Intune and Entra migrations, Windows 11 upgrades, Conditional Access, zero-touch provisioning. For IT teams that own the whole fleet without a dedicated endpoint architect.
This one is far more common than any vendor deck admits. Intune is stood up. Some policies landed. A pilot ring works fine. Then it stalled: the person driving it left, priorities moved, or the last twenty percent turned out to be the hard twenty percent. Win32 packaging. Printers. The line-of-business app nobody wants to touch. Four hundred GPOs nobody can prove are still doing anything.
Nothing here is broken. It's just unfinished, and unfinished is its own kind of expensive.
Nothing in place yet
You're starting from Group Policy.
A legacy MDM still owns the fleet, or nothing does. Machines are imaged by hand. AD domain join and GPO are the entire management story. Windows 11 is a wall with a date on it.
Further to go, but nothing to undo. Every decision gets made once instead of twice.
I've been the person on your side of this.
I'm Andrew Yeoman. I build and run Windows endpoint environments at scale: Intune tenants from scratch, the Win32 application libraries behind them, and fleet upgrades measured in thousands of devices rather than dozens. Multi-site, multi-country, often on a plant floor as well as in an office.
Most of that work is unglamorous. Packaging, provisioning, compliance baselines, the specific reason a policy reports success while doing nothing. I do it once, properly, and document it well enough that your own team runs it afterward.
No bench of juniors learning on your tenant. No 60-slide deck at the end that nobody opens twice.
Track record
Delivered at this scale, not theorized about.
4,000+ devices
Windows 11 fleet upgrade
Co-managed legacy MDM to Intune, zero-touch provisioning
3,000+ endpoints
Multi-site estate
Multiple countries, single tenant
600+ packages
Win32 application library
Detection rules, dependencies, supersedence
16 policies
Conditional Access baseline
Phased enforcement, break-glass, PIM integration
Full tenant
Passwordless rollout
Windows Hello for Business, pilot through production
Automated
Hardware asset lifecycle
Warranty sync, device attributes, reporting
This work was delivered in-house, as the senior engineer accountable for it, not as an outside consultant handing over a deck.
Done properly, the whole thing goes invisible.
A laptop arrives at a desk already configured. Policy applies without a ticket. Patches land overnight, compliance reports itself, and the person using the device never once thinks about how any of it got there. That's what automation is for. Not a dashboard nobody opens, but a fleet quiet enough that the rest of the business forgets IT exists.
How an engagement runs.
You know the scope and the cost before anything gets built, and you own it afterward.
No cost
Conversation
You describe what you're running into. I tell you honestly whether I can help, and if I can't, what would.
Two weeks, fixed fee
Assessment
Configuration, group assignments and co-management overlap get audited. You get a scored gap matrix and a sequenced roadmap.
Milestone-billed
Delivery
Scope and fee are agreed before work starts, then built in your tenant against milestones you can watch land.
Runbooks and handover
Handover
Your admins get the runbooks and the walkthrough. The point is that it keeps running after I stop.
Fixed scope. Fixed fee. Handover included.
Which one fits depends on how much is already in place.
Two weeksFixed fee
Endpoint health assessment
A full audit of your Intune and Entra configuration, group assignments, and co-management overlap, delivered as a scored gap matrix, a sequenced twelve-month roadmap, and a licensing utilization review. The cheapest way to find out what you're actually dealing with.
6 to 16 weeksMilestone-billed
Migration and remediation
AD and legacy MDM to Intune, Windows 11 fleet programs, Conditional Access design, passwordless rollout, or building the application packaging pipeline that everything else depends on. Runbooks and admin handover at the end.
OngoingMonthly retainer
Fractional endpoint architect
Standing architecture capacity for teams that can't justify a full-time senior endpoint engineer but keep hitting problems that need one. Design review before you build the wrong thing, an escalation path for failures nobody can root-cause, and quarterly roadmap ownership.
Questions I get asked first.
How do you work with our existing team?
Alongside them, not instead of them. Your admins keep their access and their ownership, I do the design and the build in the open, and everything gets written down as it goes. No bench of juniors learning on your tenant.
Do you resell licenses or hardware?
No. There's no reseller margin anywhere in this, which is why the licensing utilization review in an assessment is just an honest look at what you're already paying for and whether you're using it.
Remote or on-site?
Remote by default: endpoint work is tenant work, and nearly all of it happens in the admin center, so most projects need no travel at all. I'm based in Madison, Wisconsin, and when part of a project is physical, an imaging bench, a plant floor, a pilot group worth sitting with, I come to it.
How long does an engagement run?
The assessment is two weeks at a fixed fee. Migration and remediation work runs six to sixteen weeks, billed by milestone. The fractional architect arrangement is monthly and open-ended.
What happens after handover?
Your team runs it. That's the whole point of the runbooks and the admin handover. If you want standing architecture capacity after that, it's a retainer you can stop, not a dependency you're stuck with.
What if it's already half-done?
That's the common case, and it's easier than it looks from the inside. I pick it up where it stopped and finish the specific parts that stalled. Nothing gets rebuilt for the sake of rebuilding.
Rather than providing quick answers, Andrew invested the effort to investigate issues, evaluate alternatives, and ensure recommendations aligned with our business objectives. He approached every engagement with a sense of ownership and accountability that instilled confidence and built trust. We greatly appreciated his support and would highly recommend his services.”
Angela OlsonWI Manufacturing Company
Step zero · no cost, no pitch
Tell me what you're up against.
Step zero is a conversation, not a proposal. Describe what you're running into or what you're trying to get done, and I'll tell you honestly whether I can help. If I can't, I'll say so plainly and point you toward whatever would actually fix it. No discovery call that turns out to be a sales call.