“I’ve always dreamt of being an engineer, and at the time engineering was not a common path for girls in our community,” she says. “But I was always encouraged by my parents and my teachers to pursue my ambitions.”

With the “unwavering support” of her mother, father, and community, those ambitions have led her to a thriving career in software engineering in IT at Microsoft. Priya now works on AI-powered employee experiences, Copilot agents, and enterprise solutions that improve the ways people interact with technology.

From her first day in Microsoft Digital—the company’s IT organization—in 2021, Priya learned to embrace a culture of ownership, working closely across disciplines to support her colleagues.

“At Microsoft, you are always a full-stack engineer,” Priya says. “You’re not a back-end developer, you’re not a front-end developer, you’re not a dev ops engineer—you are everything. And that was a great thing to know. You do not just own one part of the application, you own everything. That gives you a sense of responsibility.”

Forging a career path at an early age

That sense of responsibility, ownership, and leadership started for Priya within her own family. Her mother has a master’s degree in architecture, and Priya grew up seeing how education, leadership, and perseverance could open doors for a family and a community.

Priya carried that lesson into school. She had excellent grades in high school and earned admission to the computer science and engineering program at NIT Jalandhar, a well-respected engineering institute. Entering this field still felt like a challenging step for Priya.

Her early career experiences gave her a broad view of how software supports different kinds of businesses. At Publicis Sapient, she worked across e-commerce, fintech, and retail customers. Moving on to Expedia Group, Priya worked as a software development engineer on large-scale systems serving customers globally.

Learning the Microsoft way of engineering

Joining Microsoft nearly five years ago meant learning a new technical stack and a different operating model. Priya came from a Java and Python background, learning .NET and C# as she moved into the company’s engineering environment.

“A growth mindset means being comfortable with being uncomfortable. Every major step in my career happened when I chose to leave something familiar and challenge myself to learn something new.”

Kanu Priya, software engineer, Microsoft Digital

The bigger shift was not about the language or framework, but a change of mindset. It was the expectation that an engineer should understand the customer problem, build the solution, monitor production health, and keep improving the experience after release.

“A growth mindset means being comfortable with being uncomfortable,” Priya says. “Every major step in my career happened when I chose to leave something familiar and challenge myself to learn something new.”

That philosophy matched the way Amit Raghuwanshi, a principal software engineering manager at Microsoft, describes Priya’s approach to her work. Priya has been part of Raghuwanshi’s team for more than four years, keeping up as the work ranged across asset management, ServiceNow development, and—more recently—agentic development using Azure AI Foundry and Copilot Studio.

“Throughout this journey, we keep changing the tech stack and the challenges, and Kanu has shown a really good growth mindset,” Raghuwanshi says. “She’s always willing to take on new challenges in whichever tech stack it may be.”

For Priya, ownership also means staying connected to what happens after the first release.

“Microsoft taught me that engineering doesn’t end when the code is written,” she says. “Real ownership means understanding the problem, delivering the solution, supporting it in production, and continuously improving the experience for customers.”

Building experiences with AI agents

Priya’s current work brings that ownership model into the world of AI-powered employee experiences. She contributed to the development of our Employee Device Information agent, a self-service experience that helps Microsoft employees manage primary devices and correct inaccurate device information and assignments.

The work matters to our organization, because device data can create friction for employees and support teams when it’s wrong or difficult to update. The agent reduced 70% of manual effort for support teams and BPO organizations by automating work that previously required human intervention.

Priya also contributed to the first version of a purchase experience agent that helps employees explore available devices, compare options, and understand recommendations based on employee persona and company requirements. Then they can move through device selection using a unified, conversational experience.

Raghuwanshi points to the enterprise device work as an example of Priya’s ability to learn quickly and work from the problem outward. Priya was part of that work from the very beginning, helping launch the agent with Copilot Studio so employees could answer device questions and resolve requests quickly.

“The AI era is one of the most exciting shifts I’ve seen in technology. It isn’t just helping us work faster; it’s helping us reimagine how we solve problems and create experiences for people.”

Kanu Priya, software engineer, Microsoft Digital

Microsoft dev teams are also changing how they approach solving future problems. Raghuwanshi says AI is now part of the software development lifecycle, from requirements and specifications through code and deployment. The power of AI has also added a new design question for just about any business process: Can an agent help solve this?

Priya sees that change as more than just a productivity gain.

“The AI era is one of the most exciting shifts I’ve seen in technology,” she says. “It isn’t just helping us work faster; it’s helping us reimagine how we solve problems and create experiences for people.”

Today, Priya is working on next-generation multi-agent experiences that bring device selection and purchasing workflows directly into Microsoft 365 through Copilot-powered experiences.

Raghuwanshi connects that work back to the same trait that brought Priya into engineering in the first place: Agility.

“She is a very fast learner,” Raghuwanshi says. “You give her a new problem and she quickly adapts, then starts showing further curiosity.”

Priya’s promotion in 2023 was an important career milestone, and she credits mentorship from Raghuwanshi and support from teammate Shreekantha Tarikere Indraiah as important factors in that growth.

Helping others follow her path

Priya’s story circles back to Nangal-Shama. During a recent visit home, a young woman from her neighborhood told her, “I want to be like you; I want to be where you are one day.” She says the moment filled her with pride.

“I think that’s what matters: clearing paths for the kids who can dream big,” Priya says. “I always want to make sure people from my hometown are getting resources and opportunities.”

For Priya, this is what it means to succeed at Microsoft—and beyond.

“I think success is not about reaching a destination,” she says. “It’s about continuing to grow, learn, and create opportunities for others along the way.”

The post Building a career in IT with a growth mindset: Kanu Priya’s Microsoft journey appeared first on Inside Track.

That’s certainly true for Doug Pierson, a recently retired US Marine Corps Major General who manages our Microsoft Executive Support Team. As part of that role, he works with our company’s senior leaders and created an Executive Cyber Defense service offering to assist them with protecting themselves and the company from Malicious Cyber Actors (MCAs).

“Yes, this is a different situation, but not so much that the lessons don’t apply. We need our executives to be very vigilant.”

Doug Pierson, senior director of IT Service Management, Microsoft Digital

While serving in the U.S. Marines, one of his assignments was deputy commander of Marine Corps Forces Cyber Command, U.S. Cyber Command, where he led multiple Joint Task Forces protecting the United States worldwide from cyber and asymmetric threats via nonstop offensive and defensive cyber operations. At Microsoft, he and his team have created a service offering that is founded on his time in direct contact with near peer and other adversary MCAs to help our executives protect themselves and the company from cyber threats that they face.

The attackers and battlefields may be different, but the concept is the same.

“Yes, this is a different situation, but not so much that the lessons don’t apply,” says Pierson, now a senior director of IT Service Management in Microsoft Digital, the company’s IT organization. “We need our executives to be very vigilant.”

As technology advances and proliferates, so too do the different ways that MCAs hack into businesses.

Executives—and the people around them, such as executive assistants, chiefs of staffs, and other closely aligned administrators—are particularly vulnerable to cyberattacks. As criminals look to access trade secrets, impersonate individuals, and use sensitive or confidential information for malicious means, we’ve seen an expansion in their unique approaches to finding and exploiting vulnerabilities.

Recently, Pierson and our Executive Support Team saw an opportunity to scale up how we protect our leaders’ communications and data, with approaches tailored to each person’s workflows and potential vulnerabilities.

They tackled the problem from three angles:

1. People. Besides Microsoft executive leadership, we advise support staff, clients, client stakeholders, and anyone else who might unintentionally create access vectors that lead bad actors to our executives.
2. Places. Many of our executives travel to high-risk locations that require proactive security measures. We also take into consideration whether a destination has Microsoft infrastructure in place, making it safer. Areas without Microsoft infrastructure might leave someone vulnerable. Airports, for example, might require you to sign onto a public Wi-Fi network or put you at risk of “shoulder surfing,” meaning someone looking at your laptop and gaining access to sensitive information. Our Executive Support Team provide awareness of how to safely navigate through these locations, while partnering with our Executive Protection Unit to enable a multilayered virtual and physical cyber shield while on the road.
3. Things. No matter who the staff member is and where they’re located, we ensure they have devices that are updated with the latest software, functional for mobile use, and include secure measures like cloud backup or VPN. We set them up with travel routers, provide insight on IoT home network devices, and offer support for other tools that secure communications and internal information.

As we continue to refine and build out our operating principles for executives that allow them to conduct business safely from any device and location, we learned several key lessons along the way. In simplest terms, executive support regularly ties in with an internal partnership on executive cyber protection in a “triad”:

• Our Executive Support Team maintains cyber security in proximate access: coordinating directly with the executives and their teams on IT security practices, devices, travel, and immediate concerns.
• Our Executive Protection Unit maintains physical security overwatch for executives in the office and during travel—most notably when in a high-risk area.

Lesson 1: Partner with your CISO team

Our team works with the Microsoft Office of the CISO to monitor and consistently review network and account activity on-net, and off-net for anomalies.

Our initiative has been a success in large part because we set clear, easy-to-follow guidelines and invested time and resources into educating staff on those guidelines. As an example, we deliver quarterly Protect Your Tech upskilling sessions that routinely attract 20 executive assistants (EAs), who learn about things not readily apparent as well as how to find cyber protection capabilities via Executive Support or other teams within Microsoft.

“It started with a foundational set of tips and tricks due to very real and specific need, given active targeting of the Executive Admin community and how much passion EAs have around protecting their executive on multiple levels,” Pierson says.

In newsletters, informational booklets, and the regularly offered Protect Your Tech sessions, we discuss the foundational importance of using multifactor authentication (MFA), strong passwords, keeping devices updated, and avoiding untrusted Wi-Fi networks. We then go from there into more specific measures.

“We provide executives with a secure physical device enabled with Cloud PC, a system that essentially mirrors their primary computer within a highly secure virtual environment.”

Nolan Mitchell, IT service manager, Microsoft Digital

We also regularly educate support staff on how to manage their devices with Entra ID or Intune, save files to OneDrive and SharePoint, and identify scam links or fake accounts.

In addition, we meet with executives prior to travel to high-risk locations, setting them  up with a secure environment in advance of their trip.

“We provide executives with a secure physical device enabled with Cloud PC, a system that essentially mirrors their primary computer within a highly secure virtual environment,” says Nolan Mitchell, an IT service manager in Microsoft Digital.

That means that if a device is lost or stolen, data is designed to remain accessible through the cloud rather than being stored locally on the device.

“We’re seeing governments put laws and policies in place that enable them to view what is on your devices, so we remind our folks that those laws and policies exist, and that they should be mindful or give very specific guidance related to traveling with their devices.”

Elias Gonzales, director of executive protections, Global Security

We also might advise them on what they shouldn’t bring with them.

“We’re seeing governments put laws and policies in place that enable them to view what’s on your devices, so we remind our folks that those laws and policies exist, and that they should be mindful or give very specific guidance related to traveling with their devices,” says Elias Gonzales, a director of executive protection in Microsoft Global Security.

This strong foundation has led to our team being more proactive before a threat emerges, rather than being reactive to attacks that might have already impacted them.

“The fact that folks are engaging us regarding security, for high-risk travel briefs, and to understand the environment they will be operating in before they start moving around—that’s a good thing,” Mitchell says.

Lesson 2: Collaboration is the way

It’s all about working together.

“We realized early on that leveraging our expertise and collaborating across organizations would make our initiative way more effective,” Pierson says.

Much of Pierson’s work at Microsoft Digital, for example, is informed by his extensive experience commanding offensive and defensive cyber units in the Marines.

Likewise, Asaf Kashi, a Microsoft vice president and deputy CISO, taps into his deep knowledge and experience leading teams that maintain Microsoft capabilities, systems, and tool security.

“We notify and involve executives on threat actors and actions around areas of ownership. We tell them,‘Here’s how to keep yourself and your team secure in an agile environment.’”

Asaf Kashi, vice president and deputy CISO

Collaboration across physical and digital security is crucial.

“I think sometimes the can be very siloed, but increasingly, there’s this understanding across Microsoft that it’s a blended threat—you can’t be good at one and ignore the other,” Gonzales adds.

Equally as important is the third arm of the triad: executive support.

Our Executive Support Team also works closely with other executive teams, both within the Microsoft universe (LinkedIn Executive Support as an example) and at other companies via showcase opportunities, to trade best practices.

“We notify and involve executives on threat actors and actions around areas of ownership. We tell them, ‘Here’s how to keep yourself and your team secure in an agile environment,’” says Asaf Kashi, a Microsoft vice president and deputy CISO.

Lesson 3: Stay vigilant and proactive

Cybersecurity is a rapidly moving target, which means we have to stay on top of the latest hacks and trends.

“It changes fast,” Mitchell says. “You need to be dynamic to keep ahead of MCAs.”

One way we do this is by reviewing case studies of attacks and benchmarking our security protocols against our peers and partners.

“It really does involve engagement with the industry and having a pulse on what’s going on there,” Gonzales says.

We also have to remind staff to remain vigilant in even the safest of environments.

“People are the easiest and most vulnerable link in the chain,” Pierson says. “You have to constantly remind yourself to be alert.”

This may mean trading some conveniences for peace of mind.

“Security is intended to be an inconvenience,” Gonzales says. “If it’s an inconvenience for you, it will be for bad actors. And so we need to accept the criticality of it, and do as we’re asked to do when it comes to our devices and our data.”

The post Keeping leaders safe from cyber actors: Three lessons learned from our experience at Microsoft  appeared first on Inside Track.

• Introduction: Understanding device readiness and lifecycle
• Chapter 1: Plan and standardize
• Chapter 2: Acquire
• Chapter 3: Onboard
• Chapter 4: Operate
• Chapter 5: Optimize
• Chapter 6: Refresh or reassign
• Chapter 7: Retire
• Conclusion

In a global organization such as Microsoft—with more than 220,000 employees connecting and working together from offices and remote workspaces scattered around the world—we enable our workers to stay productive from almost anywhere, on a wide range of devices.

At Microsoft Digital, the company’s IT organization, we provide our employees with that flexibility while helping keep the devices they use secure, compliant, and supportable at enterprise scale.

“Every digital experience depends on the readiness of the devices our employees use every day. Organizations that treat device management as a strategic lifecycle capability rather than a series of operational tasks are better positioned to adapt to change, reduce risk, and take advantage of new innovations with confidence.”

Brian Fielder, vice president, Microsoft Digital

We balance employee experience, security posture, and operational efficiency as part of modern device management.

This IT playbook explains how we think about device readiness at Microsoft Digital, where we serve as Customer Zero for the company. It covers the tradeoffs we manage, the lifecycle patterns that hold up over time, and the signals we monitor to understand whether we’re reducing risk or quietly accumulating it.

We also share resources you can use to apply modern device management in your own enterprise.

“Every digital experience depends on the readiness of the devices our employees use every day,” says Brian Fielder, vice president of Microsoft Digital. “Organizations that treat device management as a strategic lifecycle capability rather than a series of operational tasks are better positioned to adapt to change, reduce risk, and take advantage of new innovations with confidence.”

Understanding device readiness and lifecycle

Effective device readiness must be sustained across the full device lifecycle, from planning and acquisition through operation, refresh, and retirement. In an enterprise environment, a device is considered ready only when we can:

• Identify it and confirm ownership
• Govern it through identity and policy
• Keep it secure and compliant over time
• Support and recover it when something goes wrong
• Remove it cleanly when its role ends

When these conditions work together, device readiness becomes an operating advantage. We can move employees onto approved devices faster, enforce security and access requirements more consistently, and make lifecycle decisions with better data and less guesswork. The result is a device estate that is manageable, trustworthy, and productive at enterprise scale.

The device lifecycle model

At Microsoft Digital, we use the device lifecycle as a control system for readiness. We connect decisions, standards, and signals across the full lifecycle, so we can manage readiness over time rather than just check on it at isolated points. Each stage reinforces the next, and any issues show up early enough for us to correct them before they spread.

The stages serve specific functions:

• Plan and standardize: Sets the device standards and guardrails that make the rest of the lifecycle workable at scale.
• Acquire: Brings devices in as approved enterprise assets that can be tracked and managed from the start.
• Onboard: Gets employees up and running quickly through automated setup and policy-driven enrollment.
• Operate: Ensures devices are secure, up-to-date, and dependable over time.
• Optimize: Uses telemetry to reduce friction and improve how the lifecycle performs.
• Refresh or reassign: Keeps devices useful longer by replacing or repurposing them before they become a problem.
• Retire: Removes devices cleanly so access is closed off, data is protected, and disposition is complete.

The device lifecycle is a durable operating model that we manage holistically. Weakness in any phase often appears after the original decision was made and far from the point where the issue began.

We describe each lifecycle stage using the following structure:

Readiness question

What must be true at this stage to enable readiness

What good looks like

Our outcome-oriented goals for the stage

Signals

How we identify drift or technical debt

Microsoft Digital operating practices

Systems and processes we use internally to make this stage durable and repeatable

Stakeholder lens

Who contributes or has expectations at this stage

Being Customer Zero

How we stress-test internally in Microsoft Digital and learns at scale

Chapter 1: Plan and standardize

In this stage, we define the standards, controls, and supported patterns that make the rest of the device lifecycle manageable. Good planning reduces downstream exceptions and gives later stages a more stable foundation.

Readiness question

Are our device standards enforceable in practice, and do they reduce downstream cost, risk, and fragmentation?

What good looks like

Clear, role-based device standards limit variance and make onboarding and support repeatable at scale. These standards are grounded in capabilities that our platforms and tools can enforce, not aspirational policy language.

Signals

Signals help us detect when a lifecycle stage is falling out of alignment with its intended outcomes, becoming harder to manage, or creating downstream cost and complexity. These signals include:

Exception rates that grow over time (more devices falling outside supported standards), which later shows up in higher support costs and weaker servicing consistency.

