March 7, 2026

Summary

For security consultancies delivering services to a diverse client portfolio, particularly within regulated industries like finance and insurance, consistency and scalability are paramount. Manually configuring security settings for each client’s endpoint and cloud environments is not only inefficient but also prone to human error, leading to inconsistent security postures. To deliver value effectively, it was essential to move beyond bespoke deployments and establish a standardised, repeatable method for hardening Microsoft environments.

Challenge

The primary challenge was to industrialise the process of applying security best practices across multiple client tenants. Manually implementing comprehensive security standards, such as the Center for Internet Security (CIS) Benchmarks, for every project was time-consuming and difficult to audit. The business needed a way to ensure that every client deployment met a high standard of security from day one, while still allowing for customisation based on specific needs. This required a shift from manual configuration to a codified, automated, and transferable solution.

Objectives

To address this challenge, the engagement defined a clear set of objectives:

• Develop a set of CIS-compliant security frameworks for Microsoft Intune (endpoint management) and Microsoft Azure (cloud infrastructure).
• Engineer the frameworks as configuration-as-code using PowerShell, enabling them to be transferred and deployed efficiently.
• Create a library of ‘plug-and-play’ Attack Surface Reduction (ASR) policies adaptable to different client environments without requiring a complete redesign.
• Improve the efficiency, quality, and scalability of security posture assessments and Managed Detection and Response (MDR) onboarding services.
• Ensure all configurations were documented and governed through formal processes.

Approach and Delivery

The approach focused on creating a robust, reusable asset. The work began with detailed technical assessments of existing client architectures to identify common security gaps and configuration requirements. This analysis informed the development of a core framework that mapped CIS controls directly to policies and settings within Intune and Azure.

The framework was built using PowerShell to create a configuration-as-code model. This enabled version control, testing, and repeated deployment of complex security configurations with high fidelity. The process was integrated into the full service delivery lifecycle, from pre-sales and solution design, where it informed Statements of Work (SOWs), through to the final implementation and handover. For each deployment, automated tooling and PowerShell scripts were used to assess the client’s existing network posture, identify high-value log sources for SIEM integration, and tune detection rules before handover to the MDR service.

Technical Implementation

The solution was implemented using a core set of Microsoft security technologies. PowerShell was the engine for codifying and automating the deployment of configurations. The frameworks directly targeted:

• Microsoft Intune: For applying CIS-aligned hardening and Attack Surface Reduction (ASR) rules to Windows endpoints.
• Microsoft Azure: Utilising Azure Policy to enforce security and compliance standards across cloud resources.
• Microsoft Defender for Endpoint & Defender for Cloud: The ASR rule policies and configurations were designed to enhance the protective capabilities of the Defender suite.

This config-as-code library provided a foundational security baseline that could be rapidly deployed, ensuring that all managed endpoints and cloud subscriptions adhered to a recognised industry benchmark from the outset.

Outcome

The development of these codified security frameworks produced significant improvements in service delivery. A transferable, CIS-compliant baseline was created that drastically reduced the time and effort required to harden client environments. This automation led to a more consistent and higher-quality security posture for all clients receiving the service.

The ‘plug-and-play’ nature of the ASR policies allowed for rapid tailoring to specific client risk profiles. As a result, the efficiency of onboarding clients to advanced services like MDR was notably improved, strengthening the overall security services portfolio and supporting the achievement of Microsoft’s Advanced Threat Specialisation based on positive client feedback.

Risks, Controls and Governance

To ensure quality and manage risk, every deliverable was governed by a formal process. Detailed Statements of Work (SOWs), responses to RFPs, and comprehensive change request documentation were produced for all client engagements. The configuration-as-code approach provided an inherent audit trail and version control, reducing the risk of unauthorised or undocumented changes. Pre-deployment assessments were a mandatory control to ensure that security changes, such as new ASR rules, would not negatively impact client operations.

Key Lessons

This initiative demonstrated that codifying security standards is a critical factor in scaling a security consultancy practice. Investing in a repeatable, automated framework made the service more consistent, auditable, and effective.

The key lessons learned were:

• Configuration-as-code is essential for scale: Automating the deployment of security baselines via PowerShell is fundamental to achieving efficiency and consistency.
• Align with industry benchmarks: Using established standards like the CIS Benchmarks provides immediate credibility and a solid foundation for security discussions.
• Frameworks enable agility: A well-designed framework allows for rapid customisation, enabling the service to adapt to diverse client needs without starting from scratch.

Related Services

• CIS Intune Benchmark Assessment
  Assess Microsoft Intune against CIS Benchmark guidance, identifying configuration gaps and delivering a prioritised hardening backlog with staged remediation.
• CIS Microsoft Azure Foundations Benchmark Assessment
  Assess Azure tenant and subscription configuration against CIS Benchmark guidance, identifying gaps and producing a prioritised remediation backlog.
• Endpoint Security Hardening (ASR, BitLocker)
  Implement Windows endpoint security hardening using ASR rules and BitLocker through Intune to reduce attack surface without disrupting users.
• CIS Remediation Program & Evidence Pack
  CIS remediation programme delivering controlled hardening, agreed baseline alignment, and an evidence pack to support audits and ongoing governance.