From export to verdict in days
Three steps. The first one is a file your endpoint team already knows how to produce.
Connect or export
- A read-only Intune or Configuration Manager connection, or a device inventory export as CSV.
- Endpoint analytics adds performance and reliability depth where you have it. It is optional.
- Nothing is installed on a device, and nothing is written back to your tenant.
Every device gets a verdict
- Each device is classified into a role class by hardware and application evidence, first matching rule wins.
- It is scored on age against class life, workload fit, measured performance, reliability and Windows 11 readiness, with the default weights shown below.
- One verdict comes out, with the reason shown next to it, in the words an endpoint lead would use.
Finance gets a plan
- A refresh plan by quarter, so procurement can phase orders and the service desk can phase deployments.
- Identified savings by cohort, the redeploy pool as upside, and the cost of doing nothing.
- A ledger that records what was executed, so identified savings become banked savings on the page where finance can see them. Every assumption is visible and editable.
Five signals, weighted
Age carries the most weight because it is the one signal every fleet has for every device. The other four are what stop age from deciding alone. Every weight and threshold is a setting with a live preview, so your endpoint lead can see what a change does to the split before it applies.
- Age against class lifeHow far the device is through the expected life of its class, in years, from the purchase or enrollment date.55%
- Workload fitWhether the applications seen in the last 180 days, and the GPU, match the class the device was bought as.20%
- Measured performanceStartup time, battery health and application responsiveness from Endpoint analytics where you have it.12%
- ReliabilityCrashes, blue screens and unexpected restarts over the last 90 days.8%
- Windows 11 readinessTPM 2.0, a supported processor and enough memory and storage to take Windows 11.5%
Two ways to run it
Most fleets start in export mode because it needs nothing from the tenant beyond a file. Connected mode is for fleets that want the verdicts to follow the devices between quarters.
Export mode
- Send an export. Verdicts and the savings floor come back within days.
- Re-run each quarter with a fresh export, so the plan follows the fleet.
- Export mode uses files sent through the secure upload link.
Connected mode
- A read-only connection to Intune or Configuration Manager through a dedicated app registration with read scopes only.
- Hardware detail such as processor and memory comes through read-only Microsoft Graph, which the standard device export does not carry.
- Runs in a US or EU region we operate, as you choose, or in your own Azure tenant behind your own identity provider.
- Verdicts refresh continuously, and the ledger updates as devices are retired or redeployed.
The first week, day by day
The initial report is delivered within five business days of receiving the export. We agree the Verdict Assessment schedule when we scope the work.
- Day 1
Export received and checked for completeness. Device classes and rules confirmed with your endpoint lead in a 30-minute call.
- Days 2 and 3
Every device classified and scored. The verdict split and a sample of reasons reviewed by an analyst, with any odd cohort queried back to you.
- Day 4
Assumptions checked against your prices and labor rates where you have them, or the class defaults where you do not.
- Day 5
Readout: the verdict split, identified savings with the sum check, the redeploy pool shown separately, calendar against evidence, cost of doing nothing, Windows 11 readiness and top findings. The PDF follows the same day.
Plan and ledger
Identified savings are estimates tied to specific decisions. The ledger records which decisions your team executes and which avoided purchases finance confirms. Each verdict your team executes moves its line from identified to executed, and each purchase finance records as avoided moves it to banked. The quarterly readout shows all three columns, so nobody has to take the headline on trust.
What we never touch
The read scopes and the export define the whole surface. There is nothing else to inspect.
Security and deployment in full- File contents, documents or mail. The read scopes cover devices, applications and configuration, and nothing else.
- Browsing history or keystrokes. There is no agent on any device, so there is nothing that could see them.
- Write permissions. Nothing is changed, assigned, wiped or retired in your tenant by us. Your team executes the plan from your own console.
- User identities beyond a device-to-user link. You can strip user names and email addresses from the export, and the report still works.
Get the refresh findings for your fleet
Send us the form and we will reply within one business day with a secure upload link and the export steps for your platform. The PDF follows within five business days of the export.