Policies that are documented but not enforced through device health and access controls, including modern management capabilities such as Intune compliance policies and Conditional Access. Some examples are minimum OS requirements, encryption standards, and Microsoft Defender health. Documented but unenforced controls create “paper compliance” instead of true operational compliance.

Device and OS coverage statements that become hard to verify. This could manifest as device counts, OS mix, and ownership mix becoming directional rather than telemetry-backed, which weakens credibility and decision making.

Microsoft Digital operating practices

These practices show how we design the operating model to make the target state durable and repeatable. They represent the baseline decisions we make around rollout control, visibility, and enforcement to help prevent drift before it emerges.

• Early partnership with chip providers such as Intel, AMD, Qualcomm, and NVIDIA enables upstream testing, validation, and feedback on next-generation hardware. As Customer Zero for the Windows product group, our team in Microsoft Digital co-develops and is an early adopter of the Copilot+ PC experience, so readiness, performance, and security are tested and proven before fleet-wide deployment.
• For Windows devices, readiness standards are anchored to enforceable hardware and security capabilities, including TPM 2.0, Secure Boot, Microsoft Pluton, Credential Guard, and Windows Hello for Business compatibility.
• Devices are sourced from approved OEM catalogs and built to order, then validated against supported firmware, BIOS or UEFI, driver configurations, and setup experience. This approach reduces downstream support, servicing risk and providing white-glove device preparation while supporting a consistent, secure out-of-box experience.
• Apple (macOS/iOS) readiness is anchored to managed enrollment, encryption (for example, FileVault on macOS), and phishing-resistant sign-in via Platform SSO and passkeys.
• Android readiness requires Android Enterprise Work Profile support, verified device integrity (not compromised), and minimum OS and security patch levels enforced via MDM posture and Conditional Access.

Stakeholder lens

The following stakeholder groups shape planning, depend on its outcomes, and can detect misalignment quickly when expectations drift:

Employees

Benefit from clear, role-appropriate device expectations.

Endpoint engineering

Defines standards and automation foundations.

Security

Partners on baseline posture and control requirements.

Procurement and finance teams

Influence catalog decisions and lifecycle cost models.

Being Customer Zero

Before broad deployment of new capabilities, enterprise endpoint teams and product groups align on an enterprise readiness contract that spans trust and safety, manageability, and recoverability. We validate identity-bound access and tenant trust boundaries early, so we don’t introduce unmanaged enterprise risk.

Chapter 2: Acquire

In this stage of device lifecycle management, we bring devices into the environment as known, trackable enterprise assets. The goal is to make sure every device enters the lifecycle with the identifiers, registrations, and sourcing controls needed for clean provisioning and management.

Readiness question

Are devices known, owned, and visible before employees need them?

What good looks like

Procurement and asset registration are predictable and integrated, ensuring devices enter the environment as known enterprise assets, already associated with inventory systems and ready for automated provisioning.

Signals

These signals show where breakdowns in sourcing, registration, or asset control can create problems later in the lifecycle.

Procurement lead times cause day-one onboarding delays when devices arrive before they are ready for provisioning.

Inventory and asset records drift from reality, causing organizations to lose a single source of truth for device status, ownership, and lifecycle stage. This can create gaps in offboarding, recovery, and audit evidence.

Devices reach employees before registration is complete, such as when Autopilot or Apple Business Manager registration isn’t done before delivery. This forces catch-up work and introduces exceptions.

Microsoft Digital operating practices

These practices show how we design the operating model to make the target state repeatable:

• Acquisition readiness and zero-touch deployment begin with an integrated sourcing and provisioning model. This model defines how we source and acquire devices globally, apply persona-based configuration, fulfill local language requirements, and preload the latest supported operating system and drivers.
• When devices are delivered, they arrive asset-tagged, bundled, and preregistered with Windows Autopilot. This enables a consistent, secure, hands-off setup experience from first power-on.
• Acquisition readiness is tied to asset registration and inventory accuracy. Corporate devices are registered at purchase, associated with enterprise asset identifiers, and tracked continuously from order through retirement.

Stakeholder lens

These groups influence acquisition decisions and depend on those decisions being accurate, timely, and supportable:

Procurement and finance

Own sourcing and logistics.

IT

Validates compatibility and enterprise readiness.

Security

Advises on supply chain and trust considerations.

Being Customer Zero

Our early adoption program accelerates learning while preserving governance. We operate under explicit guardrails, including security posture, data boundaries, and regulatory requirements, so speed doesn’t bypass enterprise controls.

Chapter 3: Onboard

In this stage, we turn a device into a usable, trusted work endpoint through automated setup, enrollment, and policy enforcement. A strong onboarding experience helps employees become productive more quickly without weakening identity or compliance controls.

Readiness question

Can employees be productive on day one, experiencing minimal friction without bypassing identity, policy, or compliance?

What good looks like

Onboarding is fast, predictable, and largely hands-off for IT while remaining identity-bound and policy-driven. Day-one productivity comes through repeatable automation rather than exception handling.

Signals

These signals tell us when onboarding is becoming inconsistent, support-heavy, or harder to scale cleanly:

“Time to productive” increases or varies significantly (the onboarding path is no longer repeatable at broad scale).

Enrollment Status Page (ESP) failures increase (setup blocks, app install delays, and policy install failures).

Enrollment-related support calls or tickets rise during onboarding windows, indicating that friction is shifting from automation to human support.

Post-onboarding surveys and helpdesk ticket analysis show declining satisfaction or repeated “same issue” patterns.

Bring-your-own-device (BYOD) enrollment confusion increases as employees are unclear on what’s managed, what data is collected, or what happens when access is revoked.

Microsoft Digital operating practices

These practices show how the operating model makes the target state repeatable:

• Devices are approved and certified before reaching employees. Corporate Windows and Apple devices are sourced from approved OEM catalogs and registered through Windows Autopilot or Apple Business Manager, then associated with user identities and asset systems.
• For Windows devices, Autopilot registration occurs via OEM or partner APIs whenever possible; manual hardware hash registration is reserved for exceptions. Assigned Autopilot profiles define Entra ID join behavior, Intune enrollment, Out‑of‑Box Experience configuration, required applications, and baseline policies.
• The Enrollment Status Page acts as a gate that can’t be bypassed. Devices cannot be used until required apps, updates, and policies are successfully installed. If setup fails, reset is blocked, and errors are captured for IT remediation.
• Apple Business Manager is used exclusively for corporate‑purchased Apple devices; personally owned Apple and Android devices follow Intune BYOD enrollment paths. Android devices enroll using the Android Work Profile mechanism; Google Zero Touch is not used in this environment.
• Before access to corporate resources is allowed, devices must meet certification requirements, including Intune enrollment, encryption (BitLocker or FileVault), supported OS versions, Defender for Endpoint health, and required hardware security capabilities. Conditional Access enforces these requirements at sign‑in.
• Virtual onboarding options such as Azure Virtual Desktop are used for contractors, regulated roles, or temporary fallback access.

Stakeholder lens

These groups own setup, experience the outcome directly, and rely on tight alignment for onboarding to work smoothly:

Employees

Expect a power-on-and-go experience.

IT

Owns provisioning automation and exceptions.

Identity and security teams

Validate trust and access enforcement.

Being Customer Zero

The readiness contract explicitly validates manageability, zero-touch onboarding readiness, and identity enforcement before capabilities advance beyond early internal cohorts.

Chapter 4: Operate

In this stage, we keep devices secure, current, and reliable through ongoing servicing and operational discipline. The aim is to maintain a stable experience over time while minimizing manual intervention and operational noise.

Readiness question

Can devices remain secure, reliable, and current over time without constant manual intervention, and can known vulnerabilities be remediated quickly without manual escalation?

What good looks like

Continuous servicing and support preserve productivity while minimizing operational noise and exposure windows.

Signals

These signals help us see when operations are getting noisier, less predictable, or more reactive than they should be:

Update compliance thresholds are missed, meaning more devices are at risk because of outdated patches or repeat failure patterns.

Rollbacks, pauses, or halted rollouts become frequent, which indicates that the ring and validation strategy isn’t catching issues early enough.

Helpdesk tickets trend upward for update failures or device remediation (operational noise is rising instead of staying quiet).

Firmware- or driver-related instability increases, which requires additional validation, staging, or rollback controls.

Zero-day response requires repeated emergency actions; this signals that baseline update hygiene isn’t consistently holding.

Microsoft Digital operating practices   

These practices show how we design the operating model to make the target state durable and repeatable:

• Windows Autopatch: Provides a single, integrated update management experience in Intune. It combines Windows Update for Business policy-based controls with automated, telemetry-driven deployment across staged rollout waves, including built-in issue detection, pause, and rollback capabilities.
• Windows Hotpatch: Helps reduce disruption by applying certain security updates without requiring a restart, which supports continuity for eligible devices.
• Intune Vulnerability Agent: Extends vulnerability visibility and supports coordinated remediation through device management workflows.
• Enterprise App Management: Gives us a structured way to manage application deployment, updates, and policy alignment across managed devices.
• Update Compliance: Via Azure Monitor, it provides insight into installation rates and failure patterns, triggering remediation workflows when thresholds are crossed. Firmware and driver updates are validated with OEM partners and staged using the same ring-based deployment model.
• Minimum OS requirements: Non-Windows devices must meet minimum operating system requirements, encryption standards, and endpoint protection requirements before they can access corporate resources. These are enforced by Intune compliance policies and Conditional Access.

Stakeholder lens

These groups keep the environment running smoothly and depend on that stability every day:

Employees

Experience quiet, predictable updates that minimize disruption and maintain productivity.

IT operations teams

Own reliability and remediation, so updates are delivered safely at scale.

Security teams

Use device compliance and update posture as critical signals for access control and risk reduction.

Being Customer Zero

We use a staged rollout approach to test new updates and features with progressively larger groups of users. This helps us identify issues early, validate performance and reliability at scale, and continuously improve quality before broad deployment across the company.

Chapter 5: Optimize

In this stage, we use telemetry and operational insight to improve how the device lifecycle performs. Optimization helps us reduce friction, close recurring gaps, and make better decisions about where to invest effort.

Readiness question

Are fleet health, compliance, and cost improving or merely visible?

What good looks like

Telemetry and automation inform decisions that decrease friction, eliminate compliance gaps, and improve lifecycle efficiency.

Signals

These signals show when optimization has stalled and the environment is absorbing effort without reducing friction or risk:

Known vulnerabilities remain open longer than expected, increasing exposure to risk.

Compliance rates stop improving from one release to the next, despite ongoing remediation efforts.

Routine issues continue to require manual intervention instead of being handled through automation.

Devices repeatedly cycle in and out of compliance, indicating deeper issues in the environment.

Operational reviews spend more time addressing recurring problems and less time improving the overall service.

Microsoft Digital operating practices

These practices help us improve the environment over time and reduce operational overhead. They focus on measuring results, standardizing management, and automating routine work where possible.

• Optimization investments are guided by metrics such as patch compliance, automation coverage, remediation success rates, and operational workload.
• We standardized Windows devices on Microsoft Entra ID join and retired older management models such as Workplace join, Hybrid Azure AD join, and Active Directory join. This reduced complexity, simplified policy enforcement, and created a more consistent management experience across devices.
• Windows Autopatch, Hotpatch, and automated remediation help us keep devices current while minimizing disruption for employees.
• Intune firmware, driver, and Enterprise App Management capabilities extend the same update and deployment discipline beyond the operating system to hardware components and third-party applications.
• Microsoft Security Copilot, Microsoft 365 Copilot, and Copilot in Power BI help our teams analyze Intune and Defender data more quickly, making it easier to identify issues and prioritize remediation efforts.

Stakeholder lens

Optimization in a cloud-native model depends on aligned ownership across engineering, security, and employee experience teams. Modern management gives us a standardized, policy-driven foundation.

Employees

Experience fewer disruptions and faster issue resolution.

Endpoint engineering and modern management teams

Drive standardization, policy enforcement, and continuous fleet health optimization.

Security and CISO partners

Rely on device compliance signals to enforce secure access with minimal manual intervention.

Product groups

Incorporate Customer Zero feedback from our team in Microsoft Digital to improve enterprise readiness.

Being Customer Zero

As Customer Zero for modern management, we validate optimization capabilities at enterprise scale and feeds insights directly to engineering. This helps ensure solutions are designed for real-world scenarios.

• Modern Management transformation (Entra ID–based) simplified management and closed Conditional Access gaps.
• Validation of Autopatch and Hotpatch improves update readiness and rollout quality before broad release.
• AI-powered investigations unified Defender and Intune signals to accelerate issue triage and remediation.

Chapter 6: Refresh or reassign

In this stage, we decide whether a device should continue in service, move to a new owner, or be replaced. When done with intention, refreshing and reassignment extend an asset’s value while reducing avoidable support issues and lowering security risk.

Readiness question

Are devices refreshed or reassigned before they become performance or security debt?

What good looks like

Condition-based refresh and reassignment maximize asset value while minimizing disruption.

Signals

These signals help us see when device reuse, replacement, or support timing is slipping out of a manageable rhythm:

Hardware health telemetry trends indicate looming failures, including battery wear, thermal events, and disk health degradation, which creates unplanned downtime risk.

Firmware or driver update readiness becomes inconsistent across models (this increases the cost of servicing and support).

Refresh timing becomes reactive (devices are replaced after repeated failures instead of during planned lifecycle windows).

Reassignment or reuse requires more manual work (this signals that reset and reprovision flows aren’t consistently repeatable).

Microsoft Digital operating practices

These practices show how we make device refresh and reassignment consistent, scalable, and repeatable. They aren’t reactive steps we take when aging devices, inventory gaps, or fulfillment delays become visible. They’re the standard processes, controls, and decision points we use to keep devices moving through their lifecycle efficiently and to prevent those issues from occurring in the first place.

• Windows lifecycle guardrails: Align firmware servicing and hardware support windows to a 48-month refresh baseline so devices remain within OEM-supported windows for security and firmware updates.
• Condition-based refresh signals: Battery wear, thermal events, disk health, and firmware servicing status are monitored through telemetry to trigger proactive refresh actions before devices become performance or security debt.
• Catalog discipline: Devices are sourced from the approved OEM catalog, with model selection tied to persona, lifecycle stage, and firmware support roadmap. This reduces drift between deployed inventory and supported hardware.
• Defined recovery workflow: Reassignment is supported through a documented recovery workflow where applicable. Previously owned corporate Windows devices are returned to the out-of-box experience using WinRE-based reset initiated locally or through Company Portal, enabling redeployment to new owners through Autopilot. Recovery USB is the documented fallback when WinRE can’t be used.
• Sustainability and cost outcomes: Where possible, devices are reassigned, repurposed, or returned through approved recycling channels. This extends asset value and supports our broader sustainability commitments.
• Structured exception handling: Devices that fall outside refresh windows because of supply, persona, or business constraints follow a documented exception path with a defined review cadence so exceptions don’t become the norm.

Stakeholder lens

These groups help determine whether devices should be refreshed, reassigned, repaired, or retired:

Employees

Need reliable devices that support their work without repeated failure or disruption.

Endpoint engineering and support teams

Use telemetry and recovery workflows to guide refresh and reassignment decisions.

Procurement, finance, and sustainability teams

Balance device value, lifecycle cost, reuse, and responsible disposition.

Being Customer Zero

Our team in Microsoft Digital validates refresh and reassignment workflows at scale across device models, OEMs, and silicon partners before they reach employees. By partnering early with Windows product group, silicon partners, and OEM partners, we test Autopilot re-enrollment, WinRE-based recovery, and Company Portal reset flows in real conditions. We then turn lifecycle telemetry and friction points into direct product feedback as part of our Customer Zero commitment.

Chapter 7: Retire

In this stage, we close the lifecycle cleanly by removing devices from service in a controlled and auditable way. Retirement helps ensure that access is revoked, data is protected, and disposition is complete.

Readiness question

Can devices exit cleanly without leaving behind data, access, or audit gaps?

What good looks like

Offboarding is policy-driven, auditable, and integrated with identity, asset, and sustainability workflows.

Signals

These signals show where offboarding is leaving loose ends that can create exposure, confusion, or audit gaps later:

Orphaned devices appear (devices aren’t tied to an active person or remain enrolled after a lifecycle trigger).

Time to offboard grows (slow decommissioning creates prolonged access and data risk).

Wipe verification and audit artifacts are incomplete (this includes missing wipe confirmation logs, disposition certificates, or chain-of-custody records).

Devices remain enabled in Entra ID or continue to pass access checks after they should be decommissioned (these are access revocation gaps).

People repurpose devices informally, such as loaners or secondary devices, without clarity on what decommissioning means for audit and compliance versus reassignment.

Microsoft Digital operating practices

Offboarding triggers include employee exit, end of warranty, hardware health degradation, or compliance failure. These triggers launch automated workflows using Power Automate and ServiceNow, revoke access through Microsoft Entra ID and Conditional Access, and wipe devices through Intune or Configuration Manager. Data sanitization aligns with NIST 800-88 guidelines, and chain-of-custody controls support secure disposition.

Stakeholder lens

These groups help ensure retirement is controlled, auditable, and complete:

Employees and managers

Return devices and confirm lifecycle events that trigger offboarding.

IT operations and asset teams

Coordinate wipe, recovery, inventory updates, and disposition records.

Security, compliance, and sustainability teams

Validate access removal, data sanitization, chain of custody, and responsible disposition.

Being Customer Zero

Our team in Microsoft Digital validates retirement workflows at scale, including automated offboarding, access revocation, NIST 800-88 sanitization, and chain-of-custody controls across devices. By partnering with Microsoft Entra ID, Windows, and Intune teams, we surface real-world gaps such as orphaned devices, delayed wipes, and residual access. We then translate those gaps into product improvements that strengthen the retirement experience for customers and help keep our own audit and compliance posture durable.

