What Microsoft Intune Does, and Whether You Need It

Here is a question worth asking before any Intune project: if an employee lost their laptop on the metro tonight, what would you do about it?

If the answer involves phoning them to ask what was on it, you have found the problem Intune solves. If the answer is that the laptop holds nothing and everything lives in Microsoft 365 already, your case for Intune is weaker than a vendor would like you to believe. This article is about telling those two situations apart.

Key Takeaways

• Intune is included in Microsoft 365 Business Premium and E3, so most SMBs own it.
• It manages devices and applications from the cloud, replacing on-premises tooling.
• The strongest use cases are lost devices, mixed personal hardware, and compliance evidence.
• App protection alone can secure company data without managing personal phones.
• Turning it on badly locks people out, so pilot before you enforce.

What Intune actually controls

Intune is Microsoft's cloud service for managing endpoints. In practice it covers four things.

Device enrolment and configuration. New machines pick up your settings automatically, including Wi-Fi profiles, VPN, certificates, and security baselines. With Windows Autopilot, a laptop shipped straight from the vendor to an employee's home configures itself on first sign-in without IT touching it.

Compliance policies. You define what a healthy device looks like, meaning disk encryption on, antivirus running, operating system above a minimum version, and Intune reports which devices comply. Paired with Conditional Access, non-compliant devices simply cannot reach company data.

Application management. Deploy, update, and remove applications centrally. This includes the ability to wipe only company data from a device, leaving personal photos and messages untouched.

Update control. Decide when Windows feature updates land rather than discovering them the morning of a deadline.

The distinction most people miss: MDM versus MAM

This single concept determines whether an Intune rollout goes smoothly or generates a mutiny.

Mobile Device Management enrols the whole device. You get full control, including the ability to wipe it entirely. Appropriate for hardware the company owns.

Mobile Application Management, also called app protection policies, secures only the company applications on a device you do not own. Outlook and Teams on a personal phone get a policy requiring a PIN, blocking copy-paste into personal apps, and allowing a selective wipe of company data. The employee's device is otherwise untouched, and you never gain the ability to erase their phone.

For most SMBs the right answer is MDM on company laptops and MAM on personal phones. Trying to enrol staff-owned phones fully is where adoption projects stall, and it is rarely necessary to achieve the actual security goal.

When a small business genuinely needs it

Some honest thresholds.

You probably need Intune if: staff work on laptops that leave the office, you have any compliance or cyber-insurance requirement to evidence device encryption and patching, people use personal phones for work email, or you have more devices than you can configure by hand consistently.

You may not need it yet if: everyone works on desktops in one office, all data lives in SharePoint with nothing stored locally, and you have under about ten machines that one person configures identically. In that case a documented build checklist and Conditional Access may cover you at far lower operational cost.

The honest middle case is a business that owns Intune through Business Premium and has never enabled it. There is no licence saving in leaving it off, so the question is purely whether the setup effort buys you something. For most businesses over fifteen people with any mobility, it does.

What Intune does not do

Worth being clear, because expectations get set high.

It is not antivirus. Defender for Business or Defender for Endpoint provides the protection; Intune deploys and reports on it. The two are complementary, and we compare the Defender tiers in Defender for Business versus Defender for Endpoint.

It is not a backup product. A wiped device is wiped. Anything that lived only on that laptop is gone, which is an argument for keeping data in Microsoft 365 rather than an argument against Intune.

It does not manage everything equally well. Windows and iOS are strong, Android varies by manufacturer and enrolment mode, and macOS support is real but consistently behind Windows in feature depth. Check your actual fleet before assuming parity.

How rollouts go wrong

The failure mode is almost always the same: someone enables a compliance policy tenant-wide on a Friday and blocks half the company from email.

A safer sequence is to enrol a small pilot group of willing users first, run compliance policies in report-only mode so you can see what would break before it breaks, and enforce in stages. Communicate what changes on personal devices before it changes, because the perception that IT can read personal messages is the fastest way to lose consent for the whole programme.

When you are ready for the mechanics, our step-by-step Intune setup guide covers the initial configuration and essential Intune configurations covers the policies worth deploying first.

FAQ

Do we already have Intune?

If you have Microsoft 365 Business Premium, E3, E5, or F3, yes. It is also sold standalone. Many businesses pay for it through Business Premium for years without enabling it, so check your licence before buying anything.

Can Intune see what employees do on their phones?

No. Intune does not collect browsing history, personal email, text messages, photos, or call logs. Under app protection policies it sees only the company applications it manages. Publishing this plainly to staff removes most of the resistance to enrolment.

What happens when someone leaves?

You revoke access and issue a wipe. On a company laptop that is a full wipe; on a personal phone under app protection it removes company data only. This is meaningfully faster and more complete than chasing hardware, which is why offboarding is a common trigger for adopting Intune.

Will it work with our existing Active Directory?

Yes. Hybrid join lets devices belong to both on-premises Active Directory and Entra ID during a transition. It is more moving parts than cloud-only, so if you are close to retiring the domain controller it is often worth doing that first rather than building a hybrid you will dismantle.

How long does a rollout take?

For a business under 100 devices, plan a few weeks rather than months: initial configuration in days, a pilot group for one to two weeks, then staged enrolment. Existing devices need enrolling individually, so the calendar is driven by touching machines rather than by the configuration itself.

If you want an outside read on whether Intune would actually help your environment, our IT assessment reviews your device fleet and current controls, and tells you plainly if the answer is no. Our managed IT services cover the rollout and the ongoing policy tuning when the answer is yes.