← All articles
Microsoft Intune is a cloud-based device management platform included in Microsoft 365 Business Premium and Enterprise plans. It lets you manage, secure, and monitor company devices — Windows PCs, Macs, iPhones, Android phones — from a single admin centre. Most tenants that have it never turn it on.
What can Intune do?
At its core, Intune does two things: device management (enroll and manage company or personal devices) and app management (control which apps can access company data and under what conditions).
Device management
- Enforce BitLocker encryption on Windows devices
- Require a PIN or password on mobile devices
- Remote wipe a lost or stolen device
- Deploy software, updates, and configuration profiles at scale
- Require devices to be compliant before accessing company apps (pairs with Conditional Access)
App protection (MAM)
- Prevent copy/paste of company data into personal apps
- Require a PIN to open Outlook or Teams on a phone
- Wipe only company data from a personal device (without wiping the whole phone)
- Block screenshots in company apps
Do you need it?
If your organisation has any of these, the answer is yes:
- Employees accessing company email on personal phones
- Remote workers on laptops that aren't joined to a domain
- Any regulatory requirement around data protection (GDPR, ISO 27001, Cyber Essentials Plus)
- Concern about what happens if a device is lost or stolen
Quick win: Even without full device enrollment, you can deploy Intune App Protection Policies (MAM) in minutes. These control how Outlook and Teams behave on personal phones — requiring a PIN, preventing data leakage — without touching the personal side of the device. No user disruption, significant security gain.
Getting started
- Go to endpoint.microsoft.com (Microsoft Intune admin centre)
- Start with App protection policies for iOS and Android — these are quick to set up and don't require device enrollment
- Then set up Compliance policies for Windows (BitLocker, OS version requirements)
- Pair compliance policies with a Conditional Access policy requiring compliant devices
- Roll out Windows Autopilot for new device provisioning
How to check if Intune is configured
M365Clarity checks whether Intune is licensed and whether device compliance policies are configured as part of its tenant scan. If Intune is included in your plan but not set up, it flags it as a gap with a direct link to the admin centre.
Check your Microsoft 365 configuration in 2 minutes
Connect your tenant, run a scan, and see exactly what needs attention — in plain English. Free plan available.
Scan your tenant free →