Conclusion

Device readiness is not a one-time milestone. It is a lifecycle discipline that connects planning, sourcing, onboarding, operations, optimization, refresh, and retirement. At Microsoft Digital, we use that lifecycle to keep devices secure, employees productive, and operational decisions grounded in data.

“Device readiness is ultimately about enabling people to do their best work wherever and however they choose to work. By treating the device lifecycle as a strategic capability, we’ve transformed this function from an operational necessity into a source of innovation, resilience, and future growth across our organization.”

Senthil Selveraj, principal group product manager, Microsoft Digital

When every stage has clear standards, measurable signals, and repeatable mechanisms, the device estate becomes easier to manage and safer to scale. That helps us reduce exceptions, improve employee experience, and strengthen enterprise security without relying on manual effort as the default path.

“Device readiness is ultimately about enabling people to do their best work wherever and however they choose to work,” says Senthil Selveraj, a principal group product manager in Microsoft Digital. “By treating the device lifecycle as a strategic capability, we’ve transformed this function from an operational necessity into a source of innovation, resilience, and future growth across our organization.”

The post How we deploy and manage enterprise devices at Microsoft Digital appeared first on Inside Track.

That was the guiding mantra behind an ambitious cross-company effort involving our team in Microsoft Digital—the company’s IT organization—and a number of our product teams. The effort, internally referred to as the Securing AI Agents initiative, brought together teams from Microsoft Digital, Windows, Entra, Intune, Defender, Purview, and Microsoft Security to validate secure AI agent scenarios inside Microsoft’s corporate tenant.

Together, we set out to prove that AI agents could operate safely inside a real enterprise environment, not just in a controlled demonstration.

“Securing AI in the enterprise at pace requires an integrated, full-stack approach. By validating these capabilities together at enterprise scale, we’re generating the real-world learning to strengthen Microsoft’s products and give customers a trusted blueprint for secure AI adoption.”

Ragini Singh, partner group engineering manager, Microsoft Digital

As part of our role as the company’s Customer Zero, this work was recently showcased by Samantha Song and Scott Hanselman at the Microsoft Build 2026 conference.

“Securing AI in the enterprise at pace requires an integrated, full-stack approach,” says Ragini Singh, a partner group engineering manager in Microsoft Digital. “By validating these capabilities together at enterprise scale, we’re generating the real-world learning to strengthen Microsoft’s products and give customers a trusted blueprint for secure AI adoption. Looking ahead, our vision is to make this integrated security foundation the standard for every enterprise, so organizations can scale autonomous agents with speed, confidence, and trust.”

The Secure AI Agents initiative was the result of an all-hands-on-deck project behind the scenes here at Microsoft: Months of testing, coordination, validation, and refinement that transformed an emerging concept into a governable enterprise pattern.

“All of these teams came together and not only enabled the environment in our IT tenant but also ensured that all the right policies were deployed to make it so that these agents can run safely. That meant not bypassing any of the security parameters that we’ve already deployed.”

Shyam Sunder Gogi, technical program manager, Microsoft Digital

Shyam Sunder Gogi, a technical program manager in Microsoft Digital, served as the organizer of the effort, which initially began with a two-week sprint to get ready for Microsoft Build 2026. The project eventually involved more than 70 stakeholders representing different product and business groups.

“All of these teams came together and not only enabled the environment in our IT tenant but also ensured that all the right policies were deployed to make it so that these agents can run safely,” Gogi says. “That meant not bypassing any of the security parameters that we’ve already deployed.”

Testing in real-world scenarios

Rather than validating solutions in an isolated sandbox, we ran a pilot inside Microsoft Digital, standing up a dedicated Windows 365 Cloud PC environment for roughly 100 internal users.

Pilot participants put the solution through its paces across common developer scenarios. These included:

• Windows OS images with Copilot CLI and OpenClaw pre-installed
• Windows 365 Cloud PC provisioning
• Entra Agent IDs to distinguish human and agent identities
• Defender runtime protection and Purview data loss prevention policies
• Intune device and agent configuration policies
• Microsoft Entra Global Secure Access (GSA) network security controls at runtime

Our goal was to pressure-test a full stack of security guardrails, and to do it the way an actual customer would: with real users and real workloads.

“Customer Zero only works if you’re willing to be the first to hit the rough edges,” says Tom McCleery, a principal group cloud network engineering manager on the Microsoft Infrastructure, Network and Tenant (MINT) team here in Microsoft Digital. “We took the agent scenarios into a live tenant with real users, found the issues product teams couldn’t have surfaced in a lab, and fed every one of them back to the team to address before this ever reached broader enterprise readiness.”

The decision to use Windows 365 Cloud PCs in the pilot proved important.

“We want these device agents to run on our employees’ primary machines, and when necessary, to run on a secondary machine that can be easily isolated and reset if needed,” says Dave Rodriguez, a principal product manager for the Endpoint Experience (EE) team in Microsoft Digital. “That’s why we chose to go with Windows 365 Cloud PCs as a corporate-bound, non-primary environment, where we could have our end users work with those machines as they would with any other device.”

The approach created a safe environment for experimentation while giving teams realistic deployment conditions.

“With Windows 365, there’s no real impact to the devices that we’re using,” says Harshitha Digumarthi, a senior product manager on the EE team. “I really love how we leveraged Windows 365 for piloting this, iterating each time there was a change.”

Digumarthi and her team helped to establish and validate all administrative controls and policies, confirm that they function as expected, and execute a phased rollout strategy—starting with pilots and expanding incrementally while proactively monitoring for risks and user impact.

Identity, data, and network controls under load

Much of the runtime security work fell to our Microsoft Digital team, which validated how the controls behaved once agents were actually operating. A foundational aspect was telling humans and agents apart, so that rules and governance can be more clearly defined based on who is overseeing a process.

“Entra Agent IDs let us give an agent its own distinct identity, instead of having it borrow a person’s,” says Joshua Green, principal software engineering manager on the Microsoft Digital team. “Once you can cleanly separate human and agent identities, everything downstream—access decisions, auditing, runtime protection—gets dramatically more trustworthy.”

On the protection and data-governance side, MINT exercised Defender and Purview against agent activity.

“We validated Defender runtime protection and Purview data loss prevention against live agent behavior,” says Diego Baccino, a principal software engineering manager on the MINT team. “It’s one thing to write a DLP policy; it’s another to confirm that it actually catches what an autonomous agent might try to move. That testing is exactly the kind of value that Customer Zero adds.”

Network-layer controls rounded out the stack.

“Entra Agent IDs let us give an agent its own distinct identity, instead of having it borrow a person’s. Once you can cleanly separate human and agent identities, everything downstream—access decisions, auditing, runtime protection—gets dramatically more trustworthy.”

Pradeep Kunjunny, principal PM manager, Microsoft Digital

This was the advantage of using Global Secure Access, showing that the effort worked with traffic loads generated by a real agent.

“Entra Agent IDs let us give an agent its own distinct identity, instead of having it borrow a person’s,” says Pradeep Kunjunny, a principal PM manager in Microsoft Digital. “Once you can cleanly separate human and agent identities, everything downstream—access decisions, auditing, runtime protection—gets dramatically more trustworthy.”

From pilot to platform

Across the initiative, Microsoft Digital drove coordination and execution across multiple organizations.

“Our close collaboration with Microsoft Digital demonstrates the power of validating security capabilities for AI agents in one of the world’s largest and most complex enterprise environments. The insights we gain from real users and workloads help us strengthen our products and give customers greater confidence as they adopt AI agents securely.”

Aakarsh Nair, vice president of engineering, Microsoft Security

Pilot onboarding, validation of Intune-managed control rollouts, and rapid issue-triage loops improved decision confidence before it was demonstrated at Build, and it shaped the product to prepare it for broader enterprise use.

“Our close collaboration with Microsoft Digital demonstrates the power of validating security capabilities for AI agents in one of the world’s largest and most complex enterprise environments,” says Aakarsh Nair, vice president of engineering in Microsoft Security. “The insights we gain from real users and workloads help us strengthen our products and give customers greater confidence as they adopt AI agents securely.”

The result is a validated blueprint—endpoint, identity, data, and network controls working together—that our customers can now look to as they bring AI agents to their own tenants.

“The winners in enterprise AI won’t just be the teams with the best model experience. They’ll be the teams that make AI operationally trustworthy within the enterprise.”

Tunde Makinde, senior service engineer, Microsoft Digital

It was an initiative that was all about proving that secure AI agent scenarios could work in a real enterprise environment, not just in a demo or a lab setup.

“The winners in enterprise AI won’t just be the teams with the best model experience,” says Tunde Makinde, a senior service engineer for tenant integration and management engineering in Microsoft Digital. “They’ll be the teams that make AI operationally trustworthy within the enterprise.”

Our Secure AI Agents initiative is reinforcing a lesson we’ve learned repeatedly as Customer Zero for the company: Successfully deploying AI in the enterprise isn’t just about delivering innovative capabilities, it’s about ensuring that identity, endpoint, network, runtime, and data protections work together as a cohesive system, enabling employees to use new technologies with confidence while maintaining the governance and security standards that organizations expect.

“By validating these capabilities together at enterprise scale, we’re generating real-world learning to strengthen our products and give customers a trusted blueprint for secure AI adoption.”

Ragini Singh, partner group engineering manager, Microsoft Digital

By bringing together teams from across Microsoft and validating these capabilities in a live enterprise environment, we were able to test how AI agents perform under real-world conditions. The result was more than a successful Build demonstration. It was a practical blueprint that informs how we build our products and provides valuable guidance for companies preparing to adopt agents at scale.

“Securing AI in the enterprise at pace requires an integrated, full-stack approach,” Singh says. “That’s why our team in Microsoft Digital brought together Microsoft Agent 365, Windows 365, Intune, Entra Agent ID and Global Secure Access, Defender, and Purview to secure our agents.”

Working in concert across endpoint, identity, network, runtime, and data, our partnership helped establish the layered security model needed to secure our AI agents.

“By validating these capabilities together at enterprise scale, we’re generating real-world learning to strengthen our products and give customers a trusted blueprint for secure AI adoption,” she says.

Looking ahead, our vision is to make this integrated security foundation the standard for every enterprise, so organizations can scale autonomous agents with speed, confidence, and trust.

The post Securing AI agents in the enterprise: Learnings from our journey at Microsoft appeared first on Inside Track.

Every one of those devices relies on Secure Boot, a Windows security capability that verifies firmware, boot loaders, and operating system components before startup. This system helps ensure all our Windows devices run only trusted software and protects us against threats that target the boot process.

When three Microsoft-issued Secure Boot certificates approached expiration in 2026, our team in Microsoft Digital, the company’s IT organization, knew we needed to take action early and get ahead of the update. By partnering with the Microsoft Office of the CISO and several of our product teams, we developed an approach that ensured secure-by-default devices from the firmware up.

Updating the foundation of device trust

Secure Boot sits at the foundation of Windows security. Without updated certificates, devices would lose the ability to receive future Secure Boot protections and other boot-level security improvements.

“We manage a diverse fleet of devices and usage scenarios, so we needed an approach that could scale safely, provide visibility into our progress, and maintain confidence in device security.”

Luis Quintana, principal engineering group manager, Endpoint Security

To maintain protection, we needed to replace three legacy certificates with four new ones across a diverse device fleet. Replacing the certificates was straightforward. The real work was validating the update across thousands of device models and deployment scenarios.

We started early so we could test, validate, and gradually deploy the updates before the certificate expiration dates arrived. That approach helped us strengthen the security posture of our devices while minimizing disruption to employees and business-critical systems.

“Updating hundreds of thousands of devices without disrupting people and business operations is no small task,” says Luis Quintana, principal engineering group manager for Endpoint Security. “We manage a diverse fleet of devices and usage scenarios, so we needed an approach that could scale safely, provide visibility into our progress, and maintain confidence in device security.”

Leading the update across a complex device estate

We first began this work in 2024 by partnering with the Windows Servicing and Delivery team, which helped us identify device models the certificate renewal might affect. We tested those models end to end in our Client Test Lab, then deployed the update to a pilot group of around 35,000 devices using a controlled firmware release (CFR). That pilot achieved a 95% success rate, which gave us the confidence to scale up.

“Intune was the glue that brought the process together, turning a collection of settings and instructions into something we could orchestrate. It helped us create a repeatable playbook that covered everything from reporting and targeting to rollout.”

Kubilay Dagdelen, senior service engineer, Microsoft Intune

In February 2026, we kicked off the broader effort across our entire Windows 11 device ecosystem. Reporting and telemetry formed our essential starting point.

Microsoft Digital partnered with the Windows Autopatch, Intune, and Microsoft Defender for Endpoint teams to identify which devices already included the latest certificates because they were released after 2025, which devices needed the update, and which failed. In support of these efforts, the Autopatch team built fleet-wide reporting of Secure Boot status directly into Intune, turning raw telemetry into a live compliance dashboard.

“Intune was the glue that brought the process together, turning a collection of settings and instructions into something we could orchestrate,” says Kubilay Dagdelen, a senior service engineer on the Microsoft Intune team. “It helped us create a repeatable playbook that covered everything from reporting and targeting to rollout.”

A ringed approach across a range of devices

We started small, using telemetry signals to identify device cohorts based on their risk of failure. Starting from the simplest devices to update, we gradually scaled across models that carried more complexity, keeping backups and loaner machines ready to support global operations in case of disruption. After just 70 days, we had achieved 86% compliance across all our devices.

“This has been an opportunity to strengthen our security foundation. It’s about going from reactive security to a secure-by-default baseline aligned with Zero Trust principles.”

Pandurang Savagur, senior product manager, Microsoft Digital

But we don’t just maintain employee devices. Our hardware estate spans meeting rooms, secure admin workstations, digital signage, and executive devices. These different device types demanded different Secure Boot approaches.

To tackle this challenge we established a virtual team, with members responsible for each of these surfaces holding weekly syncs and leadership updates. For example, our 15,000 meeting room devices run a custom Windows 11 image, so we partnered with OEMs to release firmware for them.

Meanwhile, cloud PCs on Azure infrastructure needed scheduled reboots to update, so we let employees choose when to restart. For our server cohort, where telemetry gaps made progress hard, Microsoft Defender for Endpoint delivered the independent visibility we needed.

“This has been an opportunity to strengthen our security foundation,” says Pandurang Savagur, a senior product manager on the Device Lifecycle team in Microsoft Digital. “It’s about going from reactive security to a secure-by-default baseline aligned with Zero Trust principles.”

Our Customer Zero experience: Expertise and process pathfinding

Our role as Customer Zero shaped how we approached this process. As both the creators and users of Microsoft technology, we have direct access to product teams as well as intimate knowledge of our tools’ capabilities.

“Technology and culture matter equally here, and our Microsoft culture means we know what’s coming and can act proactively through direct access to our engineering groups.”

Yulia Evgrafova, principal security service engineer, Office of the CISO

Intune served as our execution engine, orchestrating policies and remediation scripts across more than 90% of our devices with precision. Autopatch and Defender added speed through visibility.

Thanks to the lessons we learned throughout our update journey, we’re in the process of incorporating capabilities we developed internally into each solution for public release. We’ve also established steps that can help you manage your own Secure Boot certificate updates.

“Technology and culture matter equally here, and our Microsoft culture means we know what’s coming and can act proactively through direct access to our engineering groups,” says Yulia Evgrafova, a principal security service engineer for our Office of the CISO. “On the technology side, we have the expertise to experiment and the privilege of reaching engineering teams directly.”

Secure by default and ready for what’s next

Thanks to thorough telemetry and a measured approach to rolling out the update, we’ve now reached 97% compliance globally, all while keeping our failure rate under one percent and our support burden low. Our devices now validate trusted firmware and boot components by default, keeping the list of trusted components current and closing gaps that attackers could exploit at startup.

This work continues as we collect logs on devices that need attention and remediate the stragglers, including meeting rooms and virtual machines. That long tail is the hard part, but it’s a natural component of any effort at this scale.

What we built here reaches well beyond one certificate update. Telemetry gave us the visibility to protect devices without disrupting people, and that aspect of this rollout will guide get compliant and stay compliant in the future.

“This effort serves as a playbook for many different initiatives that we’ll take on in the future,” Quintana says. “One of the biggest lessons is how we can balance experience and protection between Microsoft Digital and our security teams.”

The post Keeping the enterprise secure by default: Secure Boot certificate updates at Microsoft appeared first on Inside Track.

To make this ideal a reality, our team in Microsoft Digital—the company’s IT organization—created an agentic AI assistant that we’re now using to connect new devices to our network. We built the agent into GetConnected, the internal portal that 18,000 of our employees, vendors, and network administrators use each month to register their new devices to our network when they turn them on for the first time.

Our new workflow is simple, fast, and intuitive—and it’s a significant step up from our previous experience.

Creating the GetConnected AI assistant is part of the role we play as the company’s Customer Zero, where we test and use our technology and platforms first and then share our lessons learned with customers. In this case, we’re sharing how we used the Microsoft Agent Framework (MAF) to enhance onsite device management for our employees. GetConnected does not apply to remote device registrations.

“We’ve been looking across our set of services and capabilities to find places where we can do some experimentation leveraging AI. We wanted to be able to test our hypothesis around those AI investments and then be able to double down if it proved correct.”

Jason Thompson, principal PM manager, Microsoft Digital

Improving a highly trafficked internal tool using AI

Our employees use GetConnected to ensure their wired and wireless devices are registered on the network, as well as to extend device expiration dates and check on the status of their devices.

Heavy employee traffic and the repetitive actions users tend to take on GetConnected led us to realize that the tool was the perfect candidate for an agentic transformation. Our goal was to turn what was a five- or six-step process into something that could be completed in just one or two actions.

“We’ve been looking across our set of services and capabilities to find places where we can do some experimentation leveraging AI,” says Jason Thompson, a principal PM manager in Microsoft Digital. “We wanted to be able to test our hypothesis around those AI investments and then be able to double down if it proved correct.”

