Microsoft 365 · Device management
Service group: Microsoft 365Laptops and phones that configure themselves and stay compliant
With Microsoft Intune and Windows Autopilot, a new laptop can ship straight to an employee and set itself up with your apps, security settings and policies after they sign in. We design, deploy and maintain that configuration for Windows, macOS, iOS and Android.
At a glance
- Service
- Design, deployment and ongoing management of Microsoft Intune and Windows Autopilot for company and personal devices
- Best suited to
- Canadian organizations of roughly 5 to 200 employees with remote, hybrid or multi-site staff using Windows, Mac and mobile devices
- Core inclusions
- Enrolment methods, compliance and configuration policies, Autopilot profiles, app deployment, update rings, BYOD app protection and device reporting (as scoped)
- Licensing note
- Intune Plan 1 is included in Microsoft 365 Business Premium and enterprise E3 and E5 plans; licences are purchased separately unless written into your proposal
- Not included by default
- Hardware purchases, physical device repairs, line-of-business app packaging beyond agreed apps and licence purchases
- Pricing basis
- Deployment quoted as a project; ongoing management per user or device, confirmed in a written quotation
What Intune management includes
Microsoft Intune is Microsoft’s cloud service for managing devices and apps. It replaces the old model of imaging a laptop in the office and joining it to a local domain. Policies, apps, updates and security settings are delivered over the internet wherever the device is, and Microsoft Entra ID can use the device’s compliance status to decide whether it may access company data.
Our Intune service covers both the initial build and the ongoing care. During deployment we choose enrolment methods, design compliance and configuration policies, set up Windows Autopilot, package your standard apps and roll everything out in pilot groups. After deployment we maintain policies, approve new apps, watch update compliance and adjust as Microsoft changes the platform.
Intune is one part of our broader Device Management service, which also covers devices that are not managed through Microsoft. This page is specifically about Intune and Autopilot.
Device problems Intune solves
New laptops take days to set up
Someone has to unbox each machine, install apps by hand and remember the right settings, and remote hires wait for a courier round trip.
No idea which devices are encrypted or updated
There is no reliable inventory showing BitLocker or FileVault status, operating system versions or whether updates have installed.
Personal phones holding company email
Staff read email on personal devices with no PIN requirement and no way to remove company data if the phone is lost or the person leaves.
A lost laptop becomes a data incident
Without remote lock, wipe or encryption evidence, a stolen device leaves you unsure what was exposed.
What we set up and maintain
Windows Autopilot
Devices registered by your supplier or by us, deployment profiles that join them to Entra ID, and an out-of-box experience that installs apps and policies at first sign-in.
Compliance policies
Rules for encryption, minimum OS version, firewall, antivirus and password requirements, connected to Conditional Access so non-compliant devices are blocked from company data.
Configuration profiles
Security baselines, BitLocker and FileVault, Wi-Fi and VPN profiles, browser settings and OneDrive Known Folder Move delivered consistently to every device.
App deployment
Microsoft 365 Apps, common business tools and Store apps deployed automatically, with required and optional apps through the Company Portal.
Update management
Windows Update rings or Windows Autopatch where licensed, feature update control and driver policies, plus macOS and mobile OS update enforcement.
BYOD app protection
App protection policies that secure Outlook, Teams and OneDrive on personal phones without enrolling the whole device, with selective wipe when someone leaves.
What is included, and what needs separate scope
Typically included
- Enrolment design for corporate Windows, macOS, iOS and Android devices
- Windows Autopilot profiles and device registration support
- Apple Business Manager and Automated Device Enrollment integration for Macs and iPhones
- Compliance policies and their link to Conditional Access
- Configuration profiles and security baselines
- Deployment of agreed standard applications
- Update rings and compliance reporting
- App protection policies for personal mobile devices
Requires separate scope or quotation
- Hardware purchases and physical repairs
- Complex line-of-business app packaging beyond the agreed list
- Intune licence purchases, unless written into your proposal
- Migration from another MDM platform, unless quoted as a project
- Enterprise co-management with Configuration Manager at large scale
Platforms and tools
- Microsoft Intune admin centre
- Windows Autopilot and Windows Autopatch
- Windows 11 and Windows 10 business editions
- macOS with Apple Business Manager and Automated Device Enrollment
- iOS and iPadOS, Android Enterprise work profile and fully managed devices
- Intune app protection policies (MAM) and the Company Portal
- Microsoft Defender for Business or Defender for Endpoint onboarding via Intune
- Microsoft Entra ID Conditional Access device compliance
Who this service suits
Remote and hybrid teams
Organizations shipping laptops directly to staff across Canada who need devices configured without visiting an office.
Business Premium subscribers
Companies that already pay for Intune through Business Premium but have not deployed it.
Firms with BYOD phones
Businesses that allow personal phones for email and Teams and need company data protected without managing staff’s personal devices.
What you gain
- New staff can start work on a laptop that configured itself
- Evidence of encryption, update status and compliance for every enrolled device
- Company data removable from lost devices or departing staff’s phones
- Consistent security settings instead of one-off machine builds
- Access to Microsoft 365 limited to devices you trust, where licensed
How an Intune deployment runs
Device discovery
We inventory devices, ownership, operating systems, current management tools and the apps each team needs.
Design
We agree enrolment methods, policy sets, app lists, update approach and BYOD rules, documented for your approval.
Pilot
A small group enrols first, including a fresh Autopilot device, so we can refine policies and user guidance.
Rollout
Existing devices are enrolled in waves, and Conditional Access compliance requirements are enabled once coverage is complete.
Ongoing management
We maintain policies, deploy app updates, review compliance reports and adjust for platform changes.
Ways to engage
Deployments and recurring management are confirmed by a written quotation.
Intune deployment project
A scoped project to design and roll out Intune and Autopilot, with documentation handed over at the end.
Ongoing Intune management
Recurring management as part of Microsoft 365 Managed Services or a Managed IT package.
Endpoint assessment first
An Endpoint Security Assessment reviews your current device posture before deployment.
Frequently asked questions
Do we need Business Premium to use Intune?
Intune is included in Business Premium and in enterprise E3 and E5 plans. It can also be licensed on its own. Business Basic and Business Standard do not include it.
Can Intune manage personal phones without controlling the whole device?
Yes. App protection policies secure company data inside Outlook, Teams and OneDrive and allow a selective wipe, without enrolling or seeing personal content on the device.
Can existing laptops use Autopilot?
Yes. Existing Windows devices can be registered for Autopilot, typically when they are reset or reassigned. New devices can be registered by the supplier at purchase.
Does Intune work with Macs?
Yes. Macs can be enrolled through Apple Business Manager for automated setup, with configuration profiles, FileVault, app deployment and compliance policies.
Is antivirus included?
Intune deploys and reports on security settings. Endpoint protection itself comes from Microsoft Defender for Business or another product, which we can onboard through Intune.
Related services
Products and packages
Industries we support
Service areas
Plan your Intune and Autopilot rollout
Tell us about your devices and how your team works. We will scope the deployment and confirm pricing in a written quotation.