Microsoft Intune
Microsoft Intune is a cloud endpoint management service. It enrolls and configures Windows, macOS, Linux, iOS/iPadOS, Android, tvOS and visionOS devices, deploys and protects apps (including on personal devices) and reports device compliance to Microsoft Entra Conditional Access.1
Also known as Intune, Microsoft Intune Plan 1, Microsoft Intune Suite
- Intended for
- Endpoint and device management administrators, Security teams enforcing device compliance, Help desk teams, Schools managing student devices
- Runs on
- Cloud service with no on-premises infrastructure, Co-management with Configuration Manager, Corporate-owned devices (MDM), Personal devices (MAM), Shared and kiosk devices with device-only licenses
At a glance
- What is it?
- Intune is Microsoft's cloud-only service for managing devices and the apps on them, with no on-premises infrastructure required. It is built around three pillars: identities (handled by Microsoft Entra ID), devices and apps. It is licensed as Intune Plan 1 (the base service), Plan 2 and Intune Suite, which add capabilities such as Remote Help, Advanced Analytics, Endpoint Privilege Management, Enterprise Application Management and Cloud PKI. Most organizations get it inside Microsoft 365 E3, E5 or E7. Most licenses that include Intune also grant rights to Configuration Manager for on-premises and co-managed devices.123
- What does it do?
- With mobile device management (MDM) it enrolls devices through the Company Portal, Windows Autopilot, Apple Automated Device Enrollment or Android Enterprise, then applies settings, security policies, apps and updates, and can wipe lost devices. With mobile application management (MAM) it protects work data inside apps such as Outlook and Teams on personal devices and can wipe only company data. It sends compliance state to Entra Conditional Access. Copilot in Intune, powered by Security Copilot, explains policies and settings and runs agents. Every admin center action is backed by a Microsoft Graph API call.1
- Who needs it?
- IT teams that manage company-owned laptops and phones, organizations that let staff use personal devices for email and Teams, and security teams that want access decisions based on current device health. Organizations moving from on-premises Configuration Manager can co-manage devices during the transition, and schools get Intune Plan 1 for Education in Microsoft 365 A3 and A5.2
- What does it need?234
- A Microsoft Entra tenant; Entra ID P1 or P2 for features that depend on it, such as automatic enrollment for co-management
- An Intune license for each user or device that benefits from the service, usually Intune Plan 1 through Microsoft 365 E3, E5, E7 or EMS
- Intune Plan 1 as the base license for any add-on, as of 1 July 2026
- Enrollment programs set up for each platform, such as Windows Autopilot, Apple Automated Device Enrollment or Android Enterprise
- Security Copilot capacity (SCUs) for Copilot in Intune and Intune agents
- What it is not
- Intune does not store identities or authenticate users; Microsoft Entra ID does. It is not an antivirus or EDR product: endpoint security signals come from Microsoft Defender. Devices enrolled with a device-only license do not support app protection policies or Conditional Access. Administrators can manage Intune without their own license, but every user or device that benefits from the service needs one.12
Availability and licensing. Checked 26 Oct 2026: Intune is licensed as Plan 1, Plan 2 and Intune Suite. Plan 1 is included in Microsoft 365 E3 and E5 and in EMS E3 and E5, and Microsoft 365 A3 and A5 include Plan 1 for Education. Microsoft's product page says Intune Suite is included in Microsoft 365 E5 and E7, with select capabilities in E3, and that Plan 1 is the required base for any add-on as of 1 July 2026. The pages checked list no prices. A 30-day free trial is available.3
The problem it solves
Work happens on laptops and phones that rarely touch the corporate network, and many of them belong to employees. IT has to configure and patch these devices, keep company data inside approved apps and stop unhealthy devices from reaching sensitive resources, without ever handling the hardware.
Intune manages devices and apps from the cloud and feeds device compliance into Conditional Access, so access depends on device posture rather than on network location.1
How it works
- Identity: users sign in with Microsoft Entra credentials; Entra security groups are the targets for policies, apps and Intune licenses.