The team decided to start small, focusing on a couple of the most popular and crucial functionalities within GetConnected.

“We’d seen previous projects that were very ambitious fail because they tried to achieve too much at one time. Based on customer feedback, we noticed that registration is the simplest, most common action that users were having trouble with. So we said, ‘Let’s do that first.’”

Aayush Dave, product manager, Microsoft Digital

It was also important to listen to our employees—our Customer Zero frontline users. They told us which actions in the experience mattered most to them.

“We’d seen previous projects that were very ambitious fail because they tried to achieve too much at one time,” says Aayush Dave, a product manager in Microsoft Digital. “Based on customer feedback, we noticed that registration is the simplest, most common action that users were having trouble with. So we said, ‘Let’s do that first.’”

Next up was deciding how the agent would appear in the portal. The Microsoft 365 Copilot model of a sidebar chat menu worked well for other workflows, so it seemed appropriate to approach the new GetConnected experience in a similar way. This enabled us to create a new experience alongside the existing workflow, so customers could still access the original process (should they need to) and compare the two experiences.

“Other teams might decide to automatically replace the UI with an agent,” says Faris Mango, a principal software engineering manager in Microsoft Digital. “But that’s hard, because now you’re forcing people to use the agent. If it’s not ready to be used at full capacity, they don’t have an alternative to accomplish what they intended. We wanted to avoid that situation.”

Testing out Microsoft Agent Framework (MAF)

To build the agent, we considered two paths.

The first was to directly call the Model Context Protocol using JavaScript, an option that would require significant amounts of coding on our part.

“Some declarative agent systems do all of the things in the background, and you don’t get to turn all the little knobs. MAF gives you the flexibility to make the experience exactly what you want.”

Darron Sullivan, principal software engineer, Microsoft Digital

The second was to use Microsoft Agent Framework (MAF), which proved to be simpler and more customizable for our needs.

“Some declarative agent systems do all of the things in the background, and you don’t get to turn all the little knobs,” says Darron Sullivan, a principal software engineer in Microsoft Digital. “MAF gives you the flexibility to make the experience exactly what you want.”

The tricky part, however, was that MAF was fairly new at the time. In fact, the week that the team started developing the GetConnected agent was the same week that MAF was released in preview internally. As we were building out our agent, the framework was going through its own updates, which threatened to hinder our progress. Even one small change to the framework could break our tool’s entire functionality.

“They were moving really fast, and we were adopting new features and finding new bugs all the time,” Sullivan says. “You had to go through that rapid iteration and development, which is a challenge, but it was also pretty awesome because we’re working on the cutting edge.”

The upside was that we were able to provide valuable feedback to the MAF engineers, which in turn could supercharge the work we were doing on our agent. As a bonus, our partnership drove other teams to pursue similar projects.

“The knowledge sharing across our org was notable and crucial,” Dave says. “Our team was one of the first to start building a solution like this, and we presented in numerous architecture forums to share the components and frameworks we were using, and the teams we were working with. This brought the tide up for all boats in our organization, encouraging other teams to start kicking off similar projects as well.”

Building a seamless, discoverable interface

The agent currently has several key functions, the most prominent of which is to register a device on your behalf.

Previously, employees would have to fill in a long, complicated form that asked for a lot of technical details that they often didn’t know offhand, like type of device or the preferred network.

Instead of just selecting options and approving, the flow is more conversational. The user can start with a suggested prompt like “Help me register a device,” and the agent will ask for the required information (with examples for each field). If the user isn’t sure about something (for example, how to find a MAC address), they can ask follow-up questions, and the agent will pull in FAQ and help content to guide them.

Once all the required details are collected, the agent can complete the registration on the user’s behalf after the user approves it.

Once it has your approval, the chatbot submits the request and replies whether or not it was successful. Users can also ask the agent to show devices that are expired or will soon expire, then prompt the agent to renew those devices if desired.

Seamlessly integrating the agent into GetConnected required upgrading the existing user interface using Fluent.

These updates were needed to support the AI interface integration. Specifically, we introduced a custom header action to launch the AI side panel. Prior to upgrading, doing this would have required using Coherence components outside of their intended patterns.

“We used Fluent AI components to build the AI interface. This helped ensure a consistent Microsoft look and feel across the experience, built-in accessibility for scenarios like screen readers and mobile usage, and components that are designed for conversational and agent-driven interactions.”

Nathan Chambers, software engineer, Microsoft Digital

To stay consistent with the existing app architecture, we upgraded core dependencies like Fluent UI and Coherence to their latest versions. As part of upgrading Coherence across several major versions, it also required us to move the feedback experience to Centro to align with the updated patterns. We then needed to update other parts of the experience like navigation, FAQ, and release notes to match those newer component patterns.

“We used Fluent AI components to build the AI interface,” says Nathan Chambers, a software engineer in Microsoft Digital. “This helped ensure a consistent Microsoft look and feel across the experience, built-in accessibility for scenarios like screen readers and mobile usage, and components that are designed for conversational and agent-driven interactions.”

While making these upgrades, we ran tests to ensure the experience was accessible—for example, for screen reader users or others who might access GetConnected on their phones.

“You can have an amazing, strong piece of software that is well built and focuses on security. But if you don’t have the traffic or people are not using it, it’s worthless.”

Faris Mango, principal software engineering manager, Microsoft Digital

Next, we wanted the agent to be as discoverable as possible. Without people actually navigating to it, there would be no way to show proof of concept. So, we built it so the agent automatically popped open via a side panel when someone loaded GetConnected.

“You can have an amazing, strong piece of software that is well built and focuses on security,” Mango says. “But if you don’t have the traffic or people are not using it, it’s worthless.”

We also wanted to gather early feedback from users. Before releasing it to the entire company, we had internal team members and frequent GetConnected users give the agent a try. Almost immediately, it was clear we had too many approval notices.

“At the beginning, we would have approvals for every single action. For example, if you wanted to see a device in different regions like Puget Sound, Latin America, or Canada, you had to do a separate approval for each region,” Dave says. “This was a very painful experience. So we removed all the approvals and pared it down to a one-click experience.”

Users also had issues with the approval language, which they said was hard to understand and looked like an error message. The next iteration took out much of the technical jargon, making the message more conversational and easier to read.

An agent experience driven by feedback

Our work as Customer Zero is never done. For GetConnected, we’re eager to keep collecting feedback. One major goal is to improve the agent’s performance, making it faster and more responsive.

Our feedback survey is tied directly to a performance dashboard, which tracks metrics like new and returning users, total unique users, conversions, and interactions. Each user submission generates a work item.

“When users leave feedback about something they don’t like, I feed that to the team, and then we sit down and figure out how we can improve that specific part of the experience,” Dave says.

With each update, we’re seeing the payoff of more users and more interactions. The traditional method of registering a device is also seeing a drop-off as more people lean on the agent for assistance.

“Before, you used to have to go into the system and change something about the experience manually. Now, our engineers are going to an AI model and telling it, ‘Hey, you’re doing this part wrong, please improve it.’”

Aayush Dave, product manager, Microsoft Digital

Looking ahead to more use cases

Building an agent has allowed the team to embrace an entirely new type of engineering.

“Before, you used to have to go into the system and change something about the experience manually,” Dave says. “Now, our engineers are going to an AI model and telling it, ‘Hey, you’re doing this part wrong, please improve it.’”

It’s also serving as a reminder to seek progress over perfection.

“AI is changing things so quickly,” Thompson says. “It’s better to do rapid prototyping and roll it out, and start getting the data in terms of how successful the experience is. Then you can let that guide you, in terms of how you iterate going forward.”

Because of the success we’ve had with the GetConnected device registration feature, we’re already exploring other capabilities, including bulk operations to accommodate our facilities managers who need to onboard many devices at once. As AI agents become mainstreamed in many workflows across our organization, we anticipate usage and functionality will continue to grow exponentially.

The post Simplifying device registration at Microsoft with an agentic AI assistant appeared first on Inside Track.

“The legacy system was highly fragmented, with more than 50 device options, localized processes, data scattered across different systems, manual touchpoints, and limited visibility into order status. This created a lot of friction across the company, as well as higher costs.”

Aniruddha Das, principal PM manager, Microsoft Digital

But as our organization scaled globally, this system became increasingly complex and inefficient.

Across more than 200,000 employees in over 100 countries and regions, our device procurement and inventory management devolved into a patchwork of systems and practices. There was no top-level management, no consistent lifecycle model, and no standardized experience for employees needing to order a new device.

“The legacy system was highly fragmented, with more than 50 device options, localized processes, data scattered across different systems, manual touchpoints, and limited visibility into order status,” says Aniruddha Das, a principal PM manager in Microsoft Digital, the company’s IT organization. “This created a lot of friction across the company, as well as higher costs.”

Working in partnership with Procurement, we built myDevice—a companywide program that centralizes primary-device procurement and lifecycle workflows within a single managed platform. myDevice brought together previously distributed data and processes, giving us reliable visibility into each employee’s primary device and enabling predictable, data-driven refresh planning at scale—along with the operational insights needed to run the end-to-end experience.

“We’ve moved from a fragmented device procurement experience with many touchpoints to one conversation with one agent. Basically, we can tell our employees that their next device is just a conversation away.”

Mukul Singhal, partner engineering manager, Microsoft Digital

Beyond solving some of these basic data challenges, we also needed to address harder, at‑scale problems in the broader procurement experience: helping employees confidently pick the right device without getting overwhelmed by options, aligning eligibility and catalog choices to an employee’s role and location, and more.

With the new Employee Device Information (EDI) agent—affectionately referred to as “Eddie”—our employees will soon be able to use an AI chat interface to quickly explore recommended device options based on their job role and work needs, compare different models, and order a new device with a single click. This streamlined approach will reduce frustration, save time, and cut our costs as we automate a formerly manual process.

“We’ve moved from a fragmented device procurement experience with many touchpoints to one conversation with one agent,” says Mukul Singhal, a partner engineering manager in Microsoft Digital. “Basically, we can tell our employees that their next device is just a conversation away.”

Creating a unified approach with myDevice

The transformation began about three years ago, when our Procurement partners brought their vision for myDevice to us in Microsoft Digital. The stated goal was to standardize employee device procurement, inventory, and lifecycle management across the company.

“Our decentralized process was an industry outlier, and we realized we needed to pivot toward a standardized global process. We wanted to give our employees a single entry point, with consistent guidance across the enterprise.”

Angela Pearson, senior procurement program manager, Microsoft Procurement

Built on top of our internal ServiceNow platform, myDevice brought together previously disconnected workflows into a single consistent experience for employees. It introduced a common catalog of devices, standardized refresh cycles, and centralized ordering and fulfillment processes.

It was evident that such a system was badly needed.

“Our decentralized process was an industry outlier, and we realized we needed to pivot toward a standardized global process,” says Angela Pearson, a senior procurement program manager in Microsoft Procurement. “We wanted to give our employees a single-entry point, with consistent guidance across the enterprise. That was the first big win.”

Purchasing devices for a global workforce the size of Microsoft is not an insignificant budget item. And our fragmented system meant higher costs for the organization.

“The decentralized procurement model allowed teams to move fast, but it also led to inefficiencies,” Das says. “Devices were often purchased at the end of the fiscal cycle, because there was budget, but they didn’t always match real requirements and would sometimes go unused.”

This list maps out the evolution of our device procurement program here at Microsoft:

Legacy state

• Distributed experience: Inconsistent, inefficient processes across countries and business groups
• Zero visibility: Lack of proper asset tracking, accounting, or device management
• High friction and high cost: Significant manual effort required across multiple touchpoints

Foundation: myDevice 1.0

• Unified global experience: One consistent process across all geographies and divisions
• Persona-based: Guided buy for productivity needs based on job role
• Streamlined workflows: Optimized automated processes reducing manual touchpoints
• Enhanced visibility: Improved data management and asset tracking entering the company

Future vision: myDevice 2.0

• Next-gen interface: AI-driven, seamless employee interaction
• Supply chain resiliency: Built to weather disruption
• AI-assisted workflows: Intelligent automation across backend systems and processes

Creating a solution at the scale required for myDevice was a challenge. Relevant data was spread across systems, refresh cycles were inconsistent, and key processes, such as determining which devices should be refreshed, were often manual and time-intensive.

“The data was distributed across multiple systems, and each group was doing their own cycle,” says Amit Raghuwanshi, a principal software engineering manager in Microsoft Digital. “Bringing all the relevant data together was a huge task and big part of the solution.”

Three scenarios for device procurement

Our employees interact with three different workflows that involve obtaining a new primary work device:

• New hire provisioning
• Device refresh (for aging machines)
• Replacement for damaged devices

Each of these core scenarios now follows a standardized process, replacing the ad hoc methods that previously varied by team and geography.

“If a new hire’s device arrives a week after they join the company, that’s not a good experience. We want them to have it on day one.”

Ashok Bagade, principal product manager, Microsoft Digital

Establishing a clear device lifecycle was a big step. For example, Microsoft employees are eligible for a new PC (called a refresh) every four years. Now, with myDevice, roughly 20,000 employees each quarter automatically get a refresh invite, presuming available budget. This takes the burden off IT, admins, and other support staff who were previously tasked with managing this process manually.

The myDevice system is also improving the process for new hire device procurement. The goal has always been for each new Microsoft employee to have a computer waiting for them on their first day, but the gaps in the previous system often made meeting this standard difficult.

“If a new hire’s device arrives a week after they join the company, that’s not a good experience,” says Ashok Bagade, a principal product manager in Microsoft Digital. “We want them to have it on day one. Today, we are only able to do that around 70% of the time. We want to take that rate up to 98%.”

To make that happen, we’re in the process of shifting from a build-to-order device model to an inventory-based model. This means that our suppliers will have a stockpile of our most frequently requested PCs on hand, based on data we have compiled. This approach is designed to reduce the device procurement time from four to six weeks down to less than two weeks, Bagade says.

By centralizing and standardizing device management, myDevice created the foundation for the next phase of transforming this process: intelligence.

Adding AI for a seamless procurement experience

The second part of reimagining our employee device procurement at Microsoft was on the front end, which is the digital interface our people experience when they need to choose their new device.

Even with a unified platform in place, the experience of selecting and ordering the device could be time consuming and disjointed. Employees could browse a list of available computers, but choosing the right one still required research and consultation with colleagues and led to cognitive overwhelm.

“The challenge we saw is that people take a long time to complete their purchase because they don’t know which device to select,” Bagade says. “They get a bunch of options, and they’re not sure which one is right for them.”

So we built EDI (or “Eddie”), an AI-powered agent created with Microsoft Copilot Studio, that makes the process much more efficient. Eddie is transforming a static workflow into a conversational experience.

With Eddie, employees get a guided, conversational buying experience instead of a form-led journey. The agent validates the employee’s eligibility, captures the required inputs, and then offers role-aligned device choices directly in the chat—complete with comparison details and a clear selection path. Once confirmed, the employee submits the request and receives a trackable ServiceNow reference, which reduces follow-ups and helps employees stay informed on the process end-to-end.

“Eddie not only gives a consistent purchasing experience—it also guides you,” Bagade says. “You can ask questions and, through that conversation, narrow down your options.”

The agent is underpinned by a multi-agent architecture where specialized components handle different aspects of the process—catalog browsing, comparison, recommendations, and ordering—coordinated by an orchestration layer.

“With Eddie, the agent validates the information and, in many cases, executes the change. It can literally happen in minutes.”

Aniruddha Das, principal product manager, Microsoft Digital

Reducing complexity and increasing visibility

EDI also addresses operational pain points that extend beyond purchasing. One early challenge focused on correcting primary device records, which is an essential but previously manual process.

“Before we developed this solution, something as simple as correcting an employee’s primary device required multiple tickets and human validation,” Das says. “It could take weeks—and in some cases months—to resolve. With Eddie, the agent validates the information and, in many cases, executes the change. It can literally happen in minutes.”

Another critical improvement is visibility. Previously, once a device request was submitted, it effectively disappeared into a system that offered limited transparency.

“After placing a request, employees had no way to check on the status—it went into a black hole,” Das says. “Now, Eddie can look at the same data that Procurement has and provide answers immediately.”

Looking ahead: From systems to conversations

With myDevice and EDI in place, we’re now focused on the next phase: transforming device management into a fully conversational, intelligent experience. The vision is to move beyond portals entirely and toward an agent-first model where employees interact with systems through natural language.

“Our view for the future is that you won’t need to visit a UI or a system to accomplish a task, you’ll just start talking to an AI agent.”

Amit Raghuwanshi, principal software engineering manager, Microsoft Digital

This includes expanding capabilities such as predictive refresh cycles, deeper personalization, and tighter integration with supply chain and inventory systems. Efforts are also underway to reduce fulfillment times through innovations like centralized inventory management and forecasting.

At the same time, the experience will continue to evolve toward greater simplicity.

“Our view for the future is that you won’t need to visit a UI or a system to accomplish a task, you’ll just start talking to an AI agent,” Raghuwanshi says.

For employees, that shift means less friction, faster decisions, and a more intuitive experience.

“We know how busy our employees are, and we don’t want them spending time on lower-priority tasks. When it’s time to acquire a new device, the experience should be seamless from start to finish, without added complexity or cognitive burden. We’re making steady progress toward that reality.”

Anna Adams, director of hardware programs and operations, Microsoft Procurement

For our organization, it represents a broader transformation—one where AI not only improves existing processes but fundamentally reshapes our workflows and the way that work gets done across all functions.

This means that our employees have one less process that they have to puzzle through and figure out, which allows them to focus on their higher-value work.

“We know how busy our employees are, and we don’t want them spending time on lower-priority tasks,” says Anna Adams, director of hardware programs and operations in Microsoft Procurement. “When it’s time to acquire a new device, the experience should be seamless from start to finish, without added complexity or cognitive burden. We’re making steady progress toward that reality.”

