Ship the laptop. They sign in. It's already secured.

Employee onboarding without the IT bottleneck. Order a Dell to your new hire. It arrives encrypted, managed, and ready to sign in to.

Get started → How it works

$3,000 one-time · no ongoing fees · every laptop after that ships ready

Live in your browser when you deploy

§ 02   built by

Built by someone who's done this at scale.

Dylan Lang
Founder · The Galway Group

10+ years running Microsoft 365 and Azure at scale. 500+ subscriptions, 2,000+ VMs, Intune across finance, healthcare and government, where the audit doc is never optional.

View on LinkedIn
“I built Baselines because too many small teams were stuck choosing between an MSP retainer, weekends learning Intune, or leaving devices unmanaged. So I shipped what I wished I'd had, the deployment a senior Intune admin would build, ready in an afternoon.”

§ microsoft certifications

Endpoint Administrator · Intune
Associate
Azure Solutions Architect
Expert
Microsoft 365 Administrator
Expert

The Endpoint Administrator cert is for the exact stack Baselines deploys. Microsoft Intune.

§ 03   how it works

You do this once. Every laptop after it ships ready.

About twenty minutes, once. Every control lands in the audit reference on the right, mapped to SOC 2, ISO 27001 and CIS.

01

Sign in to verify your tenant

Read-only. Confirms Intune licensing before you pay.

02

Buy in the portal

Stripe checkout. Auto-links to your tenant.

03

Watch the live deployment

Runs in your browser, a checkmark per step. Every policy is logged to your audit reference →

04

Admin consent, automatic

No second sign-in, no permissions pop-up.

05

Order the laptop. Ship it to them.

Link your tenant to Dell once. Every laptop after that ships pre-registered.

§ 04   employee onboarding

Day one, from your new hire's side.

01

The box arrives at their door

Shipped straight from Dell. No imaging, no staging, no setup call.

02

They sign in with their work email

No local account, no setup wizard, no call to IT. That is the whole flow.

03

By their first coffee, it is a company laptop

Disk encrypted. Defender, firewall and updates on. Microsoft 365 installed. MFA enforced. Neither of you did a thing.

§ and on your side

  • Hiring stops waiting on IT. Onboarding is an order, not a project.
  • You never touch the device. No imaging bench, no USB sticks, no remote session.
  • Identical on laptop two hundred. It is a policy, not a checklist.
  • Every control is documented. Hand the reviewer the audit reference instead of writing one.

§ 05   what you save

The other ways to get here.

You are buying the decisions, not the twenty minutes. The alternative is a 1–2 week consultant project at $7,500–$12,000, then $1,500–$3,500/mo to keep it managed.

Phase / Task MSP / DIY Baselines
Discovery, scoping, & kickoff~6 hrOpinionated defaults
Azure AD app + AutoPilot hash-import script (the painful one)~8 hrAutomatic
30+ Settings Catalog policies (security baseline)~12 hrAutomatic
BitLocker, Defender, & compliance policies~6 hrAutomatic
Conditional Access (Require MFA)~3 hrAutomatic
Total (incl. testing + handover) ~59 hr / ≈ 1.5 weeks < 5 min, live
Cost at typical rates $7,500 – $12,000 $3,000

§ 06   frequently asked

Common questions.

Microsoft Intune. It's bundled with M365 Business Premium, M365 E3 / E5, EMS E3 / E5, and is also available standalone. Every user whose device you manage needs a licence, though the admin running the deploy does not need one personally. We check your tenant for an active Intune service plan before changing anything.
No. Every profile we create is checked by name first, if one with the same name already exists, we skip it. Your existing custom configurations are untouched.
Because the automation is the cheap part. The cost is in knowing which settings to apply and which to leave alone, which is the part that takes years to learn and is expensive to get wrong. Every policy here is a decision: BitLocker with XTS-AES 256, ASR shipped in audit mode so it cannot break your users on day one, MFA enforced with the deploying admin excluded so you cannot lock yourself out. You also get the audit reference document, every control written up and mapped to SOC 2, ISO 27001 and CIS, which is the artifact most people end up paying a consultant separately to produce. The twenty minutes is how it is delivered, not what you are buying.
Not today. Baselines deploys Microsoft 365 Apps, so a new laptop arrives with Word, Excel, Outlook and Teams ready to go. Your line-of-business applications are not part of the package. Once the baseline is in place you can add your own apps in Intune the normal way, and they will deploy to every enrolled device alongside ours.
Dell is the supported ordering route today and the only one we walk you through. Everything else still works: the baseline, AutoPilot, the security policies and the audit document apply to whatever hardware you already own. Existing laptops enrol by joining Entra ID, and the importer we deploy registers them for AutoPilot on first check-in. You just place the order yourself rather than from inside the portal.
Your purchase isn't burned, if anything fails, the order stays valid and you can retry. Steps already completed are detected and skipped. Our complete-build guarantee covers the rest: if the automated deploy can't land a configuration, we manually finish it at no extra cost.
No. We never see your password, never store your access token beyond the deploy session, and have no recurring access. The Azure AD app we register lives in your tenant and you can revoke it at any time.

§ 07   working with a vcto?

Baselines is included with every vCTO plan.

Partner with The Galway Group and Baselines comes bundled, alongside bespoke Intune work, ongoing endpoint management, and device procurement through Dell, HP, and Lenovo.

See vCTO plans

§ Partner pricing

standalone   $3,000
vCTO partner   included · $0 extra
custom Intune   at plan rate
device procurement   Dell · HP · Lenovo

Average response time

Within one business day