Microsoft Intune & Device ManagementEvery laptop and phone encrypted, patched and recoverable, without an engineer touching it.
A lost laptop should be an inconvenience, not a data breach. A new starter's machine should arrive from the supplier and set itself up. A leaver's phone should give up the company data and keep the holiday photos. Microsoft Intune does all of that, it is already in the Business Premium licence most of our clients hold, and we set it up and run it as part of managed support.
Who this is for
Businesses of 10 to 250 people with laptops that leave the building, staff who read work email on their own phones, or an insurer, customer or Cyber Essentials assessor asking how devices are controlled. If you have ever had a laptop go missing and not been sure what was on it, this is for you.
What Intune is, in plain terms
Intune is Microsoft's cloud service for managing devices and the apps on them. It does not need a server, a VPN or a visit from an engineer. A device enrols over the internet, receives the policies set for your business and reports back on whether it meets them.
Those policies are the practical ones: the disk must be encrypted, the screen must lock, updates must be installed within a set window, antivirus must be on. A device that drifts out of line shows up on a report, and Conditional Access can stop it reaching company data until it is fixed.
Intune manages Windows 10 and 11, macOS, iOS and iPadOS, Android, and even Linux and ChromeOS, so a mixed estate of Dell laptops, a few MacBooks and everyone's phones is one console, not three.
You are probably already paying for it
Microsoft 365 Business Premium includes Intune Plan 1, the full device and app management service. Most small businesses on Premium have it switched on for nothing in particular, which is like owning a burglar alarm and never setting it.
Business Basic and Standard do not include Intune. Microsoft lists standalone Intune Plan 1 in US dollars only on its UK pricing page, so for a business on Standard the move to Premium is usually the better buy: it brings Defender for Business, Conditional Access and Autopilot with it. The licensing guide below sets out the comparison.
Source: Microsoft 365 Business Premium (Microsoft UK), Intune plans and pricing (Microsoft UK)
Autopilot: the new laptop that sets itself up
Windows Autopilot is Microsoft's name for the set of technologies that pre-configure new devices and get them ready for use, and that can also reset and repurpose existing ones. A laptop ships from the supplier, the new starter switches it on, signs in with their Microsoft 365 account, and Intune does the rest: encryption, apps, printers, security settings and the company wallpaper if you insist.
The practical effect is that a starter in Horsham does not wait for a laptop to be driven to Brighton and back. Business Premium is a qualifying licence for Autopilot, and we register devices with your hardware supplier so they arrive already assigned to your tenant.
Personal phones without the fight
Nobody wants their employer managing their own phone, and nobody should have to. Intune's app protection policies, often called MAM, protect company data inside Outlook, Teams and the Office apps without enrolling the device at all. Microsoft's documentation is explicit that they work with or without device enrolment.
In practice that means a PIN or biometric on the work apps, no copying company documents into personal apps, and a selective wipe that removes the work data from the work apps and nothing else when someone leaves. The Intune and BYOD guide below walks through what a member of staff will and will not notice.
Windows 10 is out of support
Windows 10 reached the end of support on 14 October 2025. Machines still running it receive no security updates unless they are enrolled in Microsoft's paid Extended Security Updates programme, which Microsoft prices per device and doubles each year for up to three years.
An Intune report tells you in a minute how many Windows 10 machines you still have, which can take the upgrade and which need replacing. That report is the first thing we run at onboarding, and the number is usually a surprise.
How we run it
Device management is part of our standard onboarding rather than a separate project. We enrol company devices, set compliance and app protection policies, stage Conditional Access so that nobody is locked out on day one, set up Autopilot with your hardware supplier, and review the compliance reports as part of the managed service.
Order matters. The lockouts people fear from Intune come from switching everything on at once. We introduce policies in stages, with a pilot group, and tune them so that the protection is real and the interruptions are rare. The same configuration is most of the evidence a Cyber Essentials assessor asks for, so it is built once and used twice.