The post Meet ‘Eddie,’ our agent for putting new PCs in the hands of our employees appeared first on Inside Track.

In light of this priority, we have established a data council to help accelerate our companywide AI-powered transformation.

Our data council is a cross-functional team with representation from multiple domains within Microsoft, including Microsoft Digital, the company’s IT organization; Corporate, External, and Legal Affairs (CELA); and Finance.

“By championing robust data governance, literacy, and responsible data practices, our data council is a crucial part of our AI-powered transformation. It turns enterprise data into a strategic capability that fuels predictive insights and intelligent outcomes across the organization.”

Naval Tripathi, principal engineering manager, Microsoft Digital

Our data council’s mission is to drive transformative business impact by establishing a cohesive data strategy across Microsoft Digital, empowering interconnected analytics and AI at scale. Our vision is to guide our organization toward Frontier Firm maturity through a clear blueprint for high-quality, reliable, AI-ready data delivered on trusted, scalable platforms.

“By championing robust data governance, literacy, and responsible data practices, our data council is a crucial part of our AI-powered transformation,” says Naval Tripathi, principal engineering manager in Microsoft Digital. “It turns enterprise data into a strategic capability that fuels predictive insights and intelligent outcomes across the organization.”

Our evolving data strategy

Over the past two decades, we at Microsoft—along with other large enterprises—have continuously evolved our data strategies in search of the right balance between control and agility. Early approaches were highly decentralized, with different teams owning and managing their own data assets. While this enabled local optimization, it also resulted in inconsistent quality and limited enterprise-wide insight.

Our subsequent shift toward centralized data platforms brought much-needed standardization, security, and scalability. However, as data platforms grew more sophisticated, ownership often drifted away from the business domains closest to the data, slowing responsiveness and diluting accountability.

Today, we and other leading companies are embracing a more balanced, federated approach, often described as a data mesh. Rather than forcing all our data into a single centralized system or allowing unchecked decentralization, the data mesh formalizes domain ownership while embedding governance, quality, and interoperability directly into shared platforms.

With this approach, our domain teams publish data as well-defined, discoverable products, while common standards for security, metadata, and compliance are enforced through automation rather than manual processes. This model preserves enterprise trust and consistency without sacrificing speed or autonomy.

By adopting a data mesh mindset, we can scale analytics and AI more effectively across the organization while still keeping ownership closely connected to the business focus. The result is a system that supports innovation at the edges, strong governance at the core, and seamless collaboration across domains, enabling the transformation of data from a technical asset to a strategic, enterprise-wide capability.

Quality, accessibility, and governance

To scale enterprise data and AI, organizations must first ensure their data is trusted, discoverable, and responsibly governed. At Microsoft Digital, our data strategy is designed to create data foundations that power intelligent applications and effective decision making across the company.

“High-quality, well-governed data is essential to accelerate implementation and adoption of AI tools. Data quality, accessibility, and governance are imperatives for AI systems to function effectively, and recognizing that is propelling our data strategy.”

Miguel Uribe, principal PM manager, Microsoft Digital

By implementing a data mesh strategy at scale, we aim to unlock valuable data insights and analytics, enabling advanced AI scenarios. Our data council focuses on three core dimensions that make AI-ready data possible:

• Quality: Making sure enterprise data is reliable and complete
• Accessibility: Enabling secure and discoverable access to data
• Governance: Protecting and managing our data responsibly

Together, these dimensions form the foundation for scalable innovation and AI-powered data use. They connect data silos and ensure consistent, high‑quality access across the enterprise—enabling both humans and AI systems to work from the same trusted data foundation. As AI use cases mature, this foundation allows AI agents to retrieve and reason over data through enterprise endpoints, while supporting advanced analytics, data science, and broader technology.

“High-quality, well-governed data is essential to accelerate implementation and adoption of AI tools,” says Miguel Uribe, a principal PM manager in Microsoft Digital. “Data quality, accessibility, and governance are imperatives for AI systems to function effectively, and recognizing that is propelling our data strategy.”

Quality

AI-ready data is available, complete, accurate, and high-quality. By adopting this standard, our data scientists, engineers, and even our AI agents are better able to locate, process, and govern the information needed to drive our organization and maximize AI efficiencies.

By utilizing Microsoft Purview, our data council can oversee the monitoring of data attributes to ensure fidelity. It also monitors parameters to enforce standards for accuracy and completeness.

Accessibility

Ensuring that our employees get access to the information they need while prioritizing security is a foundational element of our enterprise data strategy. Microsoft Fabric allows us to unify our organization’s siloed data in a single “mesh” that enables advanced analytics, data science, data visualization and other connected scenarios.

Microsoft Purview then gives us the ability to democratize that data responsibly. By implementing a data mesh architecture, our employees can work confidently, unencumbered by siloed or inaccessible data, and with the assurance that the data they’re working with is secure.

The data mesh connects and distributes data products across domains, enabling shared data access and compute while scaling beyond centralized architectures.

Platform services are standardized blueprints that embed security, interoperability, policies, standards, and core capabilities—providing guardrails that enable speed without fragmentation.

Data management zones provide centralized governance capabilities for policy enforcement, lineage, observability, compliance, and enterprise-wide trust.  

Governance

As organizations scale AI capabilities, strong governance becomes essential to ensure security, compliance, and ethical data use. Data governance—which includes establishing data policies, ensuring data privacy and security, and promoting ethical AI usage—is critical, as is compliance with General Data Protection Regulation (GDPR) and Consumer Data Protection Act (CDPA) regulations, among others.

However, governance is not only a technical capability; it’s also a cultural commitment.

Responsible data use must be embedded into the way teams manage data and build AI solutions. Through Microsoft Purview, we implemented an end-to-end governance framework that automates the discovery, classification, and protection of sensitive data across the enterprise data landscape.

This unified approach allows teams to innovate confidently, knowing that the data powering their insights and AI systems is trusted and protected, as well as responsibly managed.

“AI systems are only as reliable as the data that powers them,” Uribe says. “By investing in trusted and well-managed data, we accelerate not only the adoption of AI tools but our ability to generate meaningful insights and intelligent outcomes.”

The data catalog as the discovery layer

By serving as a common discovery layer for humans and AI, the data catalog ensures that governance translates directly into speed, accuracy, and trust at scale.

A unified data strategy only succeeds if both people and AI systems can consistently find the right data. At Microsoft, this is enabled by our enterprise data catalog, which operationalizes the standards set by our data council. 

For business users, the catalog provides intuitive search, ownership transparency, and trust signals—enabling confident self‑service analytics. For AI agents, the same catalog exposes machine‑readable metadata, allowing agents to programmatically discover canonical datasets, validate schema and freshness, and respect governance constraints.

Our role as Customer Zero

In Microsoft Digital, we operate as Customer Zero for the company’s enterprise solutions, so that our customers don’t have to.

That means we do more than adopt new products early. We deploy them at enterprise-scale, operate them under real‑world constraints, and hold them to the same standards our customers expect. The result is more resilient, ready‑to‑use solutions and a higher quality bar for every enterprise customer we serve.

“When we engage product teams with real telemetry from how data is created, governed, and consumed at scale, we move the conversation from theory to execution. That’s how enterprise readiness becomes real.”

Diego Baccino, principal software engineering manager, Microsoft Digital

Our data council embodies this Customer Zero mindset through its Enterprise Readiness initiative. By engaging product engineering as a unified enterprise voice, the council drives strategic conversations that surface operational blockers, influence roadmap prioritization, and ensure new and existing data solutions are truly ready for enterprise use.

These learnings are then shared broadly across Microsoft Digital to accelerate adoption, reduce duplication, and scale proven patterns across teams.

“When we engage product teams with real telemetry from how data is created, governed, and consumed at scale, we move the conversation from theory to execution,” says Diego Baccino, a principal software engineering manager in Microsoft Digital and a member of the council. “That’s how enterprise readiness becomes real.”

This work is deeply integrated with our AI Center of Excellence (CoE), where Customer Zero principles are applied to accelerate AI outcomes responsibly. Together, the AI CoE and the data council focus on improving data documentation and quality—foundational capabilities that are required to make AI feasible, trustworthy, and scalable across the enterprise.

By grounding AI innovation in measurable data quality and governance standards, Microsoft Digital ensures that experimentation can safely mature into production‑ready solutions. The partnership between our data council, our AI CoE, and our Responsible AI (RAI) Council is essential to our broader data and AI strategy.

“AI readiness isn’t aspirational—it’s operational,” Baccino says. “By measuring the health of our data, setting clear quality baselines, and using those signals to guide product and platform decisions, we turn data into a strategic asset and AI into a repeatable capability.”

Together, these teams exemplify what it means to be Customer Zero: Transforming enterprise experience into action, governance into acceleration, and data into durable competitive advantage.

Learn more

Read about our AI Center of Excellence.

Advancing our data culture

Our data council plays a pivotal role in advancing the organization transition from data literacy to enterprise data and AI capability. In conjunction with our AI CoE, it creates curricula and sponsors learning pathways, operational practices, and community programs to equip our employees with the skills and mindset required to thrive in a data- and AI-centric world.

While early efforts focused on improving data literacy, our data council ’s mission has evolved to enable data and AI capability at scale together with our AI CoE—where employees not only understand data but can effectively apply it to build, operate, and govern intelligent solutions.

“Our focus is not just teaching our teams about data. It is enabling employees to apply data to create AI-driven outcomes. When teams understand how data powers AI systems, they can make better decisions, design better products, and build more responsible AI experiences.”

Miguel Uribe, principal product manager, Microsoft Digital

Our curriculum includes high-level courses on data concepts, applications, and extensibility of AI tools like Microsoft 365 Copilot, as well as data products like Microsoft Purview and Microsoft Fabric.

By facilitating AI and data training, offering internally focused data and AI certifications, and internal community engagement, our council ensures that employees develop the capabilities required to responsibly build and operate AI-powered solutions. Achieving data and AI certifications not only promotes career development through improved data literacy, it also enhances the broader data-driven culture within our organization.

“We recognize that AI capability is built when data skills are applied directly to real AI scenarios and business outcomes—not when learning exists in isolation,” Uribe says. “Our focus is not just teaching our teams about data; it is enabling employees to apply data to create AI‑driven outcomes. When teams understand how data powers AI systems, they can make better decisions, design better products, and build more responsible AI experiences.”

Find out more

Learn how a Copilot Expo helped us build interest in Microsoft 365 Copilot.

Lessons learned

Our data council was created to develop and execute a cohesive data strategy across Microsoft Digital and to foster a strong data culture within our organization. Over time, several critical lessons have emerged.

Executive sponsorship enables transformation

Executive sponsorship is a key element to ensure implementation and adoption of a data strategy. Our leaders are committed to delivering and sustaining a robust data strategy and culture and have been effective champions of the council’s work.

“Leadership provides support and reinforcement of the council’s mission, as well as guidance and clarity related to diverse organizational priorities,” Baccino says.

Cross-functional collaboration accelerates impact

Our council’s work has also benefited from the diverse representation offered by different disciplines across our organization. Embracing diverse perspectives and understanding various organizational priorities is critical to implementing a successful data strategy and culture in a large and complex organization like Microsoft Digital.

Modern platforms allow for scalable AI productivity

Technology and architecture also play a critical role in enabling enterprise data and AI capability. Platforms like Microsoft Purview and Microsoft Fabric provide the governance, discovery, and analytics infrastructure required to create trusted, AI-ready data ecosystems.

Combined with strong leadership support and community engagement, these platforms allow our organization to move beyond isolated data projects toward connected, enterprise-wide intelligence.

As our organization continues to evolve, our data council’s strategic work and valuable insights will be crucial in shaping the future of data-driven decision making and AI transformation at Microsoft.

Key takeaways

Here are some things to keep in mind as you contemplate forming a data council to help you manage and scale AI impacts responsibly at your own organization:

• A data mesh strikes the balance enterprises have been chasing. By formalizing domain ownership while enforcing standards through shared platforms, you avoid both chaotic decentralization and slow, over-centralized control.
• Governance is an accelerator when it’s automated and embedded. Using platforms like Microsoft Purview and Microsoft Fabric, governance shifts from a manual gatekeeping function to a built‑in capability that enables faster, trusted analytics and AI.
• AI systems are only as strong as their discovery layer. A unified enterprise data catalog allows both people and AI agents to find, trust, and use data consistently—turning standards into operational speed.
• Customer Zero turns theory into enterprise‑ready execution. By operating its own data and AI platforms at scale, Microsoft Digital provides real telemetry and practical feedback that directly shapes product readiness.
• Building AI capability is a cultural effort, not just a technical one. Our data council’s focus on applied learning, certification, and real-world AI scenarios ensures data skills translate into durable business outcomes.
• AI scale exposes the cost of fragmented data ownership. A data council cuts through silos by aligning priorities, resolving tradeoffs, and concentrating investment on the data assets that matter most for AI impact.
• Shared metrics create shared ownership. Publishing data quality and AI‑readiness scores at the leadership level reinforces accountability and positions data as a core enterprise asset.

Try it out

New to Microsoft 365 Copilot? Check it out!

Related links

• Learn more about the councils that are steering AI projects at Microsoft.
• See how we’re tackling Microsoft 365 Copilot governance internally at Microsoft.
• Explore how we’re unlocking enterprise AI extensibility at Microsoft with Microsoft Copilot Studio.
• See AI-powered agents in action: How we’re embracing this new ‘agentic’ moment at Microsoft.

The post Harnessing AI: How a data council is powering our unified data strategy at Microsoft appeared first on Inside Track.

There was excitement, curiosity, skepticism, and no shortage of questions about what this technology meant for the future of IT.

At Microsoft Digital—the company’s IT organization—we didn’t start with a grand transformation plan. Instead, we started with a realization: AI wasn’t just another tool to roll out. It was a fundamental shift in how engineering work could happen.

For years, our IT teams have been focused on scale, reliability, and operational excellence. Those priorities didn’t change. What changed were the possibilities.

Suddenly, engineers could draft code in seconds, summarize complex systems instantly, or automate work that had once consumed hours or days. It was an opportunity to take the skills and capabilities of our people and amplify them with AI.

That realization forced us to step back and ask harder questions.

How do you help thousands of engineers understand what AI can actually do to impact their day-to-day work? How do you move from experimentation to trust? And how do you adopt AI in a way that strengthens engineering fundamentals instead of eroding them?

The answer came in the form of a phased journey grounded in people, culture, and continuous learning.

Phase 1: Awareness and access

It might sound surprising when speaking about engineering processes, but our first challenge wasn’t technology; it was understanding.

When generative AI entered the conversation, most engineers saw the headlines and dabbled in various tools, but few understood fully what it meant for their work. Some were excited, others were wary. Many simply didn’t know where to start. That gap between awareness and practical value was the first barrier we had to address.

We realized early that top-down mandates wouldn’t work. Telling engineers to “use AI” without context or relevance would only deepen skepticism. Instead, we focused on something both simpler and more difficult: Exposure.

We started by making AI visible and accessible in the tools engineers already used. GitHub Copilot. Microsoft 365 Copilot. Early copilots embedded directly into engineering workflows. The goal wasn’t immediate productivity gains. It was familiarity. Letting engineers see, firsthand, what AI could and couldn’t do.

“We encouraged tool usage and adoption so people would at least play around with AI. And once they did, they started seeing the value. That’s when the mindset shifted from ‘AI might replace me’ to ‘AI can be my companion.’”

Mukul Singhal, partner group engineering manager, Microsoft Digital

Just as important, we talked openly about limitations.

AI wasn’t perfect. It hallucinated. It made confident mistakes. And that honesty mattered. By framing AI as an assistant, we reinforced the role of engineering judgment. Engineers didn’t need to fear losing control. They needed to understand how to stay in control.

We also made experimentation safe.

No quotas. No forced adoption metrics. Engineers were encouraged to try AI on low‑risk tasks: summarizing documentation, generating test cases, or exploring unfamiliar codebases. Small wins built confidence, confidence built curiosity, and curiosity drove organic adoption.

As that experimentation took hold, the mindset began to shift.

“We encouraged tool usage and adoption so people would at least play around with AI,” says Mukul Singhal, a partner group engineering manager in Microsoft Digital. “And once they did, they started seeing the value. That’s when the mindset shifted from ‘AI might replace me’ to ‘AI can be my companion.’”

Over time, conversations changed from ‘Should we use AI?’ to ‘Where does AI help most?’

Engineers began sharing prompts, tips, and lessons learned with one another. What started as individual exploration turned into community learning. Awareness gave way to momentum.

Phase one was about providing access to explore, to question, and to learn. And that foundation made everything that followed possible.

Phase 2: Culture shift

Access created awareness and awareness created curiosity.

As more engineers began experimenting with AI, we noticed a pattern. Some teams were moving faster, learning faster, and reducing friction in their day‑to‑day work. Others stalled after initial trials. The difference wasn’t technical skill or capability, it was mindset.

“People started shifting from the mindset of ‘Will AI work?’ to ‘AI is working for me.’ I think that was a very transformational shift, to where I believe a lot of engineers in the organization started believing in AI.”

Veera Mamilla, principal group engineering manager, Microsoft Digital

To move forward, we had to shift how AI was perceived from something optional or experimental to something that was simply part of how modern engineering gets done.

That meant normalizing AI as a trusted partner in the engineering process.

Leaders played a critical role in that shift. Rather than positioning AI as a productivity shortcut, they framed it as a way to strengthen engineering fundamentals: clearer design discussions, better documentation, faster feedback loops, and more time for deep problem‑solving. The message was intentional and consistent. Using AI wasn’t about cutting corners, it was about reimagining how work gets done.

We also had to address a fear that surfaced early: that AI adoption was a signal of replacement rather than empowerment.

