A behavioral health practice
Client records now live only on enrolled, compliant devices, and the practice can cut access cleanly the moment someone leaves.
This behavioral health practice ran a partly remote team. Virtual assistants and contractors, several of them offshore, signed into email, files, and sensitive client records every day. They were good at their jobs. The problem was where they worked. Every one of them signed in from a personal laptop the practice had never seen. There was no device management, no data loss prevention, and no clean way to remove access when someone moved on. The owner knew this quietly, the way most owners do. Client data sat on machines nobody controlled. An offboarding meant hoping a former assistant would simply stop opening files. With protected health information in the mix, that was a risk the practice could no longer carry. They wanted it fixed the week before a scare, not the week after. The risk was not a hacker. It was protected health information living on personal laptops the practice could neither see nor switch off.
If this sounds like your environment, the first conversation is free and takes 15 minutes.
Once a device is enrolled in Intune, every check has to pass before it touches company data. The same rules that let an assistant work also let the practice cut off a lost or departing laptop cleanly. A wipe removes only company information and leaves personal photos, files, and apps alone. This is the compliance posture every managed device now reports. Getting the tenant right is the foundation that makes all of this hold. Want to check where your own email domain stands? Our free DMARC record generator shows you in minutes.
We started with a short call and looked at the tenant's Secure Score together. It took minutes, and it was eye opening. A vague worry became a concrete, prioritized list.
We wrote up what was risky, what it would cost to fix, and what could wait. No jargon, just decisions the owner could make.
We set company data to be reachable only from enrolled, compliant devices. Every machine became wipeable for company data, without reaching personal files.
We added sign in policies that check the person, the location, and the device. This is the layer that makes multi factor authentication actually effective.
We configured policies so sensitive client records and card numbers cannot leave by accident. Then we hardened the tenant with Defender and closed every gap the Secure Score surfaced. Each improvement was documented.
We tested every policy with a small pilot group first, so nobody got locked out of work as the changes spread to the full team.
We'd scope the same kind of engagement for your business, with timelines and effort against each stage.
Our assistants were logging into client files from laptops we had never seen. Now company data only lives where we can control it, and when someone leaves we can cut it off the same day. It is the first time we have slept easy about this.
Patient records were scattered across shared drives with no access controls, risking HIPAA-adjacent compliance failures. Front-desk and clinical staff shared one generic login for the records drive, so there was no way to know who had opened a file, and nothing stopped a departing employee from walking out with years of patient history on a USB drive.
A boutique executive search firm nearly lost the one thing its whole business runs on, the trust in its founder's inbox. Here is exactly how the attack worked, the questions we asked, and every PowerShell step we ran to contain it.
Like a lot of growing operations, this logistics company approved invoices by forwarding emails. Someone then tracked who had signed off in a shared spreadsheet, retyping the same details every day. It worked, right up until the person who knew the spreadsheet went on vacation. The cracks showed in the usual places. Approvals sat unread at the bottom of inboxes. Nobody could say for certain who had signed off, or when, without scrolling back through an email chain. A mistyped number was caught late, if at all. The team did not want yet another subscription, another login, another monthly fee for an approval tool. They wanted the process fixed, inside the tools they already trusted. They thought they needed to buy an approval tool. It turned out they already owned everything they needed.
Book a free 15-minute call. We'll tell you honestly how much of what we did for A behavioral health practice would apply to your setup.