Microsoft Intune is a cloud endpoint-management service. It enrols Windows PCs, macOS, iOS, and Android devices, then applies configuration, app, and protection policies. Entra ID still owns the user. Intune owns the device record and whether that device is marked compliant.
This is not a licence-comparison page. It explains what Intune can enforce once a tenant has it.
Enrolment and the device record
A device becomes manageable when it is enrolled. Typical paths:
- Company Windows PC: Autopilot or Entra join during setup, then automatic Intune enrolment
- Existing PC: Company Portal or an enrolment package
- Phone: Company Portal app, often with a work profile on Android so personal apps stay separate
After enrolment, Intune stores a device object, the user it is assigned to, and a compliance state. Conditional Access can require that state before Exchange or SharePoint opens. A laptop that was never enrolled cannot be “non-compliant”; it is simply unknown.
Bring-your-own-device (BYOD) is a policy choice. You can manage the whole phone, manage only a work profile, or manage only the app (app protection without full enrolment). Full wipe of a personal phone is a different decision from wiping the work profile. Write that down before the first enrolment.
What policies actually do
Intune policies fall into groups people confuse:
- Compliance: rules the device must meet (PIN, encryption, OS version). Result: compliant or not.
- Configuration: settings you push (Wi-Fi, VPN, browser restrictions, BitLocker).
- App management: which apps are required, available, or blocked; app protection (copy/paste, save-as) for Outlook and Teams on a phone.
- Updates: Windows update rings so machines are not left on an expired build.
- Actions: remote lock, retire (remove company data), or wipe.
Intune does not back up OneDrive or SharePoint. It does not replace antivirus telemetry on its own, though it can require a health signal. It does not assign admin roles.
From an unknown laptop to a compliant device
- Create a user in Entra ID and assign a licence that includes Intune
- Enrol the device so it appears in Intune
- Assign compliance and configuration profiles to a group
- Wait for the device to report; fix PIN, encryption, or OS gaps
- Turn on Conditional Access that requires a compliant device for mail and files
Groups and scope
Assign policies to Entra ID groups, not to one-off devices, or the next hire will miss them. Keep a pilot group. A configuration that breaks Wi-Fi at a branch should not have been aimed at “All devices” on a Friday.
Retire vs wipe: retire removes company accounts and Intune management and is the usual leaver step for a PC you will reuse. Wipe returns a company device to factory state. Using wipe on a personal phone that was fully enrolled is how trust in IT collapses.
A practical example
Staff open company email on personal phones with only a password. A lost phone exposes the mailbox. The revision enrols phones with a work profile, requires a PIN and app protection (no save-to-personal-storage), and Conditional Access refuses Exchange on devices that are not compliant. Personal photos stay out of the wipe scope.
Key takeaways
- Intune enrols devices and reports compliance. Entra ID still signs the person in.
- Compliance is a pass/fail signal that Conditional Access can demand.
- Decide BYOD scope (whole device, work profile, or app only) before the first phone.
- Assign policies to groups. Retire leavers; do not wipe personal devices by habit.
FAQ
Is Intune the same as Configuration Manager (SCCM)?
No. Configuration Manager is the older on-premises tool. Many large estates use both (co-management). Most SMEs meet Intune only.
Can Intune manage a PC that never joins Entra ID?
Enrolment still creates a relationship with the tenant. Entra join plus Intune is the usual Microsoft 365 pattern for company Windows devices.
Does Intune replace a written asset list?
No. It lists enrolled devices. Machines that were never enrolled will not appear. Keep a simple asset record for the rest.