Why most businesses are not using Intune properly

Microsoft Intune has become the industry standard for device management in the modern workplace. For many UK SMEs, the transition to Microsoft 365 brought with it a suite of powerful tools, yet a significant number of businesses find themselves merely "scratching the surface" of what Intune can actually achieve. It is common to see organisations that have enabled the basic functionality—perhaps pushing out a few security policies—but failing to utilise the platform to its full potential. When Intune is misconfigured or underutilised, it creates a false sense of security. You might believe you are protected because you have a "managed" laptop, but without a comprehensive, lifecycle-based approach, you are likely leaving gaps in your security perimeter that cybercriminals are only too eager to exploit. This guide explores why most businesses fail to use Intune properly and how you can transform it from a basic administrative tool into a cornerstone of your cybersecurity strategy and operational efficiency.

What Microsoft Intune actually means

At its core, Microsoft Intune is a cloud-based service designed for mobile device management (MDM) and mobile application management (MAM). In plain English, it allows you to centrally manage and secure the devices your employees use (laptops, tablets, smartphones) and the applications running on them. Rather than needing to physically access each machine, Intune provides a single console to configure security settings, deploy software, enforce compliance, and protect corporate data. It's an integral part of Microsoft 365 and the broader Microsoft Endpoint Manager suite, designed to bring consistency and control to your IT estate, regardless of where your staff are working. Fundamentally, it shifts device management from a manual, reactive task to an automated, proactive system.

Why it matters for UK SMEs

For UK SMEs, the proper use of Intune isn't merely a technical nicety; it's a commercial imperative and a defence against significant risks.

Firstly, risk mitigation. Cyberattacks are no longer abstract threats; they are a constant, evolving danger to businesses of all sizes. An unmanaged device is a potential entry point for ransomware, data breaches, and other disruptive incidents. Intune helps close these gaps by enforcing security policies across your fleet.

Secondly, regulatory compliance. Under UK GDPR, you have a legal obligation to protect personal data. The Information Commissioner's Office (ICO) takes a dim view of organisations that fail to implement appropriate technical and organisational measures. Intune provides the framework to demonstrate due diligence by ensuring devices are encrypted, patched, and secured. Furthermore, for many UK businesses, achieving and maintaining Cyber Essentials certification is either a contractual requirement or a fundamental best practice. The NCSC (National Cyber Security Centre) guidance frequently points towards the controls that Intune can automate, making ongoing compliance significantly more manageable.

Thirdly, operational efficiency and cost control. Manual device setup, software installation, and troubleshooting consume valuable IT resources. Intune automates these processes, freeing up your team (or your outsourced IT provider) to focus on more strategic initiatives. This translates directly into reduced operational costs and improved productivity, as staff spend less time waiting for IT support and more time on their core tasks. In fairness, the initial setup can be an investment in time, but the long-term gains are substantial.

How to use Intune properly, a practical walkthrough

Moving beyond basic policy deployment requires a considered, strategic approach to Intune. Here’s how to build a truly robust and efficient device management strategy.

1. Embracing a Lifecycle-Based Approach

True device management encompasses the entire lifespan of a device, from procurement to retirement. If your organisation isn't using Intune to manage this lifecycle, you're missing out on significant efficiencies and security benefits.

Windows Autopilot is fundamental here. Instead of manually imaging each new laptop, Autopilot allows devices to be shipped directly from the supplier to the end-user. Upon first boot, the device automatically connects to Intune, applies your pre-defined security policies, installs necessary applications, and configures settings. This reduces manual setup time from hours to minutes of IT intervention per device, ensures a consistent and secure baseline configuration, and gets new employees productive faster. Onboarding a 30-user London-based architecture firm last quarter, we found their previous setup involved manual imaging taking half a day per laptop. Implementing Autopilot reduced this to under an hour of IT time per device, ensuring all security baselines were automatically applied. This also ensures critical security features like BitLocker encryption are enforced from day one, rather than being an optional step a technician might forget.

