Public Sector ยท Windows 11 Transformation
End-to-end modern endpoint delivery for the Shared Technology Services partnership across four London boroughs: planned on evidence, secured to NCSC baseline, delivered without disrupting live services.
Users transformed
Across four London boroughs
Applications tested
Compatibility-checked before cutover
Boroughs served
Brent, Southwark, Lewisham & LGA
The challenge
Shared Technology Services (STS) is a shared IT function supporting Brent Council, Southwark Council, Lewisham Council and the Local Government Association: four separate organisations with a combined estate of approximately 20,000 Windows 10 devices, over 200 line-of-business applications, and a hard deadline set by Windows 10 end-of-support.
The challenge wasn't simply installing Windows 11. It was doing so across a complex, politically sensitive shared-services model where any disruption to one borough affected all four, while simultaneously modernising device management from legacy on-premises infrastructure to a cloud-native Intune and Autopilot stack.
Previous attempts to move to modern management had stalled. The estate had accumulated years of Group Policy, custom configurations and application dependencies that nobody had fully documented. STS needed a partner that could work from evidence, not assumptions.
The solution
Before any device was touched, we mapped the estate: every application, every Group Policy object, every dependency. That evidence drove every decision that followed.
Autopilot provisioning replaced manual imaging across the entire estate. Devices enrol, receive policy, install applications and reach a compliant state without engineer intervention, and without a visit to the borough's IT team.
Conditional Access, Intune compliance policies and Entra ID were configured to the NCSC and Microsoft security baselines. Every device must prove compliance before it can reach council data, regardless of network location.
Over 200 applications were compatibility-tested against Windows 11. Those requiring remediation were re-packaged and validated before the rollout began: no surprises for end users on day one.
Legacy VPN and domain-join dependencies were replaced with cloud-native alternatives. Users connect securely from anywhere, with the same experience in a council office, at home or in the field.
The impact
The entire estate migrated to Windows 11 before the Windows 10 end-of-support date, with no extended-support costs and no security exposure.
Intune, Entra ID and Autopilot replace the legacy on-premises infrastructure. New devices are provisioned in hours, not days, without engineer involvement.
NCSC-aligned zero-trust controls are enforced across all 20,000 devices. Compliance is continuous and automated, not a point-in-time snapshot.
The compatibility exercise surfaced applications that were redundant, duplicated or unused. STS carried forward only what was needed, reducing licensing, support and attack surface.
A single, consistent management plane now covers all four organisations. Policies, compliance and reporting are unified, while each borough retains its own data boundary.
The transformation was phased and evidence-led. Services stayed live throughout. Borough staff experienced the upgrade as a seamless improvement, not an IT project.
Whether you're planning a Windows 10 to 11 migration, modernising device management or securing a complex shared-services estate, we've delivered it before and can do it again.