“People started shifting from the mindset of ‘Will AI work?’ to ‘AI is working for me,’” says Veera Mamilla, a principal group engineering manager in Microsoft Digital. “I think that was a very transformational shift, to where I believe a lot of engineers in the organization started believing in AI.”

That framing mattered.

As engineers incorporated AI into their workflows, success stopped being measured by output alone. The focus shifted to outcomes. Did AI help you understand a system faster? Did it surface risks earlier? Did it free up time to focus on higher‑value work?

Over time, AI stopped feeling like a novelty. It became part of the engineering fabric. We reinforced it through leadership modeling, peer learning, and shared success stories. Teams no longer asked whether AI belonged in their workflows. They asked how to use it responsibly and effectively.

Phase 3: Upskilling and role evolution

Once AI moved from curiosity to expectation, the challenge of skill building became unavoidable.

From the start, we made a deliberate choice: This would be an upskilling and reskilling journey, not a wholesale replacement of roles. The goal wasn’t a new workforce. It was an investment in the one we had.

That decision shaped everything that followed.

Early upskilling efforts focused on practical entry points. Prompt engineering. Tool literacy. Understanding how copilots and early agents behaved in real engineering workflows. We treated these as something every engineer needed to experiment with, regardless of discipline.

But it quickly became clear that skills alone weren’t the full story. Roles themselves were starting to evolve.

“Your title might still be software engineer or principal engineer. But if you’re acting like an AI engineer, what does that actually mean? That question helped us start defining how these roles were evolving.”

Ragini Singh, partner group engineering manager, Microsoft Digital

Across software development, service engineering, and cloud network engineering, the work was shifting from manual execution toward orchestration and oversight. Engineers were no longer expected to do every task end‑to‑end by hand. Instead, they were learning how to guide AI, review its output, and decide where automation made sense and where it didn’t.

As part of this shift, we began researching how the industry itself was redefining engineering roles. Leaders examined emerging job descriptions from across the market and compared them with Microsoft’s own role frameworks. At the time, there was no formal “AI engineer” role in the internal job library. Rather than creating a new title, the focus stayed on evolving expectations within existing roles.

The idea of an “AI‑native engineer” emerged not as a job description, but as a mindset.

An AI‑native engineer still understands systems, architecture, and risk. What’s different is how that expertise gets applied. Routine tasks are delegated to AI. Judgment, design, and accountability stay with the human. Engineers move from doing all the work themselves to supervising work done in partnership with AI.

“Your title might still be software engineer or principal engineer,” says Ragini Singh, a partner group engineering manager in Microsoft Digital. “But if you’re acting like an AI engineer, what does that actually mean? That question helped us start defining how these roles were evolving.”

This evolution looked different across disciplines. Software engineers focused on AI‑assisted coding, test generation, and spec‑driven development. Service engineers leaned into AI for incident response, knowledge capture, and operational decision support. Cloud network engineers began moving from manual intervention toward intelligent orchestration and agent‑assisted troubleshooting. The common thread wasn’t identical tooling, it was a shared shift toward higher‑order work and reduced toil.

Phase 4: Embedding AI across the engineering lifecycle

By this phase, we knew individual productivity gains were simply the starting point for larger and broader benefits.

Early on, most AI usage showed up in familiar places: Code suggestions, documentation summaries, quick answers. Useful, but fragmented. The bigger opportunity emerged when we stepped back and asked a harder question: What would it look like if AI were embedded across the entire engineering lifecycle, not just used at isolated moments?

We stopped thinking in terms of tools and started thinking in terms of flow. Design. Build. Test. Deploy. Operate. Improve. AI needed to show up across all of it, in ways that reinforced how engineers already worked.

“If AI is only showing up at one step, you don’t get the full value. The real impact comes when it’s integrated across the lifecycle, where engineers can design, build, operate, and learn faster as a system.”

Sudhakar Sadasivuni, principal group engineering manager, Microsoft Digital

In software engineering, that meant pulling AI earlier into the process. We began using it to help draft requirements, reason through design options, and review code with broader system context to accelerate how quickly we could get to informed decisions. Coding assistance mattered, but it was no longer the center of gravity.

Testing and quality followed a similar pattern. AI supported test generation, defect analysis, and code review, reducing repetitive effort and helping issues surface sooner. That gave engineers more time to focus on quality and architecture instead of cleanup.

In service engineering, we embedded AI into incident management and operational workflows. Engineers used it to summarize incidents, surface relevant knowledge, and analyze signals across systems. In cloud network engineering, AI helped shift work away from manual intervention toward orchestration and intelligent troubleshooting. Across disciplines, the principle stayed the same: AI should reduce friction, not introduce it.

As we scaled this approach, one thing became clear. Embedding AI wasn’t just a technical exercise. It was a systems change.

“If AI is only showing up at one step, you don’t get the full value,” says Sudhakar Sadasivuni, a principal group engineering manager in Microsoft Digital. “The real impact comes when it’s integrated across the lifecycle, where engineers can design, build, operate, and learn faster as a system.”

As AI became part of core workflows, engineers remained accountable for outcomes. AI output was reviewed, tested, and validated like any other engineering input. Embedding AI didn’t lower the bar for rigor. It raised expectations around judgment, oversight, and data quality. We became more deliberate about responsibility and governance.

Over time, these integrations created compound benefits.

Faster design cycles reduced downstream rework. Better testing lowered operational noise. Improved operational insight shortened recovery times. AI stopped being something we used occasionally and became something the engineering system itself was built around.

Phase 5: Eliminating toil and accelerating outcomes

At some point, every AI story hits the same test. Does it actually make engineers’ days better? For us, that proof showed up fastest in elimination of toil.

Across Microsoft Digital, engineers have always spent time on work that was necessary but draining. It included tasks such as manual troubleshooting, repetitive diagnostics, log analysis, and routine operational tasks that kept systems running but didn’t move the organization forward.

AI gave us a chance to change that.

“Toil reduction is the biggest thing. That’s where engineers’ eyes light up. If we can eliminate toil, people engineers will flock to use AI. I really believe it.”

Beth Garrison, principal cloud network engineer, Microsoft Digital

In cloud network engineering, for example, troubleshooting used to require manually reconstructing what happened, such as logging into devices, chasing configurations, and piecing together context after the fact. As we began introducing agents and machine learning into these workflows, that work shifted. Instead of spending time assembling the picture, engineers could generate the views they needed faster and focus on resolving issues.

The same shift showed up in how we used operational data.

Rather than reacting to incidents after impact, we started using machine learning to analyze logs, identify patterns, and surface anomalies earlier. That moved teams from reactive response toward proactive monitoring and prevention.

One thing became clear very quickly: Toil reduction wasn’t just a benefit; it was the catalyst for adoption.

“Toil reduction is the biggest thing. That’s where engineers’ eyes light up,” says Beth Garrison, a principal cloud network engineer at Microsoft Digital. “If we can eliminate toil, people engineers will flock to use AI. I really believe it.”

Service engineering followed a similar arc.

Across governance, operations, productivity, and cost management, we began applying agents and automation to simplify complex work and reduce manual review cycles. Governance and compliance workflows became faster and more consistent. Operational processes benefited from guided remediation and earlier insight. Knowledge capture improved as documentation and remediation guidance could be generated and updated automatically.

When we removed repetitive work such as manual triage, rote diagnostics, endless documentation cleanup, we transformed how engineers spent their time. More focus on design. More proactive problem‑solving. More energy directed toward improving systems instead of just maintaining them.

Toil reduction made the value of AI tangible. It’s the moment AI stopped being interesting and became indispensable, and our engineering teams started asking where else we can apply it next.

Measuring what matters

By the time AI was embedded across our engineering lifecycle, a new question came into focus: “How do we know it’s working?”

In the early days, we paid close attention to usage. Which tools engineers were trying, where adoption was growing, or where it stalled. Those signals mattered and adoption was the leading indicator that people were getting comfortable and starting to integrate AI into real work.

“Adoption was always the starting point. But we were clear from the beginning that usage isn’t the destination. The real goal is impact; more time for engineers to focus on the work that truly matters.”

Ullas Kumble, principal group software engineering manager, Microsoft Digital

But using AI doesn’t automatically mean better outcomes. So, we shifted the conversation and started asking, “What’s different now that our engineers are using AI?”

That change reframed how we thought about measurement. We began looking beyond tool activity to understand impact across the engineering system. Faster design cycles. Earlier defect detection. Reduced time spent on repetitive operational work. Shorter incident resolution. Clearer documentation. Fewer handoffs. Less rework.

These weren’t abstract metrics. They showed up in the flow of work.

We were intentional about not forcing a single definition of value across every role. Software engineers, service engineers, and cloud network engineers experience impact differently. What mattered was that each team could point to tangible improvements in how work moved through the system.

That perspective shaped how leadership talked about success.

“Adoption was always the starting point,” says Ullas Kumble, a principal group software engineering manager at Microsoft Digital. “But we were clear from the beginning that usage isn’t the destination. The real goal is impact; more time for engineers to focus on the work that truly matters.”

Over time, this approach changed the quality of our conversations. Instead of debating whether AI was worth the investment, teams talked about where it was removing friction and where it still wasn’t delivering enough value. Measurement became a tool for learning and prioritization.

Moving forward

Looking ahead, one lesson stands out: this journey isn’t complete.

AI tools will continue to evolve. Agents will become more capable. Roles will keep shifting. What it means to be an engineer will continue to change. And that means our approach must stay grounded in the same principles that guided us from the start: invest in people, reinforce fundamentals, embed AI into real workflows, and stay honest about what’s working and what isn’t.

We didn’t set out to build an AI‑driven engineering organization overnight, we built it phase by phase.

By meeting engineers where they were
By reshaping culture before redefining roles.
By embedding AI across the lifecycle, not bolting it on.
By reducing toil and measuring impact where it mattered most.

The result is better engineering: powered by AI, guided by human judgment, and built to keep evolving.

Key takeaways

Here’s a set of approaches you can take to establish AI-led engineering for your organization:

• Start with access and understanding. Give engineers safe, easy access to AI in the tools they already use so curiosity and confidence can develop organically before you push for outcomes.
• Frame AI as a partner, not a replacement. Position AI as an assistant that strengthens engineering judgment and fundamentals rather than a shortcut or a threat to roles.
• Normalize experimentation without pressure. Encourage low‑risk experimentation and peer sharing instead of mandates, allowing adoption to grow through visible, practical wins.
• Invest in upskilling. Focus on evolving skills and expectations within existing roles so engineers learn how to guide, review, and stay accountable for AI‑assisted work.
• Embed AI across the full engineering lifecycle. Look beyond isolated productivity gains and integrate AI into design, build, test, operate, and improve workflows to unlock system‑level impact.
• Measure impact where engineers feel it. Move past usage metrics and track outcomes like reduced toil, faster feedback, and improved flow so teams can see where AI is truly making work better.

Try it out

Try GitHub Copilot.

Related links

• Learn how an AI-led SDLC builds an end-to-end agentic software development lifecycle with Azure and GitHub.
• Discover why developers will lead AI transformation across the enterprise.

The post Powering the new age of AI-led engineering in IT at Microsoft appeared first on Inside Track.

For years, we stitched together insights across multiple tools, wrote custom queries, and maintained fragile reports just to answer basic questions. This approach slowed investigations and delayed patch targeting.

We needed a faster, stronger, cloud-native path.

We’re investing in AI-powered predictive maintenance and intelligent troubleshooting to reduce friction in device management.”

Daniel Manalo, principal service engineer, Microsoft Digital

The advent of generative AI changed the way we manage our devices. Not only were we able to ask better questions and get targeted help right from the start, we also got faster and more relevant answers from across our entire device management estate.

It’s simpler. It’s faster. It scales with our environment. And we’re doing it natively in the cloud.

“We’re investing in AI-powered predictive maintenance and intelligent troubleshooting to reduce friction in device management,” says Daniel Manalo, a principal service engineer in Microsoft Digital, the company’s IT organization.

AI and machine learning help us find errors faster and fix them autonomously, in many cases. It reduces our downtime, prolongs lifespans of our devices, and ensures our employees have a consistent and productive experience with their devices.

Today, we’re applying this approach to everyday operations: Speeding investigations, simplifying updates, and tightening the loop from detection to remediation. The overarching goal remains consistent—reduce workloads, improve clarity, and move our discoveries to earlier in the risk window.

The role of Customer Zero in evolving modern device management

We serve as the company’s Customer Zero for our products here in Microsoft Digital. We run early capabilities in our own tenant, pressure‑test them at Microsoft scale, and feed what we learn straight back to engineering. The goal is simple: Turn good ideas into reliable features that any enterprise can use.

“We use our collective learnings from our internal deployments to improve our products, which makes them better for our employees and for our customers.”

 Senthil Selvaraj, principal group product manager, Microsoft Digital

Our Microsoft Digital teams work side-by-side with the Intune product group to modernize our device management approach. The Intune group builds and operates the platform, while we bring real‑world scenarios, signals, and guardrails. Together, we help develop, test, and deploy a better cloud-native product for our customers.

“We use our collective learnings from our internal deployments to improve our products, which makes them better for our employees and for our customers,” says Senthil Selvaraj, a principal group product manager in Microsoft Digital.

For the same reasons, we work hard to make sure that we deploy our tools and services in the same way our customers do.

“That enables everyone at the company to have good visibility into the experiences our customers will have when our products get to them,” Selvaraj says. “This makes us more accountable to our customers and helps us move quickly when improvements are needed.”

Customer Zero for device management spans more than Intune.

We partner across teams responsible for Microsoft Purview, Microsoft 365 Copilot, Microsoft Defender, Windows (Autopatch and Hotpatch), GitHub, and Microsoft Azure to produce comprehensive device management capabilities. These are the surfaces where we test, learn, and refine the end‑to‑end device management experience.

The loop is tight. We identify a need, prototype a solution with the product groups, roll it out to targeted rings, measure impact, and iterate. Those learnings inform what ships in Intune—from data-driven insights to built‑in prompts that surface device health data as a conversation, rather than a simple query.

“Using natural language reduces the time it takes us to figure out what’s going on. We are able to ask Security Copilot questions naturally, which allows us to hear the signals that need our immediate action faster.”

Mohit Malhotra, product manager, Microsoft Digital

The result is a safer, faster path to value with AI-driven device management, including clear ownership, faster remediation, and features that arrive tested against operational reality.

We’ve learned a lot as Customer Zero, and we’re passing those lessons on to you.

Modern device management: Seven tips

Here are seven important tips that we’ve compiled to help with your device management efforts.

Tip 1: Ask natural-language questions with Microsoft Security Copilot

We use the generative AI capabilities in Microsoft Security Copilot to query device and vulnerability data in plain language and get a unified answer that we can act on.

This allowed us to replace bespoke reports with targeted questions.

“Using natural language reduces the time it takes us to figure out what’s going on,” says Mohit Malhotra, a product manager in Microsoft Digital. “We are able to ask Security Copilot questions naturally, which allows us to hear the signals that need our immediate action faster.”

Security Copilot lets us ask about device posture, app versions, cybersecurity vulnerabilities (known as Common Vulnerabilities and Exposures, or CVEs), and exposure across Microsoft Defender and Intune, without stitching the data together by hand. We get the context we need and move faster from finding to fixing.

How we use it

• Scope impact: “List Windows devices running <app/version> that are vulnerable, with owners and deployment rings.”
• Prioritize work: “Group affected devices by business unit and model; show counts and severity.”
• Verify reach: “Confirm which devices received <policy/package> in the last 48 hours; flag failures.”

Prompts we rely on

• “Show devices affected by <CVE/app version> and summarize recommended remediation steps.”
• “Break down exposure by ring and list top 5 models with highest risk.”
• “Identify outliers that failed the last policy sync and provide reasons.”

Why it helps

• Less toil: No custom pipelines to maintain.
• Faster triage: Discovery and scoping happen in one interaction.
• Clear next steps: Results align to our Intune targeting and scheduling paths.

Best practices

• Start specific: Name the product, version, and time window, then broaden as needed.
• Keep follow‑ups short: Quick pivots like “group by region” or “add owner emails” maintain momentum.
• Act on the output: Use the device lists to target updates or policies in Intune, then validate results with a final check.

Note

• We align usage with least‑privilege access and established approval paths so insights come from authoritative sources and actions land through the right channel.

Tip 2: Find knowledge fast with Microsoft 365 Copilot

We use Microsoft 365 Copilot to pull device context from email, chats, and documents, allowing us to troubleshoot issues faster and easier using generative AI.

Incidents start with questions, not dashboards, e.g. “Who owns this package? When did we change that policy? Where did we discuss the driver rollback?”

The answers to those questions live in mail threads, Teams chats, and planning docs. Before Copilot, we were forced to sift through these materials manually, which cost us time. Now we ask one question and get a summary with sources, people, and links. That keeps the investigation moving and reduces handoffs.

“Copilot helps scan noisy logs and points us to likely causes. Our old process of opening logs, interpreting opaque error strings, and validating a hunch took too long. Getting faster answers matters when incidents stack up.”

Michael Griswold, principal service engineering manager, Microsoft Intune

This also helps us during the coordination phase. We can surface the approver for a change, the engineer who ran the last mitigation, and the runbook section that explains the rollback steps. We make better decisions because we see the history and the intent, not just the current state. Then we line up the action in Intune with the right stakeholders already looped in.

How we use it

• Asking for recent context on a device model, configuration, or app to see decisions and outcomes in one place.
• Retrieving owners, approvers, and on‑call contacts named in Outlook and Teams messages related to the issue.
• Pulling change notes and runbook updates tied to a policy or package before we request an update in Intune.

Prompts we rely on

• “Summarize recent emails and Teams messages about <device model/app version> and list owners mentioned.”
• “Find the change note or runbook update for <policy/package> from the last 14 days.”
• “Show known issues linked to <KB/app> and who resolved the last occurrence.”

