Endpoints · Endpoint Management
Microsoft Intune
Microsoft's cloud endpoint management service, delivering configuration, applications, updates and compliance policy across Windows, macOS, iOS, Android and Linux.
IntermediateMicrosoftUpdated 2026-09-01
Overview
Intune is the management side of Microsoft's endpoint stack. It enrols devices, delivers configuration profiles and applications, manages update rings, and evaluates compliance policy, and that compliance verdict is consumed directly by Entra ID Conditional Access.
It supports both full device management (MDM) and application level management (MAM) for unenrolled personal devices, which is how most organisations handle BYOD without taking control of a personal phone.
How it works
- 01Windows devices are provisioned with Windows Autopilot using hardware identity registered by the vendor or by an import, then configured entirely over the internet.
- 02Apple devices enrol through Apple Business Manager with automated device enrolment; Android uses Enterprise enrolment profiles for work profile or fully managed modes.
- 03Configuration profiles, security baselines and settings catalogue policies define state; compliance policies define the pass/fail conditions reported to Entra ID.
- 04Applications are packaged (Win32, MSIX, store, LOB) and assigned to groups as required, available or uninstall.
Design considerations
- Use dynamic groups and filters to target policy predictably; assignment sprawl is the main cause of unexplained device state.
- Keep security baselines and custom configuration separate so conflicts are diagnosable.
- Establish update rings with a pilot population before broad deployment.
- Co management with Configuration Manager is a valid transition state, decide workload by workload which authority wins.
Security considerations
- Require compliant devices in Conditional Access for access to email and files.
- Enable BitLocker or FileVault with key escrow, and deploy attack surface reduction rules.
- Restrict who holds Intune administrator roles and use scope tags for delegated administration.
- Use app protection policies to prevent corporate data leaving managed applications on personal devices.
Common misconfigurations
- Conflicting settings from overlapping profiles, leaving devices in an error state that nobody owns.
- Autopilot profiles assigned to groups the device is not yet in at first boot.
- Compliance grace periods so long that non compliance never blocks anything.
- No monitoring of devices that have not checked in, hiding both faults and offboarded hardware.