Device Management with Microsoft Intune

What Intune does for a small business

Microsoft Intune is a cloud service for managing laptops, desktops, phones and tablets wherever they are. Instead of relying on an office server and Group Policy, settings and apps are pushed from Microsoft 365 to devices over the internet. For a small business, that means:

• Laptops that are encrypted, patched and protected, whether staff work in the office or at home.
• New starters who unbox a laptop, sign in and are ready to work.
• Lost or stolen devices that can be wiped remotely.
• A clear list of every device, its owner, its operating system and whether it meets your security rules.

Intune Plan 1 is included in Microsoft 365 Business Premium, along with Entra ID P1 for Conditional Access. Business Basic and Standard do not include Intune.

Windows: Autopilot, compliance and updates

With Windows Autopilot, each laptop's hardware hash is registered to your tenant, either by your supplier or by us. When a user signs in for the first time, Windows joins Microsoft Entra ID, enrols in Intune, applies settings and installs apps automatically.

We then set up:

• Compliance policies: BitLocker on, Secure Boot on, minimum Windows version, Defender running, and a password or Windows Hello.
• Conditional Access that only lets compliant devices reach email and files. See password and MFA set-up.
• BitLocker encryption with recovery keys escrowed to Entra ID, so a locked-out user can be helped in minutes.
• Windows Update rings to control when updates and feature upgrades install, with a small pilot group first.
• Windows LAPS so each PC has a unique, rotating local admin password.
• Security baselines and attack surface reduction rules from Microsoft's recommended settings.

Apps, phones and personal devices

We deploy Microsoft 365 Apps, browsers, PDF tools and line-of-business software through Intune, packaging other installers as Win32 apps with detection rules. See software installation support.

For iPhones and iPads, we link Intune to Apple Business Manager so company-owned devices enrol automatically, and set up the Apple Push Notification service certificate. That certificate has to be renewed every year with the same Apple ID; if it lapses, devices stop checking in, which is a common fault with inherited set-ups. For Android, we use Android Enterprise, with a work profile on personal phones and full management on company phones.

Where staff use their own phones, app protection policies keep company data inside Outlook, Teams and OneDrive: no copying into personal apps, a PIN on the app, and a selective wipe that removes only company data when someone leaves.

Rolling Intune out safely

Turning on compliance and Conditional Access all at once can lock people out on a Monday morning. We roll out in stages: inventory current devices, enrol a pilot group, run Conditional Access in report-only mode to see who would be blocked, fix those devices, and only then enforce. Existing PCs joined to an on-site domain can be moved to Entra ID join or managed in hybrid mode during the transition.

If Intune was partly set up by someone else, we review what is there, remove conflicting profiles, and document the final configuration so the next person understands it. We also check the basics that inherited set-ups often miss: a device clean-up rule so old laptops drop off the list, enrolment restrictions so personal Windows PCs cannot enrol by accident, and named owners for each policy. A wider review fits well with an IT audit.

Cost

Intune and Autopilot roll-outs are quoted upfront, based on the number of devices and how many policies and apps you need. Ongoing management, such as enrolling new devices, approving updates and handling lost laptops, fits within the Complete plan at £99 a month + VAT, which includes IT and Microsoft 365 helpdesk support and 3 hours of work each month. Ad-hoc Intune fixes are £45 an hour + VAT. Ask for a quote.

Related