The fix your last vendor said was
impossible
Endpoints that deploy themselves. Compliance that fixes itself. Packaging that just works. We build the automation that makes your IT team's hardest week look like a quiet one.
Need experienced hands on your own roadmap instead? Talent placement is a separate offering →
Quiet infrastructure, loud results
Custom-architected solutions for defined endpoint engineering projects and remediation efforts. Bring us a scoped problem — a tenant to stand up, a deployment that's been stuck, a compliance gap, a manual process burning hours every week — and we'll design, build, and hand off the fix.
Intune & Autopilot
New tenants built the right way. Inherited tenants brought up to spec. Zero-touch provisioning, configuration profiles, app deployment, and ESP screens that actually finish.
PowerShell Automation
From one-off cleanup scripts to signed, production-ready modules with logging, error handling, and tests. Code that's safe to re-run, easy to audit, and built to outlast the engineer who wrote it.
Win32 App Packaging
Detection rules that work, install scripts that don't loop, and intunewin packages QA'd against real hardware. Vendor MSIs wrangled into compliant deployments.
Endpoint Hardening
CIS-aligned baselines, BitLocker, Defender for Endpoint tuning, ASR rules, and compliance reporting your auditors will actually accept the first time.
Win11 Migrations
Hardware audits, app compatibility, image strategy, and phased rollouts. We handle the 5% of edge-case endpoints that derail every migration.
Mac MDM Migrations
Moving Mac fleets off Jamf, Kandji, Mosyle, or any other MDM, into Intune. Fresh configuration profiles, clean device records, FileVault re-escrow, app deployment, and the automation to manage MacOS alongside Windows in one console.
Custom Compliance & Automated-Remediation
Make literally anything a compliance factor — registry keys, files, certificates, running services, app versions, anything else a detection script can read off an endpoint.
Detect, decide, remediate. Custom detection scripts feed directly into Conditional Access Policy decisions, paired with automated-remediations that quietly bring devices back into line before users even notice they drifted.
Devices self-correct in the background. The helpdesk only hears about the cases the automation can't fix on its own.
Already built. Ready to deploy.
Production-ready automation we've already designed, built, and shipped. Each one solves a problem we've watched IT teams wrestle with over and over, and each drops into your environment in days, not weeks.
MFA & SSO Automated-Remediation
Azure Automation runbook that pulls Entra sign-in logs daily and flags users pelted with 10+ MFA prompts a day from misaligned Conditional Access Policy. It also surfaces the systemic reasons "fully SSO" tenants still see auth prompts — browsers not configured for WAM, devices Entra-registered instead of joined, missing Chrome and Edge policies, broken trust. The 10-per-day threshold is tunable. Findings feed back into the same pipeline for automated remediation, with an email to whatever team you choose recapping the actions taken and any outliers with no known cause.
Primary User Automated-Assignment
Azure Automation runbook that pulls 30 days of sign-in data for every device in Entra ID, identifies non-shared endpoints where a single user accounts for 60%+ of all sign-ins, and automatically sets that user as the device's primary user in Intune. Keeps user-targeted policies, Company Portal context, and app assignments accurate, without the manual cleanup nobody on the helpdesk wants to own.
Automated Password Reset Notifier
Azure Automation runbook that scans Entra ID for users whose passwords expire within the next 14 days and emails each one a personalized reminder with step-by-step reset instructions. Runs on a schedule, requires no end-user agent, proactively cutting the lockout-ticket flood before it starts.
Automated Autopilot Pre-flight Check
Azure Automation runbook that sweeps every Autopilot Enrollment Status Page in the tenant, new and existing, on a fixed cadence. Validates image hashes, deployment profiles, group assignments, ESP timeouts, Conditional Access scoping, app dependency graphs, language pack coverage, and provisioning conflicts against a known-good baseline. Drift, failed assignments, and new-deployment conflicts surface as alerts the moment they appear — caught and resolved before the next device ever reaches a user.
Automated Local Admin Access In development
Currently in active development. The architecture below is locked and being built now — want it on your fleet first? Tell us and we'll loop you into the early-access pilot.
Replaces manual local-administrator provisioning with a closed-loop, self-service workflow. No technician ever touches the device.
Request, reconcile, enforce. Users submit an admin request through ServiceNow or any ticket system that allows API calls. On approval, an Azure provisioning identity writes the grant to an AAD-authenticated Allow List blob and adds the device to an Entra exclusion group that suppresses the default admin-removal policy. An hourly script on the endpoint calls a Function App proxy to Microsoft Graph for the device's Primary User, then continuously reconciles the local Administrators group against the approved set. A scheduled Azure Runbook revokes stale grants.
