runbooks and admin handover included rather than sold separately.

Fractional endpoint architect

Monthly retainer

Standing architecture capacity for teams that cannot justify a full-time senior endpoint engineer but keep hitting problems that need one. Design review before you build the wrong thing, an escalation path for the failures nobody can root-cause, and quarterly roadmap ownership.

Get in touch

If you are staring down a Windows 11 deadline, an SCCM or KACE retirement, or a tenant nobody has audited in three years — send a note describing it. I will tell you honestly whether it is something I can help with.

andrew@yeomanlabs.co