MDM Compliance Improvement

Overview

At Infoblox I administered the global MDM setup, Intune and Jamf, for 2,800+ endpoints, and built automated compliance verification and remediation to close the gaps that kept reopening in the security posture.

Problem

Device compliance sat at 82%. The controls that mattered (FileVault, the BloxOne Endpoint network proxy, System Integrity Protection, CrowdStrike Falcon) were inconsistently enabled, running or licensed across the fleet, and nothing caught drift automatically.

Approach

Wrote scripts that verify and remediate each control on every managed device: FileVault enabled, the BloxOne Endpoint proxy configured and running, SIP active, Falcon installed, running and licensed. A device that fails a check gets corrected in the same pass instead of only being flagged.

Architecture

The verification scripts run against each device through Jamf and Intune and check FileVault status, BloxOne Endpoint proxy configuration, SIP state, and Falcon install, license and activity. A failed check triggers remediation: re-apply the configuration or reinstall the agent.

Outcome

MDM compliance went from 82% to 98% across 2,800+ endpoints. Endpoint governance is standardized and the manual-review gap that let devices drift is closed.

Lessons Learned

A compliance check only matters if it closes the loop. Verifying a control and fixing it in the same pass removes the backlog a report-only dashboard leaves behind.