Microsoft Intune Endpoint Management for Public Health Department

Secure Hybrid Endpoint Management and Compliance Visibility with Microsoft Intune Plan 1

Modernizing Endpoint Security and Device Management for Public Health Services

This Maryland public health department sought to modernize its endpoint management environment to improve device security, strengthen compliance visibility, and simplify lifecycle management across approximately 200 Windows devices supporting critical healthcare and administrative operations.

Operating within a shared-responsibility model alongside the Maryland Department of Information Technology (DoIT), the health department required a modern endpoint management solution capable of integrating with existing statewide identity and security services while giving internal IT staff greater operational control over device configuration, compliance reporting, and endpoint lifecycle management.

To support these goals, Data Networks deployed a Microsoft Intune endpoint management framework centered on Microsoft Intune Plan 1, Hybrid Azure AD Join, and Microsoft Entra ID integration. The project established centralized cloud-based endpoint management, enabled remote lock and remote wipe capabilities for lost or stolen devices, and created a scalable foundation for secure, compliant endpoint operations aligned with HIPAA and CJIS requirements.

Addressing Security, Compliance, and Operational Visibility Challenges

Prior to the engagement, the health department lacked a centralized endpoint management platform capable of enforcing consistent device policies, compliance controls, and update management across its Windows environment. Device provisioning, configuration, and rebuild processes relied heavily on manual administrative effort, resulting in inconsistent configurations and operational inefficiencies.

The health department also operated within a fragmented productivity and identity ecosystem. Google Workspace services managed by DoIT existed alongside Microsoft 365 desktop applications, creating disconnected identity workflows that complicated policy enforcement and compliance auditing.

At the same time, the health department needed to improve visibility into device encryption status, operating system patch levels, and endpoint compliance to better support HIPAA and CJIS audit readiness. Although BitLocker encryption was enabled through Group Policy, the health department lacked centralized reporting capabilities to validate compliance across all managed devices.

A critical requirement of the initiative was the ability to remotely lock or remotely wipe lost or stolen devices to protect sensitive health and criminal justice information from unauthorized access.

Deploying a Modern Microsoft Intune Endpoint Management Framework

Data Networks implemented a modern Microsoft Intune endpoint management solution integrated with the health department’s existing Windows Server 2022 Active Directory environment and coordinated closely with DoIT’s statewide identity and cybersecurity services.

The deployment included:

• Microsoft Intune Plan 1 tenant configuration and policy deployment
• Microsoft Entra ID Connect integration for Hybrid Azure AD Join
• Secure synchronization of users, groups, and devices
• Intune enrollment and provisioning workflows for Windows endpoints
• BitLocker compliance and encryption reporting
• Windows Update for Business configuration
• Endpoint protection and compliance policy baselines
• Remote lock and remote wipe validation testing
• Role-based administrative access configuration
• Compliance reporting aligned with HIPAA and CJIS requirements
• Coordination with existing CrowdStrike endpoint protection services

Data Networks worked collaboratively with DoIT to ensure coexistence between Intune management and existing statewide security controls, including Microsoft Identity Manager (MIM) synchronization and CrowdStrike endpoint protection. The project maintained clear operational boundaries while allowing the health department to gain centralized visibility and control over endpoint configuration, compliance, and device lifecycle management.

The engagement also included pilot device enrollment testing, validation of authentication and sign-in workflows, policy verification, and operational knowledge transfer to support long-term administration of the environment.

Delivering Secure, Scalable, and Compliant Endpoint Operations

Following implementation, the health department gained a centralized Microsoft Intune endpoint management platform capable of improving security, operational efficiency, and compliance visibility across its Windows device environment.

The new framework enabled administrators to remotely lock or wipe devices when necessary, helping protect sensitive information and reduce organizational risk associated with lost or stolen endpoints. Standardized compliance reporting and policy enforcement also improved visibility into encryption status, operating system updates, and overall endpoint health.

By implementing Hybrid Azure AD Join and centralized cloud-based management, Data Networks helped the health department modernize endpoint operations while maintaining compatibility with existing statewide identity and cybersecurity services. The resulting environment provides a scalable foundation for future endpoint modernization initiatives, including potential mobile device management and expanded cloud security capabilities.

Tags: SLG, local, government, healthcare