Beyond initial setup, Intune ensures ongoing standardisation and security. You can mandate that the built-in Windows Firewall is active and correctly configured, and that Microsoft Defender Antivirus is running and up-to-date across all devices. This means you have a consistent security posture, and users cannot inadvertently (or deliberately) disable critical protections.

Finally, secure offboarding is crucial. When an employee leaves, or a device is lost or stolen, Intune allows for remote wiping of corporate data. You can perform a "corporate wipe" (removing only business data, ideal for BYOD scenarios) or a "full wipe" (resetting the device to factory settings, suitable for company-owned devices). This ensures sensitive information doesn't walk out the door or fall into the wrong hands, which is a key component of GDPR compliance.

2. Integrating with Conditional Access for Zero Trust

Intune, while powerful for device management, reaches its full potential when integrated with Microsoft Entra ID (formerly Azure AD) through Conditional Access. Many businesses fail to connect the dots between device health and access to sensitive corporate data, creating a significant vulnerability.

Conditional Access acts as your gatekeeper. It evaluates signals – such as user identity, device health, location, and application – before granting access to your Microsoft 365 apps and data. This is a cornerstone of a Zero Trust architecture, where no user or device is inherently trusted, regardless of whether they are inside or outside the corporate network.

The key is defining Device Compliance Policies within Intune. These policies specify what constitutes a "healthy" device for your organisation. This might include requirements like:

• The operating system must be up-to-date (e.g., Windows 10/11 within two feature updates of the current release).
• BitLocker encryption must be enabled.
• Antivirus software must be running and up-to-date.
• The device must not be jailbroken or rooted.

Once these policies are configured, Conditional Access steps in. You can create rules that state, for example, "only compliant devices are permitted to access SharePoint Online and OneDrive for Business." If a user tries to access these resources from a device that doesn't meet your compliance standards (perhaps an old home PC with an outdated OS or disabled antivirus), access will be blocked. This dramatically reduces the risk of a compromised device being used to exfiltrate or encrypt your company's valuable data, even if the user's credentials have been stolen.

3. Automating Cyber Essentials Controls

The UK government’s Cyber Essentials scheme provides a baseline for security for any SME. While many businesses strive for this certification, they often struggle to maintain the technical controls once the initial audit is over. Intune is, frankly, the perfect engine for maintaining Cyber Essentials compliance automatically.

Cyber Essentials requires that devices be kept up-to-date and that software is patched. Manual patching is prone to human error, inconsistency, and oversight. With Intune, you can:

• Configure Update Rings: Automatically push Windows Updates to devices on a schedule, ensuring no machine falls behind. This includes both quality updates (security patches) and feature updates (new OS versions), keeping your endpoints current and protected against known vulnerabilities.
• Application Management: Deploy and manage approved software centrally. This ensures that applications like web browsers, productivity suites, and other critical software are also kept updated, addressing another key Cyber Essentials requirement.

Furthermore, Intune’s App Protection Policies (MAM) are invaluable, especially for organisations that allow Bring Your Own Device (BYOD). Even if you allow employees to use personal mobile phones or tablets for work, Intune can containerise business data within specific mobile apps (like Outlook, Teams, or OneDrive). This prevents employees from copying sensitive files into personal cloud storage, local folders, or unapproved apps. It ensures that corporate data remains secure and auditable, even on devices you don't fully manage, which is a critical aspect of data protection and maintaining compliance.

4. Optimising User Experience and Productivity

A common reason Intune is underutilised is the fear of "breaking things." IT managers often shy away from strict policies because they worry about locking users out of their machines or hindering productivity. However, a properly implemented Intune environment actually improves the user experience and streamlines operations.

