Microsoft Intune lets IT administrators manage workplace devices and protect business applications from a browser-based console. This cloud service supports Windows, macOS, Linux, Android, iOS/iPadOS, tvOS and visionOS, with management controls that vary by platform. It covers company hardware and personal devices used for work, allowing an organization to manage an enrolled device or restrict its control to supported work apps and their data.
Device enrollment
Enrollment brings a device under Intune’s mobile device management, or MDM. Organizations can connect this process to Windows Autopilot, Apple Automated Device Enrollment or Android Enterprise. User-driven enrollment through Company Portal provides another route. The enrollment method determines how the device enters management and whether it is associated with a particular person or used as shared equipment.
Assigning configuration profiles
After enrollment, administrators assign configuration profiles for settings such as Wi-Fi, VPN connections, certificates and email. The settings catalog exposes platform-specific controls, so an administrator can select the settings for a device group and have Intune apply them when devices check in.
Assignments use Microsoft Entra groups. A policy aimed at a user group can follow those people across their associated devices. A device-group assignment applies to the selected hardware regardless of who signs in, which suits kiosks and shared computers.
App protection
Microsoft Intune can also protect work data without enrolling the entire device. Its mobile application management, or MAM, applies policies inside compatible apps. This lets an employee use a personal phone for corporate email while the organization controls how that email’s contents can be accessed and shared.
Administrators can require an app PIN, restrict copying to personal apps, limit where work files are saved and require encryption of corporate app data. In apps that support separate personal and work identities, protection follows the work context. A selective wipe removes organization data from the managed app while leaving personal content in place.
These controls require apps that support Intune protection through its SDK or App Wrapping Tool. MAM alone does not deliver device-level Wi-Fi, VPN or certificate profiles, and it does not push apps onto an unenrolled device. An organization can combine MAM with MDM when both device settings and in-app data controls are needed.
Managed apps
The Intune app catalog can contain store applications, internal line-of-business packages and links to web apps. Administrators choose the appropriate app type, add its store entry or installation package, and assign it to the intended groups. Required assignments install an app on managed devices; available assignments let users obtain it through Company Portal. A web app entry creates a shortcut to the hosted application.
App configuration policies provide organization-specific settings before people begin using a supported application. Depending on the app, these can control language, account behavior or other exposed options. Configuration is separate from the protection rules that govern company data.
Update handling depends on the app source. Store publishers supply their app updates, while an organization distributing its own installation package must provide updated packages through Intune. Administrators can also assign an uninstall action when a group no longer needs an application.
Device compliance
Compliance policies evaluate whether managed devices meet an organization’s rules. Checks can include the operating system level, encryption, rooted or jailbroken status, and risk reported by integrated threat-management services. Each platform has its own policy settings. The compliance dashboard shows results and lets administrators inspect individual devices and policies to find unmet conditions.
Microsoft Intune passes compliance status to Microsoft Entra ID. With Conditional Access configured to require a compliant device, that status becomes part of the decision to allow or block access to company email and other resources. User notifications can explain a compliance problem so it can be corrected. Evaluation follows device check-ins and policy refreshes; a compliance rule assesses a condition, while configuration profiles control the settings themselves.
Windows updates
Windows update rings control when updates reach different device groups and how installation affects users. Administrators set deferral periods, deadlines, active hours, restart behavior and notifications. Separate rings can give a pilot group updates before a wider deployment. Feature, quality and driver update policies provide additional targeting controls, while reports show assignment and setting status.
Admin permissions
Intune’s role-based access controls divide administrative work into permitted tasks, such as managing applications or editing profiles. Scope tags narrow which objects an administrator can see. Together, these controls allow a support team to manage its assigned devices without receiving access to the entire device estate.
Device retirement
Remote lifecycle actions handle equipment that is replaced, lost or withdrawn from service. Depending on the platform and management mode, administrators can remove organization data, retire a device from management or reset it to factory settings. Removing work data from a protected app and resetting an enrolled device have different scopes, so the available action follows how that endpoint is managed.
Intune plans
Microsoft Intune Plan 1 provides the base device and app management service. Plan 2 adds advanced capabilities such as Remote Help and Advanced Analytics, while Intune Suite includes Plan 2 and further management and security capabilities. Intune is also included in selected Microsoft 365 subscriptions.
Licensing can cover users or eligible devices. Device-only subscriptions serve equipment without a dedicated user, such as kiosks, but do not include app protection policies, Conditional Access or user-based management features.
