National Australia Bank boosts staff productivity, device security with Microsoft Endpoint Manager

This story was created before our rebranding over to Microsoft Intune. All references to Microsoft Endpoint Manager and its benefits remain true to the valued core product: Microsoft Intune.

When National Australia Bank set out to create a modern workplace for its 32,000 workers, it focused on endpoint management. The bank made a quantum leap forward when it turned to the consolidated tool set in Microsoft Intune, making life easier and more productive for its workers and setting a new standard for compliance that enhances the digital workplace for everyone.

Bringing the NAB technology estate in line with its high customer service standards

As committed to positive social impact as it is to fiscal responsibility, Melbourne-based National Australia Bank (NAB) works hard to help its communities prosper. Keeping thousands of workers productive at more than 900 locations in Australia, New Zealand, and the Northern Hemisphere is not an easy task. NAB needed to modernize to support a large and mobile workforce.

But years of outsourcing device management to an external provider hadn’t significantly advanced the bank’s modernization plans. Furthermore, the difference between the requirements of the corporate and institutional banking group and the rest of the bank created the need for a dual IT environment. The corporate banking side of the company used one operating system; everyone else used another. That bifurcation challenged NAB’s support and security efficiencies. The bank needed to maintain a highly secure network along with its desire to modernize and create new efficiencies. Ironically, the corporate banking group’s conservative approach ultimately didn’t increase security. “We were falling behind the technology curve,” recalls Andrew Zahradka, Head of Workplace Compute Technology at NAB. He and the bank’s engineering team felt that the answer lay in committing to a single standard operating environment. “Windows 10 was the catalyst for retooling our environment and getting to where we are today—moving patch compliance from 60 to 97 percent across 45,000 endpoints.”

NAB turned to Microsoft Endpoint Manager, a unified platform that includes Configuration Manager and cloud-based Microsoft Intune that IT admins use to help secure, deploy, and manage all users, apps, and devices. The rollout heralds what Zahradka considers the new norm for IT performance. “In under three years, NAB’s Workplace Technology uplift was delivering a greater software delivery standard with far less deployment issues, resulting in a much greater end user experience,” he says.

“In under three years, NAB’s Workplace Technology uplift was delivering a greater software delivery standard with far less deployment issues, resulting in a much greater end user experience.”

Andrew Zahradka, Head of Workplace Compute Technology, National Australia Bank

Managing ahead of the curve with Endpoint Manager

Returning to the bank after two years of working elsewhere, NAB Technical Service Owner John Disco realized that the outsourcing company hadn’t moved modernization forward. Workstations were still running Windows 7, and the company’s emphasis on incident-based user support tied up support teams rather than empowering them to provide strategic momentum. “Without the ability to identify which client devices were going dark, the team couldn’t be proactive,” he says. “Our first priority was to install the latest version of Configuration Manager to optimize Windows 10 support.”

With executive management backing its plan and ending NAB’s outsourcing company contracts, the Technical Service team kicked off a modernization initiative dubbed Project Inception. There was a lot to tackle, such as the incumbent VPN that limited the number of remote users to just 5,000 a day, partly because of incompatibilities between that solution and NAB’s new micro-VPN cloud security service. At one point, eight or nine security software agents were deployed on NAB desktops, all competing for resources to the detriment of performance for the employees—a performance hit characterized by Disco as a “security tax.” And without full visibility into client devices on the network, the team’s patch compliance rate hovered around 60 percent. Much of the issue stemmed from the organization’s use of its incumbent patching product, a managed desktop solution. “When we switched to Configuration Manager, we discovered that our previous tool hadn’t identified a number of vulnerabilities even though it indicated that we had patched our fleet,” says Disco.

Project Inception improvements ultimately erased NAB’s previous limitations on remote work, making it possible for 30,000 people to work from home during COVID-19. “That wouldn’t have been possible if we hadn’t already embarked on our modernization journey,” adds Disco.

“When we switched to Configuration Manager, we discovered that our previous tool hadn’t identified a number of vulnerabilities even though it indicated that we had patched our fleet.”

John Disco, Technical Service Owner, National Australia Bank

Ramping up security and productivity with a consolidated tool set

The team further enhanced visibility into its environment with a cloud management gateway (CMG), a service that deploys in Azure and simplifies managing client devices over the internet. NAB now delivers Windows 10 as a task sequence by using Configuration Manager with the CMG. With co-management—the ability to manage devices concurrently with both Configuration Manager and Intune—the NAB technology team fast-tracks the task sequences needed to provision devices. “With the previous model, wait times made it necessary for me to have as many as four devices for the very technical work that I do,” says Disco. “It’s greatly simplified provisioning.” Adds Samir Younes, Senior Consultant Workplace Engineer: “We have the best of both worlds—Windows Autopilot in Configuration Manager to provision devices and Intune to configure them. That combination unlocked everything for us.”

The bank’s Microsoft endpoint management solutions fit neatly together with other Microsoft services and capabilities to close the loop on security. “Using Azure Active Directory with Configuration Manager and Intune made management easier—all devices are visible,” says Disco. “We also switched from our previous antivirus provider to Microsoft Defender for Endpoint, which vastly improved performance and contributed to increased compliance.”

Damian Cullen, Manager Engineer, Enterprise Mobility, NAB, needed to extend the modernization program to mobile devices. A fleet of 13,000 devices with access to email only has swelled to more than 24,000 with 80,00-plus Microsoft 365 applications under management. “Employees no longer have to enroll to see email and use other Microsoft 365 apps on their devices,” he says. “Mobile access to all of our productivity apps is a huge advantage for us.” He appreciates the ease with which the solution can manage technologies outside of the Microsoft family, especially when it comes to mobile application management. “With Intune, our staff can access applications outside of Office 365—even those that lack specific mobile application management apps. Employees can use them with the same degree of data protection in a BYOD scenario as they would otherwise, without having to go through mobile device management enrollment. That also checks the security box.”

“With Intune, our staff can access applications outside of Office 365—even those that lack specific mobile application management apps. Employees can use them with the same degree of data protection in a BYOD scenario as they would otherwise, without having to go through mobile device management enrollment. That also checks the security box.”

Damian Cullen, Manager Engineer, Enterprise Mobility, NAB

Creating a new standard for usability and security at NAB

Trust between a committed technology team and senior management propelled the changes. “NAB senior management gave us the freedom to do what needed to be done,” says Samir Younes, Senior Consultant Workplace Engineer at NAB. “That’s why we’re here today.” Having jettisoned the traditional “wipe and load” method for updating devices, NAB uses Configuration Manager, Windows Autopilot, and Intune to configure devices with the latest software and keep patches up to date.

The entire modernization initiative has changed everything for the bank’s technology team. “With a unified Microsoft solution set, we’ve created a new standard for usability and security,” says Disco. Zahradka wryly points out the contrast between the days when anything beyond a 60 percent patch compliance rate was deemed standard. “Senior management consistently & appropriately drive for higher patch level standards,” he says. “Now, our CIO isn’t satisfied with 97 or 98 percent.” And that success is driving a fresh approach for the bank. “We want to stay out in front,” says Zahradka. “We’ll adopt future releases of Microsoft technology as fast as possible.” NAB staff also benefit. “Now incidents are down by 30 percent, and people have grown to expect quality deployments and efficient desktops,” he adds. “That’s a direct result of our move to the cloud and modernizing the NAB digital workplace.”

The organization is currently rolling out Windows 11 and taking advantage of further productivity gains, setting the stage for continued technology leadership in the banking space. “We’ve created flexibility for our staff,” says Younes. “People can work from anywhere now. Our success in deploying a modern Microsoft workspace is their success.”