Article · Device management
Microsoft Intune for small businesses, explained without the jargon
Intune lets a small team manage laptops and phones the way large organizations do: devices arrive configured, security settings are enforced, and lost hardware can be wiped. Here is how it works, which enrolment method fits which device, and where small businesses usually go wrong.
- Published
- 8 min read
On this page
Key takeaways
- Intune is Microsoft’s cloud service for managing Windows, macOS, iOS/iPadOS and Android devices and the apps on them.
- Pick an enrolment method per device type and ownership model: Autopilot for company Windows PCs, Apple automated device enrolment for company Apple devices, and app protection without enrolment for personal phones.
- Compliance policies define what a healthy device looks like; Conditional Access turns that definition into an access decision.
- App protection policies let staff use personal phones for work email and files while keeping company data separable and wipeable.
- Intune Plan 1 is included in Microsoft 365 Business Premium and the enterprise E3 and E5 plans; Business Basic and Business Standard do not include it.
- Plan the rollout: build policies, pilot with a few users, then enforce, and track the annual Apple certificate and token renewals.
What Intune actually does
Microsoft Intune is a cloud-based endpoint management service. It combines mobile device management (MDM), where the organization manages the whole device, with mobile application management (MAM), where it manages only company apps and the data inside them. Because Intune is tied to Microsoft Entra ID, device state can be used when deciding whether a sign-in to Microsoft 365 should be allowed.
For a small business, the practical benefits are concrete. A new laptop can be shipped directly to an employee and configure itself on first sign-in. BitLocker or FileVault encryption is enforced and the recovery key is stored centrally. Windows updates follow a schedule you control. Required apps install automatically. When someone leaves, or a phone is lost in a taxi, IT can remove company data remotely. And all of it is documented in one console instead of in the memory of whoever set up each machine.
Choosing the right enrolment method
Enrolment is how a device comes under Intune management. The right method depends on the platform and on who owns the device.
Windows Autopilot (company Windows PCs)
Device hardware hashes are registered to your tenant, usually by the reseller at purchase. On first boot the PC joins Microsoft Entra ID, enrols in Intune and applies your apps and settings. Autopilot can also reset an existing device to a business-ready state without reimaging.
Entra join with automatic enrolment
For existing Windows PCs, joining the device to Entra ID with automatic MDM enrolment configured brings it under management. This is a common path when transitioning machines that were set up locally.
Apple automated device enrolment
Company-owned iPhones, iPads and Macs purchased through Apple Business Manager can be assigned to Intune so they enrol automatically during setup, with management that users cannot remove.
Android Enterprise
Company-owned Android phones use fully managed enrolment. Personally owned Android phones can use a work profile, which keeps work apps and data in a separate container.
App protection without enrolment
For personal phones where staff do not want their whole device managed, app protection policies secure Outlook, Teams, OneDrive and other supported apps without enrolling the device.
Compliance policies and Conditional Access
A compliance policy is a set of rules that a device must meet to be considered healthy. Typical rules for Windows include requiring BitLocker, Secure Boot, a minimum operating system version, an active firewall, real-time antivirus and, if you use Microsoft Defender for Business or Defender for Endpoint, a machine risk score at or below a threshold. For phones, rules commonly include a device passcode, a minimum OS version and blocking jailbroken or rooted devices.
Compliance on its own only produces a status. The control comes from Conditional Access, which can require a compliant device before granting access to Microsoft 365. That combination is what stops a stolen password from being used on an attacker’s computer. Roll it out carefully: set non-compliance actions such as a notification and a grace period, confirm devices report as compliant, test with a pilot group, and only then enforce the Conditional Access policy for everyone. Keep emergency access accounts excluded.
Bring-your-own-device with app protection policies
Many small businesses let staff read email and Teams on their own phones. App protection policies make this safer without asking employees to hand over control of a personal device. The policy applies inside supported apps and can require a PIN or biometric to open work apps, block copying and pasting company data into personal apps, prevent saving files to personal storage, and encrypt work data within the app.
