Microsoft Intune is Microsoft's cloud service for managing computers, phones, and tablets. Instead of setting up each device by hand, you define how company devices should be configured and secured, and Intune applies those rules to every enrolled device, wherever it is.
What Intune manages
Intune can manage Windows and Mac computers, iPhones and iPads, and Android devices. It handles both company-owned devices, which can be fully managed, and personal devices, where it can protect company data inside specific apps without controlling the whole device.
Enrollment
Devices have to be enrolled before Intune can manage them. Common methods include:
- Windows Autopilot: new Windows computers register to your organization and configure themselves when the employee signs in.
- Automatic enrollment: Windows devices joined to Microsoft Entra ID can enroll automatically.
- Apple Business Manager: company-purchased Macs, iPhones, and iPads enroll automatically through Automated Device Enrollment.
- Android Enterprise: separate work profiles on personal Android phones, or full management for company-owned ones.
Configuration profiles
Configuration profiles deliver settings to devices: Wi-Fi and VPN connections, BitLocker or FileVault encryption, Windows Update rings, browser settings, and restrictions such as blocking USB storage. Changing a profile updates every device it applies to.
Compliance policies
Compliance policies define what a healthy device looks like, such as requiring encryption, a minimum operating system version, a screen lock, and active antivirus. Intune reports which devices don't comply. With Conditional Access, you can also block noncompliant devices from reaching company email and files until they're fixed.
Applications
Intune can install and update Microsoft 365 apps, line-of-business software, and other required tools. For personal phones, app protection policies can require a PIN for Outlook and Teams, prevent copying company data into personal apps, and remove company data if an employee leaves.
Security and lifecycle
Intune's endpoint security policies manage antivirus, firewall, and attack surface reduction settings centrally. When a device is lost, it can be locked or wiped remotely. When it's replaced, it can be reset and reassigned, and Intune keeps an inventory throughout.
Licensing
Intune is included in several Microsoft 365 plans, including Microsoft 365 Business Premium, and is also sold separately. Using Conditional Access with device compliance also requires Microsoft Entra ID P1, which Business Premium includes.
Getting started
A successful rollout starts with a device inventory and a short list of policies to enforce first, such as encryption, updates, and MFA. Policies should be tested on a few devices before applying them to everyone, and existing devices should be enrolled in stages so nobody is locked out during the transition.
Founder of Albano Tech, providing managed IT, Microsoft 365, and cybersecurity services to businesses in Delaware, Maryland, and the Philadelphia region. More about Zach.
Need help with this?
Albano Tech provides Device Management & Intune for businesses in Delaware, Maryland, and the Philadelphia region.