- Client
- Financial & insurance group
- Sector
- Financial & Insurance
- Services
- Identity Management, Endpoint Management
- Year
- 2026
- Timeline
- 7 months
- Read time
- 5 min read
100%
MFA coverage across every entity and account
3,000+
Endpoints brought under unified management
70%
Fewer password-related support tickets
01 · The challenge
What we walked into
The group had grown by acquisition, and every entity brought its own identity platform, its own endpoint tooling, and its own way of meeting the regulator's expectations. Shared accounts remained in legacy systems, MFA coverage varied from entity to entity, and auditing access across the group meant collating spreadsheets from a dozen administrators.
The board's mandate was clear. One identity platform, every device managed, and evidence the auditors could read without a translation layer.
02 · Our approach
How we got there
- 01
Assess identity risk
A structured review of every entity's identity estate, from accounts and privileges to legacy authentication paths, and the gaps between written policy and lived reality.
5 weeks
- 02
Redesign the identity platform
A single Microsoft Entra ID tenant with conditional access, privileged identity management, and break-glass accounts with monitored use.
11 weeks
- 03
Bring every endpoint in
A staged Microsoft Intune rollout that enrolled devices entity by entity, with compliance policies set to report first and block later, so every entity moved across without disruption.
9 weeks
- 04
Prove it to the auditors
Access reviews, sign-in reports, and compliance evidence configured to answer the regulator's questions directly, without a manual collation exercise.
5 weeks
03 · The outcome
What changed
Identity and endpoints are now one system across the group. MFA covers every account including service accounts, more than 3,000 devices report their real compliance state, and audit evidence generates itself from policy.
One identity platform
Every entity, every account, one tenant. Conditional access applies to everyone, administrators included.
MFA everywhere
Full coverage including service accounts, with phishing-resistant methods for privileged roles.
Endpoints that report their real state
Compliance state is visible across more than 3,000 devices, with drift corrected automatically.
Audits without archaeology
Audit evidence generates itself from policy, ready for each cycle without a manual collation exercise.
“For the first time I can see who has access to what across every company we have acquired. When the auditors asked, the answer was a report, not a three-week scramble.”
Technologies
- Microsoft Entra ID
- Conditional Access
- Microsoft Intune
- Microsoft Defender for Endpoint
- Privileged Identity Management
- Microsoft Purview
A note on confidentiality
Much of our work takes place in regulated and security-sensitive sectors, where the details of a client's environment are confidential by default. In line with our commitments to those clients, identifying details in this case study have been anonymised or generalised, while the work, the decisions, and the outcomes are described as delivered.
If you would like to know more about this engagement, we are happy to discuss it further and can share additional information on request.