AtlisoFor MSPs on Microsoft Intune
Intune says compliant. Your devices say otherwise.
Your baseline says it's configured. Atliso checks it actually happened, on every device in every client tenant, every night: BitLocker keys that never reached Entra ID, LAPS passwords that stopped rotating, devices Conditional Access is already blocking. Each one comes with the tested fix, so it's sorted before it becomes a helpdesk call.
No card to see your first results. 30 days free after that. No agent, read-only until you deploy a fix. Already using it? Sign in
Connects directly to
Microsoft Intune
Microsoft Entra ID
Microsoft Graph
Ten device checks, every night
What is actually true on each device, not what the policy says. This is a sample client after one night.
Also checked: drives with protection off · devices with no LAPS password · remediations failing quietly · devices that stopped checking in · non-compliant devices · Apple certificates expiring · Remediations licensing.
- High8 / 113
BitLocker keys missing from Entra ID
Encrypted, with no recovery key on file if they hit recovery
- Medium10 / 111
LAPS passwords not rotating
Compliant in Intune, unchanged for months
- High7 / 118
Windows versions out of support
Checked by edition: Pro and Enterprise end a year apart
Sample tenant from the live demo
Lands in your ticket queue
One ticket per issue, per client, with the affected devices and the fix attached. It closes itself when the next night's check confirms the fix.
Works with any PSA that creates tickets from email, such as Halo, ConnectWise and Autotask. No integration to set up: add your helpdesk address and send a test ticket.
New ticket
[Atliso BL-8YEX] High: Northwind Traders: BitLocker keys missing from Entra ID on 8 devices
Client: Northwind Traders Finding: BitLocker keys missing from Entra ID (High) Reference: BL-8YEX WHAT'S WRONG 8 devices are encrypted, with no BitLocker recovery key saved to Entra ID. If one of them goes into BitLocker recovery, nobody can get back into it. AFFECTED (8 devices) - NW-THI-1004 amelia.smith@northwind.example last check-in 14 Nov 2026 - NW-ELI-1017 harry.walker@northwind.example last check-in 13 Nov 2026 - NW-SUR-1030 sofia.brown@northwind.example last check-in 15 Nov 2026 - NW-THI-1043 arthur.wright@northwind.example last check-in 13 Nov 2026 - NW-LAT-1056 harry.taylor@northwind.example last check-in 15 Nov 2026
Same thread, once the fix lands
[Atliso BL-8YEX] Resolved: Northwind Traders: BitLocker keys missing from Entra ID
Built for running many client tenants
- All tenants, worst first
- Every client on one page, with high-severity counts, devices and last scan. Open any tenant in one click.
- Per-tenant rules
- Thresholds, checks on or off, and excluded kiosks or lab machines, set for each client.
- Client-ready report
- A printable report per tenant for the monthly review: what was found, what was fixed, what is still open.
- Fix tracking
- Each deployed fix shows how many devices it has cleared since, scan by scan.
Also: daily or weekly digests, Teams or Slack alerts, team roles for technicians and clients, and an audit log.
Your first client connected in two minutes
- 01
Sign in with Microsoft
Use your work account. No new password to manage.
- 02
Approve each client tenant
An admin of the tenant, or your delegated admin access, approves Atliso on Microsoft's consent screen. Revoke it any time in Entra ID.
- 03
Read the first report
About a minute per tenant. Nightly re-checks, fixes and alerts run through the 30-day trial.
Fix it, don't just report it
Every finding comes with the Atliso fix that was built and lab-tested for it. One click adds it to Intune Remediations, unassigned, so you pilot it on your terms. The next morning's scan shows which devices dropped off the list.
Each fix links to its guide on atliso.com: the full write-up of the problem and the script, published and tested before it ever reached the product.
What it can see
DeviceManagementManagedDevices.Read.AllList Intune devices, encryption and compliance state
BitlockerKey.ReadBasic.AllSee which devices have a recovery key in Entra ID (never the key itself)
DeviceLocalCredential.ReadBasic.AllSee when LAPS passwords were last backed up (never the password)
DeviceManagementScripts.ReadWrite.AllRead remediation results, and add Atliso fixes when you click Deploy
Organization.Read.AllTenant name and licences, to know whether Remediations are available
DeviceManagementServiceConfig.Read.AllExpiry dates of the Apple push certificate and enrolment tokens
DeviceManagementApps.Read.AllExpiry dates of Apple Apps and Books tokens
ProfilePhoto.Read.AllShow your team's Entra profile photos in Atliso
£12 per client tenant per month
Five tenants included for £60 a month, so you can start small. Single tenant £29 a month. Every plan starts with a 30-day free trial.
Questions MSPs ask
We already use inforcer or CIPP.
Keep them. They set policies and baselines across tenants, and Atliso does not replace them. It checks which devices did not get the baseline, and it does not add another dashboard to watch: findings go to the helpdesk you already use, as tickets.
How does it work across clients?
Connect each client tenant from one account and see them all on one page, worst first. Each tenant needs one of its own admins, or your delegated admin access, to approve it.
How does the trial work?
Connect a tenant and see every finding and affected device before adding a card. Nightly scans, one-click fixes and alerts run for 30 days once you add one. Nothing is charged until day 31, and you can cancel any time before.
Do I install anything on devices?
No agent. Atliso reads Intune and Entra ID through Microsoft Graph. Fixes run through Intune Remediations, the same way you deploy anything else.
Can it change my tenant?
Only when you press Deploy, and only by adding a remediation that is not assigned to anyone. You choose the pilot group in Intune before anything runs.
Does it read recovery keys or passwords?
No. It asks for the "ReadBasic" permissions, which show whether a key or password exists and when it was backed up, never the secret itself.
We are on Business Premium.
Everything works. Without Remediations licensing (E3/E5, A3/A5 or VDA), Atliso deploys each fix as an Intune platform script instead, still unassigned.
Who can see it?
Invite technicians as owners (deploy fixes, change settings) or viewers, and invite a client as a viewer of their own tenant. Every change is in the audit log.
See what's wrong on your clients' devices by tomorrow morning
Sign in with Microsoft, approve read access for a client tenant, and the first scan runs straight away.
Start free trial