← Selected work

Modernising Enterprise Endpoint Management at NHS Scale

Building a resilient SCCM platform and introducing Intune co-management across an estate of approximately 16,000 endpoints.

A critical platform that had outgrown its architecture

The existing SCCM environment managed approximately 16,000 endpoints across an NHS shared-service organisation. It had been through several upgrades, but the underlying architecture had not scaled with the wider operation. The platform remained a single-site deployment and had become a significant operational dependency: an SCCM failure had the potential to become a P1 incident.

The Operational Development Manager initiated a project to replace it with a more resilient environment. This was also an opportunity to introduce cloud management where it could solve practical operational problems.

Owning the endpoint-management implementation

I acted as Project Lead for the SCCM implementation, responsible for building and configuring the new endpoint-management platform and supporting the migration from the existing environment.

That distinction reflects how the project operated: I owned the endpoint side while working with infrastructure specialists where deeper platform expertise was required.

A greenfield replacement built for resilience

Rather than perform another upgrade of the existing environment, we built a greenfield replacement using two SCCM servers alongside two SQL database servers configured for high availability through a SQL Availability Group.

This addressed the resilience limitation without carrying the accumulated architecture of the previous environment into another generation. It also provided the foundation for Microsoft Intune co-management.

Using Intune where it solved a genuine problem

Application deployment was the main workload moved towards Intune. The choice was driven by a real service need rather than a desire to replace SCCM for its own sake.

Microsoft Store app requests were cumbersome to fulfil through SCCM because the team needed a workaround to obtain and package them. Enabling the application workload through co-management meant suitable apps could be delivered from either SCCM or Intune. For Store apps, a convoluted packaging process became a much simpler Intune deployment.

Modernisation did not mean discarding SCCM. It meant strengthening the platform while introducing cloud management where it provided a tangible operational advantage.

Staged deployment across approximately 16,000 endpoints

The migration scope covered approximately 16,000 SCCM-managed endpoints. A controlled rollout was essential, so deployment followed the organisation's existing pilot structure.

  1. Operational DevelopmentInitial technical validation
  2. Wider HISBroader service pilot under change control
  3. Trust early-pilot groupsBusiness validation across the trusts under change control

All stages after the initial Operational Development pilot were managed through formal change control. PowerShell was used as part of moving clients from the old SCCM environment to the new platform, allowing the migration to progress in controlled stages while the existing service remained available.

One strand of a broader workplace transition

Separate projects were running in parallel to develop an Autopilot provisioning model—an intermediary step towards fuller device-first and cloud adoption—and to migrate remote desktop services from RDS to Azure Virtual Desktop.

I was not involved in either of those projects. They are relevant here only as context: the SCCM and Intune work formed part of a wider organisational move towards modern workplace services.

A clear handover point

I was promoted into another role before the wider migration programme reached final closure, so I was not present for final completion or sign-off.

By the time I moved on, the new platform had been implemented and the migration was progressing through the organisation's staged deployment and change-control process. The project became an important step in my progression from infrastructure engineering into enterprise endpoint management, bringing together SCCM, SQL high availability, PowerShell, Intune co-management and enterprise change control at NHS scale.