Managed by Mand-IT

Workplaces that work.

Intune · Azure Virtual Desktop · Microsoft 365 · Azure — assess, fix and build. As code where it counts, no drama.

Services

Services: Intune, Azure Virtual Desktop, DevOps and consultancy

Workplace, DevOps and consultancy: six things you call me for.

Workplace

Intune · Azure Virtual Desktop · Microsoft 365

Modern Workplace & Intune

From sprawl to Intune as Code.

Sound familiar?
Your Intune tenant grew organically: hundreds of policies, three admins, zero overview. I turn it into a standard your own team can carry — Autopilot, compliance, device lifecycle, all as code and documented.
What you get
A tenant you dare to touch.
IntuneAutopilotMicrosoft365DSCMDEConditional Access

Azure Virtual Desktop & Azure

From cost leak to predictable.

Sound familiar?
AVD for thousands of users runs fine. Until the invoice arrives. I design and optimise Azure environments with Infrastructure as Code, autoscaling and monitoring. At a retailer with 15,000 users, 60% came off the Azure bill — without a single user noticing.
What you get
An invoice you can explain to Finance.
AVDAzureBicepFSLogixAutoscale

DevOps

Pipelines · Infrastructure as Code · Config as Code

CI/CD & Infrastructure as Code

From handwork to pipeline.

Sound familiar?
Your Azure environment was built by hand once and nobody dares to repeat what happened back then. I turn infra and rollout into Bicep and YAML pipelines in Azure DevOps or GitHub Actions — with reviews, approvals and environments you can rebuild in a single run.
What you get
A deploy you dare to start on a Friday afternoon.
Azure DevOpsGitHub ActionsBicepARMYAML

Config as Code & Automation

From click-ops to code.

Sound familiar?
Anything you do by hand three times belongs in code. Intune and Microsoft 365 configuration as code (Microsoft365DSC, Graph, PowerShell), rolled out repeatably to every tenant, with drift control and an audit trail. Even long after I'm gone.
What you get
No knowledge locked in one head.
Microsoft365DSCMicrosoft GraphPowerShellKQLGit

Consultancy

Assessment · Troubleshooting · Alongside your team

Environment assessment

From "it sometimes breaks" to knowing why.

Sound familiar?
Your environment runs, but not smoothly: slow logins, Intune policies that don't land, Conditional Access locking users out, an Azure bill nobody understands. I look at what's really there — tenant, devices, identity, infra — and come back with an honest list: what hurts, why, and what to tackle first. No eighty-page report, just a list you can start on tomorrow.
What you get
Knowing where you stand, and what comes first.
IntuneEntra IDAVDAzureMicrosoft 365

Troubleshooting & hands-on help

From fire to fixed. On my own or alongside your team.

Sound familiar?
A problem that has been open for weeks, a migration stuck halfway, or simply too few hands. I dig in: logs, Graph, the policy that's causing it. Fixing it myself when it's urgent, together with your admins when you want them to handle it next time. No everything-as-code project when a good fix is enough.
What you get
One problem fewer, and a team that knows how.
LogsMicrosoft GraphPowerShellKQLSherlog

Also: hybrid environments, migrations, security architecture (SC-100, SC-300), tech lead for your team or a few days a week inside your ops team.

kris@mand-it: ~

Terminal

Mand-IT OS terminal. Type help, ls or open bewijs. Or sudo hire kris.
kris@mand-it:~$ 
Settings

Settings

Language
Theme
Appearance

On a large screen you choose between Windows and macOS, on a phone between iOS and Android.

About this device

Device name
visitor-pc
Managed by
Mand-IT
Compliance
✓ Compliant
Administrator
Kris Mandemaker
Enrolled
2021 · Mand-IT

Privacy & security of this site

Trackers
✓ None
Cookies
✓ None only localStorage for language, theme and appearance
Third-party scripts
✓ None
CSP
default-src 'self' no external sources, no frames
Headers
nosniff · frame-ancestors 'none' · Referrer-Policy
Vulnerability?
/.well-known/security.txt

Check for yourself: securityheaders.com ↗ · Mozilla Observatory ↗

Recycle Bin — Unnecessary complexity

Recycle Bin

Things I throw in the bin at clients:

  • Click-opsClicking around the portal by hand and hoping you'll remember it next time.
  • Golden images from 2014Autopilot exists. Use it.
  • PowerPoint architecturePretty pictures, no pipeline.
  • "Just a quick GPO"Nothing has ever been quick with a GPO.
  • Excel as CMDBTab 3 is the truth. Or was it tab 4?
  • "Works on my machine"Your machine isn't going to production.
  • Admin rights for everyoneConvenient. Until the first phishing mail.
  • 47 Conditional Access policies without namingCA policy (3) (copy) (new) (final).
  • "We've always done it this way"Not an argument, but a warning.
  • Knowledge in one headEven when that head is mine: I document and hand over.
  • Passwords in an Excel sheetTab "Passwords", right next to tab "CMDB".
  • Service account with Global AdminPassword never expires. That is not a feature.
  • "We'll do MFA later"Later is a date that never comes. Phishing does not wait.
Zero Trust Invaders — Patch Tuesday

Zero Trust Invaders

Your AVD host pool. Five session hosts, one Defender, four pipelines. How long do you stay compliant?

Zero Trust Invaders

Phishing, malware and drift rain down on your AVD host pool. Shoot them down as Defender, keep your hosts compliant in Intune and run your pipelines when things get hot. Every third sprint ends with a boss, then it is Patch Tuesday: catch the updates instead of shooting them.

avd-image-buildGolden image: all hosts restored

← → or A/D to move · space to shoot · Enter to deploy · P to pause. On a phone: drag across the field, shooting is automatic.

Your workplace ran into a problem that won't go away on its own.Your workplace needs to be restarted. Or just managed better.Your workplace is restarting…

0% complete

Kidding. You won't see this screen on my watch.

Stop code: WORKSPACE_CONSULTANT_NOT_FOUND. Recovery options: send me a message on LinkedIn or restart.

Fix it via LinkedIn →