The problem
The client’s endpoint platform had grown across several control planes. Microsoft Intune policy lived in the portal, Windows hardening needed a clearer source of truth, and endpoint changes meant clicking, not reviewing. CIS Level 1 hardening was claimed but unauditable. Onboarding a new policy or patch baseline took days because nobody knew which setting or assignment was authoritative.
The approach
I built a CI/CD pipeline using GitHub Actions and DeploymentTheory’s Microsoft365 Terraform provider to manage Intune resources as code: compliance policies, configuration profiles, device configurations, app protection rules, app assignments, and remediation scripts. Existing portal-defined configurations got imported into Terraform state so the live estate matched what the repo declared.
Windows 11 hardening used OpenIntuneBaseline as the practical starting point, then mapped the required CIS Level 1 controls into Intune configuration profiles, custom compliance policies, and PowerShell remediation scripts that ran on devices that drifted out of policy.
The Windows environment included directory-joined devices and workforce identity integration outside the Microsoft-only path. I maintained the device policies, assignment model, and PowerShell remediation scripts so compliance stayed readable without copy-pasting policy between tenant contexts.
Windows Autopilot deployment profiles for Entra ID joined devices stayed in the same repo, supporting zero-touch provisioning. PatchMyPC integration with Intune handled fleet-wide application patching.
The outcome
Endpoint policy and application patching changes ship through clearer review paths now. Shared policy lives in one codebase with tenant-specific overrides, so a hardening change can apply uniformly without hiding exceptions. CIS L1 compliance is auditable directly from the repo instead of depending on portal screenshots or ad hoc remediation.