When you use Intune correctly, the user experience becomes notably smoother and more self-sufficient:

• Company Portal: Instead of calling the helpdesk to install the latest version of Adobe Acrobat, a new printer driver, or a specific line-of-business application, employees can use the Company Portal app. This acts as an internal app store, allowing users to install pre-approved software themselves, reducing the burden on your IT team and empowering users.
• Silent Configuration and Deployment: Applications like Microsoft 365, Edge browser settings, Wi-Fi profiles, VPN configurations, and even printer drivers can be pushed silently to devices. This means a new employee can be "work-ready" within minutes of opening their laptop box, with all necessary software and settings automatically applied without user intervention.
• Standardised Desktops: Configuration profiles allow you to enforce consistent desktop backgrounds, screen saver settings, power management plans, and even browser homepages. This creates a uniform and professional environment, reducing user confusion and support requests related to personalised settings.

When employees don't have to fight their technology, productivity increases, and the burden on your internal IT support team decreases significantly. Frankly, it makes everyone's day less frustrating.

5. Combatting Shadow IT and Ensuring Compliance

Shadow IT—the use of software or hardware without explicit organisational approval—is a massive security risk for UK SMEs. If you aren't using Intune to manage the applications on your devices, you have no visibility into what software is running on your network. This lack of control can introduce vulnerabilities, licensing compliance issues, and data leakage risks.

Intune allows you to take proactive control of your application ecosystem:

• Application Management: You can deploy, update, and remove software centrally across all managed devices. This ensures that only approved applications are installed and that they are kept up-to-date. You can also create an "Allowed" and "Blocked" list for applications, preventing users from installing potentially malicious or non-compliant software. From our service desk data, the most common cause of malware infection in UK SMEs is unauthorised software downloads, often facilitated by a lack of centralised application control.
• Software Inventory Management: Intune provides a clear, real-time dashboard of all software installed across your estate. This is invaluable for security audits, identifying unauthorised applications, and managing your software assets.
• Licensing Compliance: With a clear inventory, you can easily audit which employees are using specific licensed software. This helps you manage your SaaS spend, identify underutilised licences, and avoid unnecessary costs or, worse, compliance fines from software vendors for under-licensing.

By taking control of the application layer, you eliminate the risk of employees downloading "free" tools that might contain malware, violate data protection regulations, or simply create support headaches.

Common mistakes we see

Even with the best intentions, businesses often stumble when it comes to Intune. Here are three common missteps we observe:

• The "Set and Forget" Mentality: Treating Intune as a one-time configuration project rather than a living system that requires regular review and adaptation.
• Failing to Integrate with Conditional Access: Managing devices without linking their compliance status to data access leaves a critical security gap.
• Underutilising Autopilot: Manual device provisioning wastes significant IT time and misses the opportunity for a secure, standardised baseline from day one.
• Ignoring App Protection Policies: Forgetting to implement MAM for mobile devices or BYOD scenarios exposes corporate data to unnecessary risk.
• Neglecting the Company Portal: Overlooking the self-service capabilities of the Company Portal leads to increased helpdesk tickets and a poorer user experience.

Key Takeaways

To ensure your business is getting the most out of Microsoft Intune, keep these core principles in mind:

• Embrace Lifecycle Management: Utilise Windows Autopilot for seamless device provisioning and robust offboarding procedures.
• Integrate for Security: Combine Intune with Entra ID Conditional Access to ensure only healthy, compliant devices can access your data.
• Automate Compliance: Configure Intune’s update rings and configuration profiles to automatically meet Cyber Essentials standards.
• Optimise User Experience: Leverage the Company Portal and silent deployments to empower users and reduce IT support burden.
• Control Your Applications: Use Intune for comprehensive application management, combatting Shadow IT and ensuring licensing compliance.

If your business is currently struggling to balance security with usability, you are likely in the same position as many of our clients before they partnered with us. The complexity of the Microsoft 365 ecosystem is high, but the cost of a data breach or a compliance failure is significantly higher. At Black Sheep Support, we specialise in helping UK SMEs move beyond basic setups to create a hardened, efficient, and compliant IT environment. We don't just "set it up"; we ensure your infrastructure is built to support your growth while keeping your data safe from modern cyber threats.

To take the next step

Book a Discovery Call