What is included
Enrolment of every company device
Windows laptops and desktops, Macs, iPhones, iPads and Android phones brought under management, with existing devices migrated from whatever came before.
Security baseline
Disk encryption with recovery keys held in your tenant, screen lock, Defender for Business switched on and reporting, local admin rights removed, and firewall rules set.
Compliance and Conditional Access
Devices must meet the baseline to reach email and files. Policies are staged and piloted so people are warned, not locked out.
Patching and updates
Windows and macOS update rings, with critical patches within 14 days and usually 7, in line with Cyber Essentials. The patch management guide explains the rings.
Autopilot and zero-touch deployment
New devices registered with your supplier, assigned to your tenant and configured on first sign-in. Leavers' devices reset and reissued the same way.
App protection for personal phones
Work apps protected on staff-owned phones with no enrolment, and a selective wipe when someone leaves.
Lost and stolen devices
A remote lock or wipe within the hour of you telling us, and an encryption status we can show your insurer or the ICO.
Reporting
Compliance, encryption and update status reviewed by us and summarised in your quarterly review, and available on request for audits and tenders.
What is not included, and why
- The Microsoft licence. Intune Plan 1 is included in Business Premium; businesses on Basic or Standard need Premium or a standalone Intune licence, which we quote and supply through our distributor.
- Intune Plan 2, the Intune Suite and Remote Help. These are separate Microsoft add-ons for things like Endpoint Privilege Management and advanced analytics. Most businesses under 250 people do not need them; where one would help we say so and quote it.
- Management of devices you do not own and have not agreed to enrol. Personal phones are covered by app protection only, by design.
- Hardware. Laptops, desktops and phones are supplied through our business hardware service at trade pricing and arrive already registered for Autopilot.
What it costs
Device management is included in managed IT support, from £35 per user per month, and in the managed device service for clients on Microsoft 365 management. The Business Premium licence it depends on is £16.90 per user per month at Microsoft's UK price on 2 October 2026, excluding VAT, on an annual commitment. A one-off onboarding project to enrol an existing estate is quoted on the number of devices.
How it starts
- 1Free IT Health CheckA short online check that benchmarks your security and business risk and tells you where you stand.
- 2Discovery callAn engineer, not a salesperson. What you have, what is broken, what it would cost to fix, in writing.
- 3OnboardingEverything moves across on a plan, with no gap in cover and nothing lost.
Questions people ask before signing
Is Intune included in Microsoft 365 Business Premium?
Yes. Business Premium includes Intune Plan 1, Windows Autopilot, Defender for Business and Entra ID P1 with Conditional Access. Business Basic and Standard do not include Intune.
Can Intune manage Macs and iPhones?
Yes. Intune manages macOS, iOS and iPadOS alongside Windows and Android. Apple devices need an Apple Business Manager account linked to your tenant, which we set up; the Apple device management guide covers the detail.
Will staff have to hand over their personal phones?
No. App protection policies protect the work apps without enrolling the device, and Microsoft's documentation states that personal data is untouched. A selective wipe removes company data from the work apps only.
What happens when a laptop is lost?
You tell us, we lock or wipe it remotely, and the encryption status in Intune lets you tell your insurer or the ICO that the data on it was protected. Most of the value of Intune is in that one conversation.
Does this replace antivirus?
No, it runs it. Intune switches on and reports Defender for Business, which is also in Business Premium. Antivirus does not encrypt a lost laptop or wipe a leaver's phone; Intune does.
We still have Windows 10 machines. What now?
Windows 10 has been out of support since 14 October 2025. Intune reports which machines can upgrade to Windows 11 and which cannot. Replacements arrive through Autopilot; Extended Security Updates are a paid stopgap, not a plan.
How long does it take to roll out?
For a business of 20 to 100 devices, typically two to four weeks: pilot group first, then the rest in waves, with Conditional Access switched to enforcement last.