Question

A logistics company operates a fleet of 4,000 rugged Windows-based handheld scanners used by warehouse staff. These devices are enrolled in Microsoft Intune, connect over cellular and Wi-Fi, and frequently operate in low-connectivity environments. Security architects must ensure each device continuously enforces a hardened OS configuration aligned to industry benchmarks, reports drift, and remains compliant before accessing corporate resources. Which approach best meets these requirements?

Accepted Answer

Apply Intune security baselines (Microsoft Defender for Endpoint and Windows baselines) as configuration profiles, and use Intune compliance policies as a Conditional Access requirement for resource access

Answer

Onboard the scanners to Azure Arc and apply Azure Machine Configuration (guest configuration) to enforce and audit the OS baseline

Answer

Deploy Microsoft Defender for IoT with a network sensor to passively monitor the scanners and alert on configuration anomalies

Answer

Enable Windows LAPS to rotate local administrator passwords and rely on Secure Score recommendations in Defender for Cloud to track hardening