If the employee leaves or the phone is lost, a selective wipe removes company data from those apps while leaving personal photos and messages untouched. Pair app protection with a Conditional Access policy that requires an approved client app or app protection policy on mobile platforms, so staff cannot simply sign in through the native mail app or a browser instead. Write a short BYOD policy explaining what IT can and cannot see, because clear expectations prevent most objections.
What to configure first
Once devices are enrolling, these are the policies that deliver most of the day-to-day value for a small organization.
- Disk encryption with BitLocker on Windows and FileVault on macOS, with recovery keys escrowed to Intune or Entra ID.
- Windows Update rings and feature update policies, with a small pilot ring that receives updates a few days before everyone else.
- Microsoft Defender Antivirus settings, tamper protection and attack surface reduction rules, or onboarding to Defender for Business where licensed.
- Windows LAPS to give each device a unique, rotating local administrator password stored in Entra ID.
- Removal of everyday local administrator rights, with a documented process for installing approved software.
- Required apps such as Microsoft 365 Apps, your PDF editor and line-of-business software, deployed from Intune rather than installed by hand.
- Security baselines or settings catalog profiles for password, screen lock, USB and browser settings, reviewed before assignment so they fit your environment.
Licensing in plain terms
Intune Plan 1 is included in Microsoft 365 Business Premium, which is designed for organizations of up to 300 users and also includes Entra ID P1 for Conditional Access and Microsoft Defender for Business. It is also included in the Microsoft 365 E3 and E5 enterprise plans and can be purchased on its own. Microsoft 365 Business Basic and Business Standard do not include Intune; they offer a more limited built-in mobility and security feature that suits only simple scenarios.
Microsoft also sells Intune add-ons, such as remote help and advanced endpoint analytics, that some organizations find useful as they grow. Licensing names and bundles change from time to time, so confirm current inclusions with your licensing provider before you plan a rollout around a specific feature.
A rollout plan that avoids surprises
Inventory and decide
List devices by platform and ownership, decide which will be fully managed and which will use app protection only, and confirm licences.
Prepare the tenant
Set up automatic enrolment, the Apple MDM push certificate, the Apple Business Manager token if you have one, Android Enterprise binding and device enrolment restrictions.
Build and pilot
Create compliance, configuration and app policies, then assign them to a pilot group of a few willing users across different roles. Fix what breaks.
Enrol everyone
Move remaining devices into management in batches, communicating clearly with staff about what will change and how to get help.
Enforce and maintain
Turn on Conditional Access for compliant devices, review non-compliant devices weekly, and calendar the yearly renewals of the Apple push certificate and enrolment tokens, because an expired certificate breaks management of every Apple device.
Common mistakes we see
Enforcing device compliance before devices are reporting correctly, applying a full security baseline untested, creating the Apple push certificate with a personal Apple ID that leaves with an employee, and letting staff keep local administrator rights so policies are quietly undone. Each is avoidable with a pilot and documentation.
Frequently asked questions
Can Intune manage Macs as well as Windows PCs?
Yes. Intune manages macOS devices, including configuration profiles, FileVault encryption, app deployment and compliance. Company-owned Macs bought through Apple Business Manager can enrol automatically during setup.
Can IT see my personal photos or messages if I use app protection on my phone?
No. App protection policies apply to company data inside supported work apps. IT can see information about the app and device, such as the OS version, and can remove company data, but cannot read personal content.
Do we need Windows Autopilot to use Intune?
No. Autopilot makes provisioning new Windows PCs much faster, but existing devices can be enrolled through Entra join with automatic enrolment. Many small businesses adopt Autopilot as they replace hardware.
How long does an Intune rollout take for a small business?
It depends on device count, platforms and how much existing configuration needs to be untangled. A careful rollout includes a pilot period before enforcement, so plan in weeks rather than days.
Related services
Products and packages
Plan your Intune rollout with us
We can review your devices and licences, design enrolment and compliance policies, and pilot them with your team before anything is enforced.