Intune

Microsoft Intune is the cloud endpoint management service in Microsoft 365. It enrolls and configures Windows 10/11, macOS, iOS, iPadOS, and Android devices, pushes apps and Wi-Fi/VPN/certificate profiles, evaluates compliance, and feeds that compliance signal into Entra ID Conditional Access. Beyond traditional mobile device management (MDM) for corporate-owned devices, Intune also supports mobile application management (MAM) for personal devices — protecting corporate data inside specific apps without managing the device itself. Intune is included in Microsoft 365 Business Premium, E3, E5, and F3, and is the cornerstone of Microsoft's zero-trust device posture story.

Worked example

A new laptop arrives for a remote hire who never sees an IT technician in person. Windows Autopilot recognises the device's hardware hash on first boot, enrols it into Intune automatically, and applies a compliance policy requiring BitLocker and a current OS build before the device can be marked compliant. Until that policy passes, a Conditional Access policy blocks the device from reaching Exchange Online and SharePoint — so the new hire can sign in, but can't actually reach company data until Intune reports the device meets the required baseline, all without an admin manually touching the machine.

Common pitfalls

Writing a compliance policy but never linking it to a Conditional Access policy is a common gap — Intune will happily report a device as "not compliant" forever without that status ever blocking anything, since compliance evaluation and access enforcement are two separate systems that have to be deliberately wired together. Assuming every device type gets the same profiles is another mistake: Windows, macOS, iOS, and Android each need their own configuration and compliance profiles built for that platform's actual settings, and a policy written with only Windows in mind silently does nothing on enrolled Macs or phones. And treating Intune enrolment as a one-time setup task rather than an ongoing responsibility misses that update rings, app assignments, and compliance thresholds need periodic review as the device fleet and threat landscape change.