Why it helps

• Less hunting: We replace ad hoc inbox and wiki searches with a single query.
• Faster coordination: We identify the right stakeholders and prior decisions immediately.
• Better decisions: We confirm history and context before proposing changes in Intune.

Best practices

• Keep prompts scoped. Include product, version, and a timeframe to focus your results.
• Respect boundaries. Align usage with least‑privilege access and existing approval and auditing paths.
• Capture outcomes. Link summaries, owners, and key docs back to the incident record so future searches return richer context.

Note

• Copilot gets better as more decisions and runbooks live in Microsoft 365, since that’s where the signals come from.

Tip 3: Accelerate log triage with GitHub Copilot, Visual Studio Code, and Log Analytics

We use GitHub Copilot in Visual Studio Code with Azure Monitor Log Analytics to explain errors, draft KQL, and shorten device log investigations.

“Copilot helps scan noisy logs and points us to likely causes,” says Michael Griswold, a principal service engineering manager with the Microsoft Intune product group. “Our old process of opening logs, interpreting opaque error strings, and validating a hunch took too long. Getting faster answers matters when incidents stack up.”

Now we keep the entire loop in one workspace. AI in GitHub Copilot interprets the event, proposes likely causes, and generates KQL to confirm or rule out scenarios. We move from symptom to validated pattern without bouncing across tools.

How we use it

• Connect VS Code to your Log Analytics workspace and load the tables you need (e.g., inventory and update events).
• Paste a minimal log sample with timestamps and device identifiers, so Copilot has context.
• Ask Copilot to summarize the error, suggest probable causes, and produce KQL to test each path.
• Run the query, review clusters and outliers, and request an alternate query or grouping if noise is high.

Prompts we rely on

• “Explain this error in a device‑management context and list three validation checks.”
• “Write KQL to find matching failures in the last 24 hours and group by model and policy.”
• “Join device inventory with update events for device and surface anomalies.”

Why it helps

• Faster pattern recognition: Proposed queries get us to evidence quickly.
• Less context switching: Analysis and validation happen inside VS Code.
• Cleaner handoff: Results map to our Intune actions for targeted remediation.

Best practices

• Keep inputs tight: Provide a small, representative log snippet, the affected device attributes, and a precise time window.
• Iterate on queries: Ask for different filters, joins, or time ranges when results are noisy.
• Close the loop: Use the device list to drive policy or update changes in Intune and confirm fixes with a final query.

Note

• This workflow is broadly repeatable with GitHub Copilot, Visual Studio Code, and Azure Monitor Log Analytics.

Tip 4: Keep firmware and drivers current with Intune update management

We use Intune firmware and driver update management to identify, approve, and deploy our OEM updates at scale.

“Staying current on firmware and drivers keeps devices stable and secure. With Intune, we stage updates, watch the rollout, and adjust before issues spread.”

Taqui Mohammad, senior service engineer, Microsoft Digital

Firmware and driver releases don’t land on a predictable schedule. Different vendors ship on different timelines, and a single environment can span hundreds of models.

Tracking this manually slows responses and leaves risk on the table. Intune centralizes the view so we can see what’s applicable, choose the right targets, and roll out updates with the same discipline we use for OS patches.

“Staying current on firmware and drivers keeps devices stable and secure,” says Taqui Mohammad, a senior service engineer in Microsoft Digital. “With Intune, we stage updates, watch the rollout, and adjust before issues spread.”

How we use it

• Review applicability: Open the firmware and driver updates view to see available updates grouped by make and model.
• Select a pilot: Target a small ring first (model, business unit, or region) and set short deadlines.
• Plan time windows and restarts: Align deployments with maintenance windows and communicate expected reboots.
• Monitor, then expand: Track success and failure signals, remediate issues, and scale to broader rings.

Configuration tips

• Standardize categories: Separate firmware from drivers in policies so reporting and rollbacks are clean.
• Use device tags consistently: Model, region, and business unit tags make scoping and expansion straightforward.
• Define rollback steps: Document how to revert a driver or hold firmware for a specific model when needed.

Success checks

• Compliance trend: Increased percentage of devices on the latest approved firmware and driver versions after each wave.
• Incident correlation: Fewer support tickets related to device stability and peripherals on updated models.
• Deployment reliability: Decreased failure rates as pilots catch issues before broad rollout.

Best practices

• Pair with risk signals: Prioritize models tied to active vulnerabilities or incident clusters before broad rollout.
• Keep rings small and fast: Validate quickly, then scale; long pilots hide issues and delay benefits.
• Document exceptions: If a model needs a temporary hold due to app or peripheral compatibility, record the reason and set a review date.
• Verify outcomes: Confirm update levels on target devices and scan for regressions in support queues.

Notes

• Expect uneven arrival patterns across vendors and models; a weekly review cadence helps catch new updates without creating noise.
• Treat firmware and drivers as first‑class updates; include them in regular compliance reports and reviews so they get consistent attention.

“Autopatch Update Readiness catches and resolves common blockers before deployment begins. What used to require manual checks and troubleshooting is now handled upfront, giving us smoother updates and a far more reliable experience for our employees.”

Dave Rodriguez, principal product manager, Microsoft Digital

Tip 5: Speed updates with Windows Autopatch, Hotpatch, and Auto Remediation Update Readiness

We use Windows Autopatch and Hotpatch to reduce disruptions and keep our devices current, and we pair them with automated readiness and remediation so our changes land safely and quickly.

Autopatch handles orchestration for quality updates and feature releases. We define rings that reflect business risk and user impact, then let the service pace deployments as health signals arrive.

“Autopatch Update Readiness catches and resolves common blockers before deployment begins,” says Dave Rodriguez, a principal product manager in Microsoft Digital. “What used to require manual checks and troubleshooting is now handled upfront, giving us smoother updates and a far more reliable experience for our employees.”

Where Hotpatch is available, we apply security updates without a reboot, which cuts downtime and helps us move faster on critical fixes. An automated readiness layer checks prerequisites, fixes common blockers, and confirms that devices are ready before rollout.

How we use it

• Enroll eligible devices in Autopatch and map them to the right scope so ownership, reporting, and break‑glass procedures are clear.
• Build rings that reflect business priority and user profiles (e.g., VIP laptops, frontline kiosks, engineering workstations, and lab devices).
• Enable Hotpatch on supported SKUs and confirm policy alignment so security updates apply without restarts where possible.
• Run readiness checks that verify update agent health, policy state, storage and battery requirements, VPN reachability, and available maintenance windows.
• Auto‑remediate common blockers such as stale update caches, missing prerequisites, paused services, or conflicting policies before a device enters the next ring.
• Start with small cohorts, monitor early signals like install rate and post‑update stability, validate rollback paths, then expand the scope deliberately.

Operational checks

• Ring coverage ensures eligible devices are actually assigned to a ring and not stranded outside the managed flow.
• App and driver smoke tests validate business‑critical apps, kernel drivers, and peripherals on pilot cohorts before broad rollout.
• Safeguard holds and known‑issue tracking are able to watch for vendor or service flags, which can pause or throttle a ring until a fix is available.
• Rollback readiness confirms who owns the decision, what steps they follow, and how telemetry proves the rollback succeeded on affected devices.

Why it helps

• Continuous movement shortens exposure windows because healthy rings advance without waiting for a fixed date.
• Fewer interruptions improve user experience, as Hotpatch removes the need for restarts on supported devices.
• Higher success rates come from automated readiness and remediation, removing predictable failures before deployment.

Best practices

• Use consistent device tags so rings map cleanly to models, regions, and business units, which keeps targeting and reporting trustworthy.
• Keep pilots small and fast to find issues quickly, then scale once success criteria are met and rollback is validated.
• Communicate maintenance expectations in plain language so users know timing, restart behavior, and how to report problems.
• Pace by risk rather than calendar, advancing rings when health metrics and support signal quality are within thresholds.
• Review deployment dashboards daily during rollout, adjust ring size or cadence when error rates rise, and capture lessons learned for the next wave.

Note

• Hotpatch availability depends on your Windows edition and configuration, so confirm support and prerequisites as part of your scoping work.

Tip 6: Keep third‑party apps current with Intune Enterprise App Management

We use Intune Enterprise App Management to keep third‑party apps current without constant packaging work.

“Third-party apps fall out of date fast, so we’re standardizing how they’re updated. We do that with Enterprise App Management, which gives us reliable packages and keeps us moving at a steady cadence.”

Humberto Arias, senior product manager, Microsoft Digital

Third‑party software drives real risk: version drift, silent installers change, and manual packaging pipelines break at the worst time.

With Enterprise App Management, we select from a managed catalog, set assignment and update rules, and let the service handle new versions as they ship. We spend our time on exceptions, not routine updates.

“Third-party apps fall out of date fast, so we’re standardizing how they’re updated,” says Humberto Arias, a senior product manager in Microsoft Digital. “We do that with Enterprise App Management, which gives us reliable packages and keeps us moving at a steady cadence.”

This approach also improves the user experience. Updates arrive in predictable windows and dependencies are handled in a timely manner. We avoid surprise prompts and failed installs that generate tickets. When we do need to pause or pin a version, we scope it cleanly and document the reason.

How we use it

• Build a standard catalog that covers the common apps our users need and assign clear ownership for each title.
• Configure update behavior to auto‑update.
• Use rollout rings so pilots validate the installation success rate and app behavior before expanding to broad audiences.
• Scope assignments with device tags such as model, region, or business unit to simplify targeting and reporting.
• Monitor install and update status, investigate failures, and retry with adjusted timing or requirements when needed.
• Capture exceptions for apps that need holds or custom steps and set review dates to revisit the decision.

Scenarios we run

• Rapid response when a high‑risk CVE drops by prioritizing affected apps and moving them to the front of the update queue.
• Version cleanup by removing outdated or duplicate installers so devices converge on a single approved release.
• Conditional deployment for specialized teams by offering an app as available instead of required while still tracking adoption.

Why it helps

• Less packaging toil because the catalog supplies current installers and metadata.
• Faster patching for common apps because updates flow as they publish.
• Better compliance reporting because versions and assignments are consistent across rings and groups.

Best practices

• Keep an authoritative list of approved apps with owners, support notes, and rollback steps.
• Coordinate maintenance windows for high‑impact apps so users can save work before enforced updates.
• Require pilots for any app with add‑ins or drivers and validate workflows with real users before scaling.
• Use uninstall assignments to remove unapproved or vulnerable software and block reinstallation where needed.
• Document app‑level exceptions, including the rationale and a date to re‑evaluate.

Notes

• Some apps need pre-install checks or post-install steps, so include scripts or detection rules where required.
• Track license terms and usage for commercial titles so updates do not outpace entitlements.

Tip 7: Close the loop with Defender Vulnerability Management and Intune security tasks

We use Microsoft Defender Vulnerability Management with Intune to turn exposure insights into targeted actions that close risk fast.

“The Intune Vulnerability Agent gives us a clear list of issues by device and owner. It shortens our path from finding a problem to fixing it.”

Harshitha Digumarthi, senior product manager, Microsoft Digital

Incidents don’t end when we spot a CVE. They end when devices are fixed and verified.

Vulnerability Management gives us an AI-powered live inventory of devices, software, and configurations, then connects that inventory to known threats. It shows which versions run where, highlights misconfigurations, and explains why a device is at risk. We see the problem and the cause, not just a risk score.

“The Intune Vulnerability Agent gives us a clear list of issues by device and owner,” says Harshitha Digumarthi, a senior product manager at Microsoft Digital. “It shortens our path from finding a problem to fixing it.”

It also ranks what to fix first. Factors like severity level, exploit availability, active attacks, and business context all feed into the priority list, so that commensurate effort goes where it’s needed most. The service recommends specific actions such as updating, uninstalling, reconfiguring, or applying a policy as appropriate.

From there, it pushes the work into our change tools. Tasks flow to Intune, Autopatch, and Enterprise App Management so the remediation is traceable. Exceptions are tracked, including data on owners, compensating controls, and review dates. Closure is verified by watching exposure decrease and confirming the fix landed with the intended devices.

How we use it

• Review exposure by CVE, software, and device group to see where risk concentrates.
• Prioritize based on business impact, internet exposure, and privilege level so high‑value targets move first.
• Select the fix that fits the issue, including app updates through Enterprise App Management, OS and quality updates through Autopatch or Hotpatch (where supported), firmware and drivers through Intune update management, or policy changes for configuration weaknesses.
• Target the right scope using tags for model, region, and business unit so remediation lands where it’s needed.
• Set deadlines and user experience settings that balance urgency with productivity.
• Validate closure by rechecking exposure, confirming install success, and watching support signals for regressions.

What we monitor

• Exposure trends over time, to prove that remediation is reducing risk.
• Top vulnerable apps and models, so effort tracks where it matters most.
• Noncompliant devices and owners, so follow‑ups are direct and accountable.
• Exceptions that need compensating controls, documented rationale, and a review date.

Why it helps

• Fewer handoffs because the same team that sees risk can initiate remediation.
• Measurable outcomes because exposure and deployment data live in connected systems.
• Consistent execution because rings, tags, and approvals follow the same patterns as other updates.

Best practices

• Keep device tags authoritative so targeting and reporting stay reliable.
• Use pilots even for urgent fixes to catch compatibility issues before broad rollout.
• Link vulnerability records to Intune assignments so audit and learning loops are clear.
• Communicate clearly with affected users about timing, restarts, and how to report problems.
• Document exceptions with owners and expiration dates so temporary holds don’t become permanent.

Notes

• Not every fix is an update, and some issues require a configuration change or feature disablement with clear rollback steps.
• Least‑privilege access and standard approvals keep remediation fast without expanding risk.

Key takeaways

Our approach for managing devices and updates has changed. We shifted device and update management from manual hunting and ad hoc remediation to a connected loop that starts with a question and ends with verified resolution—reducing investigation time and speeding recovery.

A few lessons stand out:

• Make natural language work by grounding it in trust. Natural language becomes a force multiplier when insights are drawn from authoritative data and access is tightly scoped.
• Keep pilots small, fast, and intentional. Focused pilots surface issues early without slowing momentum or introducing unnecessary risk.
• Standardize signals to build confidence. Consistent tagging and clear ownership make reports, deployment rings, and rollbacks easier to interpret and trust.
• Control exceptions with discipline. Every exception requires a written rationale and a review date, ensuring temporary holds don’t become permanent policy.
• Close the loop—every time. Verification matters as much as detection. We confirm outcomes and capture learnings to continuously improve the next cycle.

What we’re improving next:

• Strengthen question‑to‑action flows. We’re deepening prompts and playbooks that connect Security Copilot and Intune so operators can move from investigation to scoped change in a single flow.
• Expand Hotpatch adoption and measurement. As support broadens, we’re increasing usage and measuring the impact on downtime, reliability, and user experience.
• Grow app coverage with clearer stability rules. We’re expanding Enterprise App Management while enforcing stronger version‑pinning guidance where predictability is critical.
• Automate deployment decisions. Additional automation around ring placement, readiness checks, and rollback triggers will allow deployments to adapt to live health signals.
• Accelerate investigations with reusable telemetry. We’re developing richer telemetry patterns and reusable KQL in Visual Studio Code to reduce noise and speed repeat investigations.

It’s a continuing evolution of our awareness and capabilities in device management, and we’ll keep improving on it, one loop at a time.

Try it out

Manage and secure your devices with Microsoft Intune.

Related links

• Learn how Microsoft Security Copilot integrates with Microsoft Intune.
• Explore how we’re transforming security and compliance with Windows Hotpatch.
• Read more about Windows Autopatch.
• Discover how Microsoft Defender Vulnerability Management helps remediate device vulnerability.
• Find out how Intune Enterprise App Management enables app discovery and deployment

The post Read our seven tips for shifting to a ‘cloud-native’ device management strategy appeared first on Inside Track.

At Microsoft Digital, the company’s IT organization, we’re embracing this as Customer Zero for the company.

What does that mean?

It means that we’re testing and shaping new Windows 11 features before they ship to customers. And as such, we’re helping the company reimagine what the OS can do for enterprise users in an AI-first world. We’re also helping the company transform the tools and processes we and our customers use to manage the Windows devices that our employees use to do their work.

“Windows 11 is our foundation for the future of work. We’re helping to build an OS that’s not just reactive—it’s predictive. It understands context, adapts to users, and helps IT teams stay ahead of the curve.”

Sean MacDonald, partner director of product management, Microsoft Digital

When we rolled out Windows 11 across Microsoft in 2021, we wanted to modernize the Windows experience for our global workforce. That meant moving beyond the legacy of Windows 10 and building a platform that’s smarter, more secure, and easier to manage. It also meant working closely with engineering teams to ensure that what we deploy internally reflects what customers need externally.

“Windows 11 is our foundation for the future of work,” says Sean MacDonald, partner director of product management at Microsoft Digital. “We’re helping to build an OS that’s not just reactive—it’s predictive. It understands context, adapts to users, and helps IT teams stay ahead of the curve.”

This transformation isn’t happening in isolation. It’s part of a broader organizational commitment to AI across Microsoft. From the integration of Copilot into dozens of Microsoft products to intelligent device management, we’re aligning every layer of the stack to deliver smarter experiences.

And we’re doing it because the time is right. The end of Windows 10 support is here, and Windows 11 is the essential solution for organizations seeking the enhanced productivity, security, and personalized experiences that AI makes possible.

Embracing a secure and efficient update environment

Keeping Windows 11 secure and up-to-date has evolved into a streamlined, intelligent process.

With Windows Autopatch, we’ve automated the deployment of updates across our enterprise.

But automation doesn’t mean losing control. The management tools available across Microsoft Intune and Windows allow us to exercise complete control over updates. We can leave Autopatch to make patching decisions, or we can dictate how any part of the process works—evaluate and select which updates to perform, define the rollout structure and schedule, and monitor the updates.

