Skip to content
Ekovolt

A Reinsurance Organisation in West Africa

Endpoint security with Microsoft Intune

Laptops and phones had no consistent security policies. In three weeks we rolled out a full Microsoft Intune framework and trained the client's IT team to run it themselves.

Request a free assessmentAll case studies
Users secured
20–50
Policy enforcement
100%
Hands-on training
8 hrs
IT staff trained
4

The client

The client is a reinsurance organisation serving insurance companies across West Africa. Its staff work across several countries on a mix of Windows laptops and Android phones.

Device management had grown up unevenly. There were no common security policies, no single view of which devices were reaching company data, and no clear picture of compliance. In a regulated industry, that exposure could not continue.

The challenge

Each gap added to the next, creating security and compliance risk across the organisation.

  • Compliance exposure

    Inconsistent controls invite regulatory scrutiny.

  • Breach risk

    Unmanaged devices are the most common way into a network.

  • Wasted IT time

    The team managed devices one by one, by hand.

  • Limits on growth

    An inconsistent security setup cannot scale as the business expands.

Security gapEffect on the business
No unified device managementIT could not see which devices were accessing company resources
Inconsistent security policiesDefender was off on some devices, and others had no encryption
No mobile device controlsAndroid phones reached company data without compliance checks
Weak identity checksMFA was not consistently enforced for admin roles
Open USB accessData could be copied to USB storage with no controls
No encryption standardBitLocker was not deployed across all Windows devices
Reliance on outside supportThe internal team could not manage endpoint policies on its own

Why the client chose Ekovolt

  1. 01

    Deep Intune expertise

    We designed one framework covering compliance, identity, data protection and threat detection, rather than deploying policies piecemeal.

  2. 02

    Training alongside rollout

    The client's team learned each policy as it went live, not after we left.

  3. 03

    Compliance-first design

    Every policy was built around insurance-sector obligations, so the client can show an audit-ready setup at any time.

  4. 04

    Fixes that last

    When issues came up after go-live, we recommended automated, self-maintaining solutions instead of one-off scripts.

What we did

  1. Phase 1

    Discovery and setup (week 1)

    • RequirementsWorked through the device mix, needs and risk tolerance with the client's IT team.
    • Readiness checksConfirmed Microsoft 365 and Intune licensing and that the environment was ready.
    • Intune configurationSet up the device management framework.
    • Training labBuilt a virtual lab for hands-on training.

  2. Phase 2

    Policy rollout and training (week 2)

    • First training sessionFour hours of hands-on policy configuration in the lab.
    • Second training sessionFour hours of advanced scenarios, troubleshooting and validation.
    • Four IT staff trainedFour members of the client's IT team took part in both sessions.
    • Training materialsComplete documentation for ongoing reference.
    Policy areaControls put in place
    Compliance policiesAndroid compliance with Google Play Services checks; Windows security with Defender and Tamper Protection; Intune health monitoring
    Endpoint security (Defender)Behaviour monitoring, cloud protection, real-time and on-access scanning, email and download scanning, protection from potentially unwanted apps
    Endpoint detection and responseEDR onboarding and full configuration
    Windows updatesUpdate rings for Windows 10 and 11 devices
    Conditional Access and MFAMFA for admin roles; unmanaged iOS and Android devices blocked; unknown platforms blocked
    Data protectionUSB storage blocked, with an exception list; BitLocker full-disk encryption enforced
    Lock screenStandard lock screen image and settings
    Content filteringWeb content filtering for Chrome

  3. Phase 3

    Testing and handover (week 3)

    • TestingEvery policy tested on Windows and Android devices.
    • Implementation reportFull documentation of every configuration.
    • Knowledge transferA final Q&A and a walk-through of real scenarios.
    • 30-day supportUp to 10 hours of support after go-live.

After handover

Two requests from the 30-day support period, and how each one left the client's team more independent.

Before and after

AreaBeforeAfter
Compliance visibilityNone, or manual checksComplete, through the Intune dashboard
Policy enforcementInconsistent100% enforced on all devices
MFA for admin rolesPartialFully enforced through Conditional Access
Unmanaged device accessPossibleBlocked by policy
USB data controlsNoneBlocked, with configurable exceptions
Device encryptionAd hocBitLocker on every Windows device
Mobile device managementNot in placeAndroid compliance policies active
IT independenceReliant on outside supportThe team manages the environment itself

Lessons from the project

  1. 01

    Security has to be enforced

    Policies without enforcement are only suggestions. Intune makes compliance mandatory.

  2. 02

    Visibility comes first

    You can't secure devices you can't see. Intune gave the team a single view of every device.

  3. 03

    Training is the point

    Eight hours of hands-on training meant the team inherited the capability, not just the setup.

  4. 04

    Build for the long term

    Faced with old devices, an automated policy beat a scripted cleanup.

  5. 05

    Support after launch matters

    Some questions only come up after the trainers leave. The 30-day support window caught them.

More case studies

Are your organisation's devices truly secure?

Unmanaged devices are the most common way attackers get in. We help insurance and financial organisations roll out enterprise-grade endpoint security and train their teams to run it.

Ask for a free assessment and our team will get back to you within 24 hours.