The same architecture adapts directly to an automated EPM rollout with minimal change.
Discovery to handoff, in four phases
How a Service engagement runs. (Talent engagements follow their own cadence; see the Talent section below.)
Discovery
Tenant audit, environment review, and a written scope. You'll know exactly what we're building before a line of code ships.
Design
Architecture, runbooks, and rollback plan. Reviewed with your team so nothing lands as a surprise on a Friday afternoon.
Build & Pilot
Build in a sandbox, pilot to a ring, instrument logging. We don't go wide until the pilot ring is boring.
Handoff
Documentation your team can actually read, knowledge transfer sessions, and 30 days of post-go-live support.
Placement is the start, not the deliverable
A separate offering from our project work. We place senior engineers and architects into client teams to work on your roadmap — your tools, your priorities, your codebase. Most contract shops drop a resume on your desk, place a body, and disappear until the invoice. There's no oversight, no mentorship, no feedback loop — and quietly, no real way to know if the work being shipped is any good. We've spent careers as the engineer on the other side of those engagements. Cloud Forge Talent is the staffing model we wished existed.
Place a body. Send the invoice. Move on.
- Resume drop, then radio silence after the start date
- No technical oversight of the work being delivered
- Issues surface at the quarterly review — months too late
- Engineer isolated, no growth path, no advocate
- Process feedback flows one way, if at all
Hand-picked. Actively mentored. Never left on an island.
- Weekly 1 on 1s with the engineer and the client, every engagement
- Senior Architect mentors the engineer, reviews work and helps guide them through blockers as they happen
- Issues surface in week one — not at the quarterly review
- Growth plan baked into every engagement, not bolted on after
- Bidirectional process feedback delivered to the client every week
What's actually included
Weekly Check-ins
30-minute syncs with engineer and client every week. Real conversation, not status theater. Logged, actionable, followed up on.
Active Mentorship
Every placed engineer is paired with a senior practitioner who reviews work, helps guide them through blockers, and grows their craft alongside the engagement.
Process Feedback Loop
What we see inside your environment, we tell you. Methodology gaps, tooling friction, hidden bottlenecks, all surfaced weekly with recommendations.
Growth Roadmap
Every engineer has a written development plan tied to the engagement — certs, skills, architecture exposure. They leave sharper than they arrived.
Forged from real infrastructure
Cloud Forge Automation was built from years inside enterprise IT — packaging apps that fail at 3am, debugging Autopilot ESP screens that never finish, and writing the PowerShell that nobody else wanted to touch.
We're not a generalist MSP. We don't do helpdesk, we don't resell licenses, and we don't pad invoices with junior engineers. We run two distinct lines of business.
Service: we architect custom endpoint and automation solutions for clients with a defined project or remediation effort.
Talent: we place senior engineers and architects into client teams to work on their roadmap, with active mentorship throughout.
The two can coincide on the same engagement. They don't have to, and we never pretend they do.
If your Intune tenant feels held together with tape, your packaging takes a week per app, or the contractor you placed last quarter has gone quiet, that's the work.
Proud sponsor & creator of IntuneNerds
Beyond client work, Cloud Forge Automation builds and funds IntuneNerds — a free, field-tested knowledge base and toolset for modern endpoint management. Same engineers, same production fleets; everything we learn, written down and handed back to the community.
373 deep-dive guides across iOS, Android, Windows, and macOS — with the failure modes the official docs leave out, written and maintained by working endpoint engineers. Free for everyone, forever.
Intune Simulator
A full Intune console in the browser. Build configuration profiles, query device records, and run endpoint analytics, diagnostics, and remediations — no tenant required.
Decision Center
78 interactive decision tools across the full endpoint lifecycle, with guided journeys and the rationale behind every recommendation — from "should I?" to a defensible call.
MD-102 Study Lab
Exam-ready MD-102 prep — 191 practice questions, 175 flashcards, and a readiness tracker mapped across all 39 exam objectives.
Open-Source Toolbox
144 field-tested open-source tools for endpoint engineers — packaging, diagnostics, imaging, and remediation — curated and organized by job across Windows, macOS, iOS, and Android.
Got an endpoint problem, or a placement, that nobody wants to own?
Walk us through it. We'll come back within one business day with design notes, scope, and a clear path forward.