Device management with Microsoft Intune
Every laptop and phone that opens company email should follow the same basic rules: encrypted, updated, locked when unattended and wipeable if it goes missing. Intune lets us set those rules once and apply them to every device, wherever the person happens to be working.
Device management with Microsoft Intune for small and medium businesses
In most small offices, devices are set up one at a time by whoever is available. One laptop has BitLocker turned on, another doesn't. Some phones have a passcode, some open with a swipe. A former employee's personal tablet may still be syncing the shared mailbox. None of this is visible until something goes wrong, and by then it is hard to say which devices hold company data or who has them. Intune replaces guesswork with a single list and a consistent set of rules.
Microsoft Intune is included in Microsoft 365 Business Premium, so many businesses already pay for it without using it. With it, new Windows laptops set themselves up through Autopilot when a person first signs in, Macs and iPhones enrol through Apple's business programme, and Android phones get a separate work profile. Policies for encryption, passwords, updates and firewall settings are pushed out automatically, and each device reports back whether it complies.
Personal phones are handled differently, because people rightly object to their employer controlling their own device. Instead of enrolling the whole phone, we protect the work apps: Outlook and Teams data can't be copied into personal apps, must sit behind a PIN, and can be removed on its own when someone leaves while their photos and messages stay untouched. Staff get access from their own phone, and the business keeps control of its information.
What's included
Autopilot setup
New Windows laptops registered before delivery, so they configure themselves with your settings and apps the first time a staff member signs in.
Apple and Android enrolment
Macs, iPhones and iPads enrolled through Apple's business programme, and Android phones set up with a separate work profile.
Security baselines
Disk encryption, screen locks, firewall, update rings and other settings defined once and applied to every enrolled device.
App deployment
Microsoft 365 apps, browsers, PDF tools and your business software installed and kept current without anyone visiting a desk.
Compliance checks
Devices that fall behind on updates or turn off encryption are flagged, and can be blocked from company data until fixed.
Lost and stolen devices
Remote lock, locate where supported and full wipe for company devices, plus removal of work data from personal ones.
Bring your own device
App protection rules for personal phones, keeping work email and files inside managed apps without taking over the whole phone.
Device inventory
An up-to-date list of every enrolled device, its owner, operating system and compliance status, available whenever you ask.
Who is device management for?
Intune is a good next step if:
- You pay for Microsoft 365 Business Premium but have never switched Intune on
- Staff read work email on personal phones with no rules applied
- You couldn't say for certain which laptops are encrypted
- Setting up a laptop for a new starter takes hours of hands-on time
- A lost phone or laptop last year left you unsure what was exposed
Not sure where to start?
Our free IT health check looks at your devices, accounts, backups, security and network. You get a short written report with what is working, what is at risk and a price to fix it. No obligation.
Book the health checkDevice management with Microsoft Intune questions
Can you see what staff do on their personal phones?
No. With app protection on a personal phone we manage only the work apps and their data. We cannot see personal photos, messages, browsing or other apps, and leaving the company removes only the work data.
What is the difference between enrolling a device and app protection?
Enrolment puts the whole device under company management and suits laptops and phones the business owns. App protection manages just the work apps and suits personal devices, where full control would be unreasonable.
Do we need Business Premium?
Intune comes with Business Premium and some other Microsoft plans. It can also be bought on its own. We check your current licences and recommend the least expensive way to get what you need.
Will enrolment wipe existing laptops?
Not necessarily. Many existing Windows devices can be brought under management without a reset. Older or messy setups are sometimes better reset with Autopilot, and we agree that with each user first so nothing is lost.
Is device management included in a plan?
Device policies are set and enforced as part of the Complete plan at $169 per user per month plus GST. On other plans the initial setup is quoted in writing first and changes are billed at $109 an hour remote.
How quickly can a lost laptop be locked?
As soon as you tell us. The lock or wipe command is sent straight away and takes effect the moment the device next connects to the internet, and the user's sign-in can be blocked immediately as well.
Can Intune manage Macs properly?
Yes. Macs can be enrolled, given security settings such as FileVault encryption and firewall rules, and have apps installed. A few settings work differently from Windows, and we explain those before rolling out.
Other ways we help
Managed IT
One monthly price per person for support, security, updates and backups. Your outsourced IT team.
Managed IT
IT support
Remote and onsite help when you need it, billed by the hour. No plan, no contract.
IT support
Cyber security
Practical protection against scams, ransomware and account takeover, set up and kept current.
Cyber security