The challenge
Foundations run lean. Their IT gets attention when something breaks, not before. When Surdna moved to Advisory at the end of 2024, our onboarding audit found an environment that had quietly drifted out of control:
- Device management had stopped working. The Apple push certificate and the device enrollment and app purchasing tokens had all expired, so Jamf could no longer communicate with Surdna’s Macs.
- An aging fleet: 16 of 32 Macs were at or past the end of their recommended lifecycle, and 10 had not checked in for more than 30 days.
- No endpoint security tool, no industry-standard security baselines, and no central patching for third-party apps.
- Lapsed network security: the firewall’s advanced filtering and security services had expired in October 2024, wireless support had lapsed, and network services were split across three devices.
- Windows still tied to an on-premises domain controller that ran very few services.
What we did
Audit
A full picture, ranked by priority
We assessed Surdna’s Mac, Windows, network and identity environments, combining on-site and remote reviews, and gave each recommendation a priority.
Build
Rebuilt for the cloud
- Restored Jamf Pro’s connection to Apple.
- Rather than migrate the old on-premises setup, built a cloud-native Windows environment in Microsoft Intune from scratch, with security baselines, automated app patching, remote monitoring and Autopilot.
- Set up company iPhones and iPads for zero-touch enrollment, with Okta sign-in, an app catalog and restrictions.
Deploy
Moved, rewired and secured
- Moved Windows users onto the new Intune environment.
- Completed a network modernization, including new wiring and properly mounted access points, by the end of May 2025.
- In Okta, required Okta Verify MFA for every user, strengthened the password policy, required MFA for self-service password resets and blocked anonymizing networks.
Manage
Security and policy, ongoing
We later deployed Jamf Protect, giving the Mac fleet dedicated endpoint security. Most recently, we reviewed Surdna’s AI responsible use policy as the foundation began adopting AI tools.
The results
- Device management restored after Surdna had lost the ability to manage its Macs.
- A cloud-native Windows environment, with no dependence on an on-premises domain controller.
- A modernized office network, completed in May 2025.
- MFA required for every user, including for password resets.
- Dedicated endpoint security across the Mac fleet.
- [CONFIRM: total devices now under management across Mac, Windows and mobile]
- [OPTIONAL: a measurable improvement, such as patch compliance, ticket volume or WiFi performance]