Managed by Mand-IT

Workplaces that work.

Intune · Azure Virtual Desktop · Microsoft 365 · Azure — assess, fix and build. As code where it counts, no drama.

Proof

Case studies: Azure Virtual Desktop and Intune as Code in practice

Promises are free. This is what actually happened.

Retail · 15,000 AVD users

−60% Azure costs

Jumbo via Conclusion Enablement · 2022–2023

Situation
An AVD environment for 15,000+ unique users a month, grown under pressure, with a monthly invoice nobody dared to open anymore.
Action
Operations and further development, automated scaling and targeted optimisation of infrastructure and resource usage.
Result
60% lower Azure costs. More stable and scalable, without a single user noticing.

Central government · Intune as Code at scale

Config as Code

Justitiële ICT Organisatie · 2023–present

Situation
Intune solutions that must be deployable across government clients, with strict compliance requirements. Hundreds of settings per tenant, and every client migration threatened to start from scratch.
Action
Tech Lead of the Intune team: configuration as code with Microsoft365DSC, rollout through Azure DevOps pipelines (export → review → deploy → drift check), quality assurance and coaching engineers in the new way of working. Migrations from intake to delivery.
Result
One reusable standard, repeatably deployable to every tenant. Quality assurance lives in the pipeline instead of in someone's head. Compliant with government guidelines.

Safety region · from on-prem to modern

24/7 critical

Safety Region Noord-Holland Noord · 2018–2022

Situation
The complete IT environment of a safety region: 24/7 critical, legacy on-prem, and an organisation that can never go offline.
Action
Migrations to Azure, Exchange Online and Azure Virtual Desktop. A new workplace on ECM + Intune, including co-management and MDM-only scenarios.
Result
A modern workplace for an organisation that knows no downtime — without the control room noticing a thing.

Built because I missed them myself

Free tools for the Microsoft and Apple workplace. No login, no fuss.

SherlogBrowser-based analyser for Intune Management Extension logs. Timeline analysis, device-health dashboards and a CMTrace-style log viewer — fully in the browser.sherlog.nl ↗PayloadKitSearch 250+ payloads and build or edit Apple Configuration Profiles (.mobileconfig) for macOS, iOS and tvOS — with ready-made export to Intune.payloadkit.app ↗
kris@mand-it: ~

Terminal

Mand-IT OS terminal. Type help, ls or open bewijs. Or sudo hire kris.
kris@mand-it:~$ 
Settings

Settings

Language
Theme
Appearance

On a large screen you choose between Windows and macOS, on a phone between iOS and Android.

About this device

Device name
visitor-pc
Managed by
Mand-IT
Compliance
✓ Compliant
Administrator
Kris Mandemaker
Enrolled
2021 · Mand-IT

Privacy & security of this site

Trackers
✓ None
Cookies
✓ None only localStorage for language, theme and appearance
Third-party scripts
✓ None
CSP
default-src 'self' no external sources, no frames
Headers
nosniff · frame-ancestors 'none' · Referrer-Policy
Vulnerability?
/.well-known/security.txt

Check for yourself: securityheaders.com ↗ · Mozilla Observatory ↗

Recycle Bin — Unnecessary complexity

Recycle Bin

Things I throw in the bin at clients:

  • Click-opsClicking around the portal by hand and hoping you'll remember it next time.
  • Golden images from 2014Autopilot exists. Use it.
  • PowerPoint architecturePretty pictures, no pipeline.
  • "Just a quick GPO"Nothing has ever been quick with a GPO.
  • Excel as CMDBTab 3 is the truth. Or was it tab 4?
  • "Works on my machine"Your machine isn't going to production.
  • Admin rights for everyoneConvenient. Until the first phishing mail.
  • 47 Conditional Access policies without namingCA policy (3) (copy) (new) (final).
  • "We've always done it this way"Not an argument, but a warning.
  • Knowledge in one headEven when that head is mine: I document and hand over.
  • Passwords in an Excel sheetTab "Passwords", right next to tab "CMDB".
  • Service account with Global AdminPassword never expires. That is not a feature.
  • "We'll do MFA later"Later is a date that never comes. Phishing does not wait.
Zero Trust Invaders — Patch Tuesday

Zero Trust Invaders

Your AVD host pool. Five session hosts, one Defender, four pipelines. How long do you stay compliant?

Zero Trust Invaders

Phishing, malware and drift rain down on your AVD host pool. Shoot them down as Defender, keep your hosts compliant in Intune and run your pipelines when things get hot. Every third sprint ends with a boss, then it is Patch Tuesday: catch the updates instead of shooting them.

avd-image-buildGolden image: all hosts restored

← → or A/D to move · space to shoot · Enter to deploy · P to pause. On a phone: drag across the field, shooting is automatic.

Your workplace ran into a problem that won't go away on its own.Your workplace needs to be restarted. Or just managed better.Your workplace is restarting…

0% complete

Kidding. You won't see this screen on my watch.

Stop code: WORKSPACE_CONSULTANT_NOT_FOUND. Recovery options: send me a message on LinkedIn or restart.

Fix it via LinkedIn →