“Autopatch update readiness takes us to a new level with Windows 11 updates. It allows us to be proactive, rather than reactive in ensuring our Windows devices are in a ready state to seamlessly update, which minimizes disruptions and distractions to our employees.”

Dave Rodriguez, principal product manager, Windows team, Microsoft Digital

Autopatch lets us tailor rollouts to match our business structure. We’ve created custom Autopatch groups of up to 50 rings so we can deploy updates to the right people at the right time.

This flexibility is critical. It means we can schedule around sensitive periods like year-end close, define grace periods, and even choose which updates to deploy—feature, driver, or quality.

But the real magic happens behind the scenes.

With Windows 11 and Autopatch, we’re not just reacting to issues—we’re anticipating them. That’s where the Autopatch update readiness (AUR) comes in. It adds a new layer of resilience to our update management strategy.

Update readiness continuously monitors device health and update compliance across the enterprise.

By analyzing real-time telemetry, update readiness flags irregularities early and recommends targeted fixes.

“Autopatch update readiness takes us to a new level with Windows 11 updates,” says Dave Rodriguez, a principal product manager on the Windows team in Microsoft Digital. “It allows us to be proactive, rather than reactive in ensuring our Windows devices are in a ready state to seamlessly update, which minimizes disruptions and distractions to our employees.”

“Hotpatching has been a game-changer for keeping our devices secure without disrupting work. Security updates take effect immediately—no reboot required. That’s a big deal.”

Harshitha Digumarthi, senior product manager, Windows team, Microsoft Digital

One of the biggest wins?

Hotpatch, which allows us to apply most of our monthly security updates without our employees needing to restart their devices, which has been huge for our productivity.

“Hotpatching has been a game-changer for keeping our devices secure without disrupting work,” says Harshitha Digumarthi, a senior product manager on the Windows team in Microsoft Digital. “Security updates take effect immediately—no reboot required. That’s a big deal.”

Hotpatch works by modifying in-memory code to silently apply updates in the background. It’s especially valuable for operations that require high availability.

“We’re seeing a shift from device-centric recovery to user-centric personalization. It’s not just about getting the machine back—it’s about getting the person back to work.”

Markus Gonis, senior service engineer, Microsoft Digital

Together, hotpatch, update readiness, and Autopatch are helping us transform how we manage updates. We’re not just deploying tools—we’re reshaping business critical processes.

Protecting data using Windows Backup and Restore for Organizations

With Windows 11, we’ve redefined what backup and restore means for enterprise users with Windows Backup and Restore for Organizations. It’s not just about getting a device back online—it’s about restoring the user’s experience.

When a user signs into a new device with their Entra ID, they can select a backup to automatically restore their Microsoft Store app configurations, settings, and preferences. It’s seamless. It’s secure. And it’s fast.

“We’re seeing a shift from device-centric recovery to user-centric personalization,” says Markus Gonis, a senior service engineer on the Windows team in Microsoft Digital. “It’s not just about getting the machine back—it’s about getting the person back to work.”

This matters. Especially in large organizations where device turnover is constant and downtime is costly.

With Entra ID, we can automatically enroll devices into Microsoft Intune for management. That means IT policies, security configurations, and compliance settings are applied instantly. No manual setup. No waiting.

And because the restore process is tied to the user’s identity, it works across devices. Whether it’s a laptop refresh, a lost device, or a hardware upgrade, users get their familiar environment back—apps, layout, even their desktop background.

“Windows 11 is designed for fast deployment and compatibility,” Gonis says. “We’ve seen up to 25 percent faster deployment times compared to Windows 10. That’s a huge win for IT teams.”

This isn’t just about convenience. It’s about resilience.

By combining Entra ID with modern device management, we’ve built a recovery system that’s secure by default. Data is encrypted. Access is conditional. And IT retains full control over who can restore what, when, and where.

Capturing the power of AI-enabled apps and experiences

Windows 11 is bringing intelligent experiences to the forefront, and we’re seeing it firsthand at Microsoft Digital. From productivity to security, AI is transforming how our people work.

Windows Recall is an opt-in AI-powered feature built directly into Copilot+ PCs with Windows 11. It’s designed to solve a problem every person knows too well: Finding something you’ve already seen.

Recall allows you to search across time to find the content you need. Just describe how you remember it, and Recall retrieves the moment you saw it. Once opted-in snapshots are taken periodically while content on the screen is different from the previous snapshot. The snapshots of your screen are organized into a timeline. Snapshots are locally stored and locally analyzed on your PC. Recall’s analysis allows you to search for content, including both images and text, using natural language.

Here are its core capabilities:

• Semantic AI-powered search. No need to recall exact filenames. Just describe what you remember—like “blue sustainability slide from last meeting”—and Recall uses on-device AI to surface images or text that match the description.
• Full user control and privacy. IT admins have a full set of controls to manage security and privacy when enabling the Recall feature for the enterprise. Once enabled by enterprise admins, you as the end user then have the choice to opt in to enable snapshots on your machines.
• Explore content with a visual timeline. Recall periodically captures screenshots of your active window and displays them in an interactive, chronological timeline. When you need to revisit something, you can simply scroll through your past activity or jump directly to the specific moment you remember seeing it.
•  Granular snapshot management. You choose which apps and websites to include or exclude. You can pause snapshot capture, delete past captures, and set retention limits (e.g., 30, 60, 90, or 180 days) to manage storage and privacy. And IT admins can control how these capabilities work for the entire organization.
• All snapshots, indexing, and AI processing occur on-device. Recall runs completely locally—no data leaves your PC.It never shares your data with Microsoft or third parties, nor across different user accounts on the same device.

Recall doesn’t just remember—it protects. IT admins can control snapshot storage, retention policies, and even filter which apps and websites are recorded.

That’s where enterprise-scale controls come in.

“We helped define these controls. We tested them to validate they worked as expected.”

John Philpott, principal product manager at Microsoft Digital

Microsoft Digital partnered with the Purview and Intune product teams to help build a rich set of controls that give IT full visibility and governance over Recall’s data store. That includes sensitivity labels, data loss prevention (DLP) policies, and tenant trust reviews—all designed to keep enterprise data safe.

Purview and Intune provide the level of control that IT admins need to ensure that Recall respects the security and privacy concerns of the enterprise and the end user.

If a document is labeled “Highly Confidential,” Recall won’t index it. If a meeting is tagged “Recipients Only,” it won’t be captured. Purview admins can decide exactly which sensitivity levels are allowed in Recall and which are excluded.

Recall’s content redaction feature automatically detects and removes highly confidential information from screen snapshots based on Purview sensitivity labels. Users can work with both sensitive and non-sensitive documents on the same screen without risk of accidental exposure.

“We helped define these controls,” says John Philpott, a principal product manager within Microsoft Digital. “We tested them to validate they worked as expected.”

Implementing Windows 11 for the enterprise

Windows 10 support officially ended on October 14, 2025. Still, many companies have not yet made the needed move, something that Microsoft would like them to do as soon as possible.

At Microsoft Digital, we’ve already made the leap. We’ve deployed Windows 11 across our internal fleet, and we’ve learned what works and what doesn’t.

The most important thing? Have a plan and a phased approach.

“We didn’t try to do everything at once,” Digumarthi says. “We went slow, monitored help desk calls, and paused when needed. It wasn’t about speed—it was about getting it right.”

That phased approach helped us avoid surprises. We used security groups to segment users, deployed in waves, and ran parallel communication campaigns to keep everyone informed. “We built tech web pages, sent individual emails, and used Viva Engage for direct outreach,” Gonis says. “We wanted users to know what was coming and why.”

Organizations have options. They can upgrade to Windows Pro to Windows Enterprise. They can subscribe to Windows 365, which provides access to Windows 11 in the cloud. And they can extend the life of Windows 10 devices with Extended Security Updates (ESU).

Windows 365 lets you keep older hardware while giving users a modern experience. You get ESUs at no extra cost, and you don’t have to manage license keys or deploy images.

With tools like Autopatch and Intune, deployment is faster and easier. Compatibility is strong. And support is built in.

Looking ahead

We’re just getting started.

At Microsoft Ignite, we’re unveiling new capabilities that push the boundaries of what’s possible with AI and automation. Expect deeper integration between Windows and Microsoft Defender, new agentic workflows, and expanded support for AI-driven security operations.

We’re expanding the update readiness initiative, introducing carbon-aware updates in Autopatch, and expanding privacy capabilities in Recall.

Baseline Security Mode is growing, too, with more features, better reporting, and stronger baselines coming soon.

And we’ll keep telling the story. Start with the tools. Lean on the community. And let us help you make the leap to a more intelligent and secure enterprise powered by AI and Windows 11.

Key takeaways

Here are several practical steps you can take right now to maximize your transition to Windows 11 and harness the full potential of its AI-powered capabilities:

• Understand Windows 11’s AI-driven transformation. Learn how Windows 11 leverages artificial intelligence to enhance productivity, security, and user experiences across your organization.
• Discover new enterprise features and deployment strategies. Explore the latest tools and best practices for rolling out Windows 11 efficiently, including advanced management and security capabilities tailored for businesses.
• Learn from Microsoft Digital’s role as Customer Zero. Benefit from Microsoft Digital’s firsthand insights and lessons learned as the initial adopter of Windows 11 within a large enterprise environment.
• Explore migration options. Review your choices for upgrading to Windows 11, such as moving to Windows 11 Pro or Enterprise, subscribing to Windows 365, or leveraging Extended Security Updates for legacy devices.
• Prepare for what’s next. Stay ahead by planning for upcoming features, security enhancements, and innovations that will continue to shape the future of Windows in the enterprise.

Try it out

• Learn more about moving to Windows 11 and download our onboarding kit.
• Start using Windows Autopatch.

Related links

• Check our Microsoft Ignite Windows news announcements.
• Learn more about AI improvements to Windows that we’re announcing at Microsoft Ignite.
• Learn how we’re accelerating workplace productivity at Microsoft with Windows Recall.
• Find out more on how we’re transforming security and compliance at Microsoft with Windows Hotpatch.
• Check out how we’re hardening our defense at Microsoft with Baseline Security Mode.

The post Supercharging our enterprise with Windows 11 and AI PCs appeared first on Inside Track.

Recall on Copilot+ PCs can help. It uses whatever details you remember about the missing item to find it for you.

Our team in Microsoft Digital, the company’s IT organization, has deployed Recall, giving our employees access to its AI-powered memory in a secure and managed environment. Recall now integrates with Microsoft Purview, which layers enterprise-grade security and compliance controls on top of Recall’s local AI capabilities.

How Windows Recall works

Windows Recall is an AI-powered feature built directly into Copilot+ PCs with Windows 11. It’s designed to solve a problem every person knows too well: Finding something you’ve already seen.

Here are its core capabilities:

• Explore content with a visual timeline. Recall captures periodic screenshots of your active window and visualizes them in an explorable, chronological timeline. When you need to revisit something, you can scroll through your activity or jump straight to the moment you remember seeing it.
• Semantic AI-powered search. No need to recall exact filenames. Just describe what you remember—like “blue sustainability slide from last meeting”—and Recall uses on-device AI to surface images or text that match the description.
• Full user control and privacy. IT admins have a full set of controls to manage security and privacy when enabling the Recall feature for the enterprise. Once enabled by enterprise admins, you as the end user then have the choice to opt in to enable snapshots on your machines. Only your device stores them, and they’re encrypted locally via BitLocker or Device Encryption. Access requires Windows Hello biometrics (your face or fingerprint), which ensures only you can view them.
•  Granular snapshot management. You choose which apps and websites to include or exclude. You can pause snapshot capture, delete past captures, and set retention limits (e.g., 30, 60, 90, or 180 days) to manage storage and privacy. And IT admins can control how these capabilities work for the entire organization.
• All snapshots, indexing, and AI processing occur on-device. Recall runs completely locally—no data leaves your PC.It never shares your data with Microsoft or third parties, nor across different user accounts on the same device.
• Jumping back in. Windows Recall doesn’t just help you find something you saw before, it helps you pick up where you left off, getting right back to the page, slide, or chat in Word, Excel, PowerPoint, and Teams, as well as in an app, document, or webpage.

It’s like having a photographic memory for your digital life. Recall is a productivity booster. But it’s also a security-first, enterprise-ready feature.

“We’ve been working for over a year with Microsoft Digital to understand how Windows Recall will function best in the enterprise environment. They helped us get it ready for our customers.”

Adam Wayment, principal product manager, Windows product team

To ensure security, privacy, and governance, the Windows product team turned to our team in Microsoft Digital, the company’s IT organization, to test Windows Recall. This happened after early users of the feature suggested that better controls needed to be put in place. Our team helped the product group design and deploy better enterprise controls.

This collaboration helped shape Recall into a feature that works for everyone—from individual users to global enterprises.

“We’ve been working for over a year with Microsoft Digital to understand how Windows Recall will function best in the enterprise environment,” says Adam Wayment, a principal program manager lead for Windows Recall. “They helped us get it ready for our customers.”

Establishing security and privacy for the enterprise

Recall doesn’t just remember what you’ve seen. It remembers what it should—and forgets what it shouldn’t.

That’s where enterprise-scale controls come in.

Comprehensive controls are at the center of deploying Recall to the enterprise.

Microsoft Digital partnered with the Purview and Intune product teams to help build a rich set of controls that give IT full visibility and governance over Recall’s data store. That includes sensitivity labels, data loss prevention (DLP) policies, and tenant trust reviews—all designed to keep enterprise data safe.

Purview and Intune provide the level of control that IT admins need to ensure that Recall respects the security and privacy concerns of the enterprise and the end user.

“We helped define these controls. We tested them to validate they worked as expected.”

John Philpott, principal product manager at Microsoft Digital

If a document is labeled “Highly Confidential,” Recall won’t index it. If a meeting is tagged “Recipients Only,” it won’t be captured. Purview admins can decide exactly which sensitivity levels are allowed in Recall and which are excluded.

That means no screenshots of HR portals. No copies of credentials. No risk of sensitive data lingering on a user’s device.

Recall’s content redaction feature automatically detects and removes highly confidential information from screen snapshots based on Purview sensitivity labels. Users can work with both sensitive and non-sensitive documents on the same screen without risk of accidental exposure. Only permitted content is captured during multitasking or collaborative activities. That Excel document with employee salary information? It never becomes part of the snapshot.

IT admins also have policy controls to manage access to Recall. They can set retention limits. They can restrict access by role, ensuring Recall is only available to the right people. And they can block specific apps and websites from being captured.

“We helped define these controls,” says John Philpott, a principal product manager within Microsoft Digital. “We tested them to validate they worked as expected.”

“Security is at the center—data is encrypted on the device. Recall uses the latest technology for security, from all the controls on the backend right up to user authentication, including Windows Hello with face or fingerprint recognition required to access the data.”

Adam Wayment, principal product manager, Windows product team

This wasn’t just about building features. It was about building trust.

We worked to identify the key scenarios and apps—including Word, Excel, PowerPoint, Outlook, Teams, and Edge—to prioritize what needed protection. We made sure Recall could handle the real-world complexity of enterprise data.

It was a massive undertaking, requiring collaboration between Microsoft Digital, the Recall product team, and the products teams from all the apps with which Recall interacts. It came down to creating useful functionality while protecting our data.

“Security is at the center—data is encrypted on the device,” Wayment says. “Recall uses the latest technology for security, from all the controls on the backend right up to user authentication, including Windows Hello with face or fingerprint recognition required to access the data.”

These controls were built in collaboration with the product team, with our Microsoft Digital team acting as Customer Zero. We helped define tenant trust requirements and test every scenario—credentials, certificates, internal portals, and more. And now Recall is stronger because of it.

Moving forward

Our team in Microsoft Digital learned a lot helping the Windows product team build and test Recall.

Some lessons were technical. Some were strategic. All of them made the product better.

One of the first challenges we tackled was credential protection. We wanted to make sure passwords, certificates, and other sensitive data wouldn’t be captured. The product team agreed, and we helped them build the exclusion logic that ensures Recall ignores credential-related content.

Another lesson came from deployment.

Recall is disabled by default in enterprise builds. That meant we had to work through IT policy hurdles to get it up and running. We hit race conditions. We found bugs. But we fixed them. And we made the deployment smoother for everyone.

We also learned the value of centering enterprise needs early in the deployment.

When Recall first launched, we focused on consumers. But customer feedback reinforced how powerful the tool could be for information workers in enterprises like ours. We built tenant trust requirements. We ran evaluations. We created a checklist of what needed to be done. And we did it.

That process changed the conversation, and we’re not done. We’re still listening, still improving, still building.

Key takeaways

Here are four actions you can take right away as you consider deploying Windows Recall in your organization:

• Test at scale. Roll out Windows Recall to a wide group to uncover complex issues—especially those that don’t show up in smaller test environments.
• Start with enterprise needs and roles. Engage enterprise stakeholders early review which roles should have access and shape feature requirements such as tenant trust and data-handling policies.
• Collaborate for improvement. Test controls early to ensure that they are configured to provide the level of security and privacy required by your organization.
• Build confidence for adoption. Use thorough evaluations and checklists to ensure readiness, leading to greater trust among users, partners, and teams.

Try it out

Retrace your steps with Windows Recall.

Related links

• Learn more about Windows Recall.
• ‘Click to Do’ in Recall: find out how to do more with what’s on your screen.
• Ensure privacy and control over your Windows Recall experience.
• Learn how the NPU is paving the way toward a more intelligent Windows.
• Learn how we’re supercharging our enterprise with Windows 11 and AI.
• Check our Microsoft Ignite Windows news announcements.
• Learn more about AI improvements to Windows that we’re announcing at Microsoft Ignite.  
• Find out more about our Microsoft Purview-related news from Microsoft Ignite. 

The post Accelerating workplace productivity at Microsoft with Windows Recall appeared first on Inside Track.