- Enrollment: devices join through Windows Autopilot, Apple Automated Device Enrollment, Android Enterprise or the Company Portal; device-only licenses cover kiosks and shared devices without user affinity.
- Configuration and apps: the Intune admin center pushes settings, deploys apps and applies app protection policies when devices check in.
- Compliance and access: devices report compliance to Entra, and Conditional Access combines it with user, app, location and Defender risk signals.
- AI: Copilot in Intune and its agents use Security Copilot capacity.
Because every admin center action maps to Microsoft Graph, the same operations can be automated with scripts.12
Diagram as a list
Copilot & business apps
- Microsoft Intune admin centerConsole for policies, apps and device actionsConnects to Intune service
- Protected apps (MAM)Keep work data inside apps such as Outlook and Teams
AI models & platform
- Copilot in Intune and agentsExplain policies and run change review, offboarding, policy and remediation agentsConnects to Intune service
Developer tools
- Microsoft Graph APIAutomates every admin center actionConnects to Intune service
Security, identity & governance
- Microsoft Entra ID and Conditional AccessAuthenticates users and uses compliance to allow or block access
- Microsoft DefenderSupplies endpoint security and vulnerability data
Cloud & hybrid infrastructure
- Intune serviceCloud MDM and MAM engine
- Managed devices (Windows, macOS, Linux, iOS/iPadOS, Android, tvOS, visionOS)Receive settings, apps and updates and report compliance
- Configuration ManagerOn-premises management, co-managed with IntuneConnects to Intune service
Capabilities
Mobile device management1
Enrolls and manages whole devices on Android, iOS/iPadOS, Linux, macOS, tvOS, visionOS and Windows, including settings, security, apps, updates and remote wipe.
Why it matters: One cloud console for every common device platform.
Limits: Each platform needs its own enrollment setup, and each managed user or device needs a license.
App protection (MAM)12
Protects work data inside managed apps such as Outlook and Teams without managing the rest of the device, with selective wipe of company data.
Why it matters: Supports bring-your-own-device programs while respecting personal content.
Limits: Not supported on devices enrolled with device-only licenses.
Compliance and Conditional Access1
Sends device compliance state to Microsoft Entra, where Conditional Access combines it with user, app, location and Defender risk signals.
Why it matters: Unhealthy devices cannot reach corporate resources.
Limits: Conditional Access features need the matching Microsoft Entra ID licensing.
Advanced capabilities (Plan 2 and Intune Suite)23
Remote Help, Advanced Analytics, Endpoint Privilege Management, Enterprise Application Management and Cloud PKI, plus Tunnel for MAM, firmware over-the-air updates and specialized devices through Plan 2 or the Suite.
Why it matters: Adds helpdesk, analytics, least-privilege and certificate tools on the same platform.
Limits: Sold as add-ons or in the Suite; Microsoft states the Suite is included in Microsoft 365 E5 and E7, with select capabilities in E3.
Copilot in Intune and agents14
Copilot explains policies and settings and flags conflicts; the Change Review, Device Offboarding, Policy Configuration and Vulnerability Remediation agents work inside the admin center.
Why it matters: Speeds up policy work and helps prioritize vulnerability fixes using Defender data.
Limits: Requires Security Copilot capacity; the Device Offboarding Agent needs admin approval before it offboards a device.
Co-management with Configuration Manager2
Most Intune licenses include Configuration Manager rights; existing Configuration Manager devices can be auto-enrolled into Intune.
Why it matters: Lets organizations move from on-premises management in stages.
Limits: Auto-enrollment for co-management needs Microsoft Entra ID P1 or P2 for each user.
Practical use cases
New laptops have to be prepared by hand before they are shipped to remote staff.
- Approach
- Enroll devices automatically with Windows Autopilot and assign configuration profiles, apps and compliance policies to Entra groups.
- Role of Microsoft Intune
- Intune configures each device when the user first signs in.
- Data, infrastructure and skills
- Intune Plan 1, Microsoft Entra ID and devices registered for Autopilot.
- Type of benefit
- Faster device rollout
- Caveats
- Test profiles with a pilot group before targeting everyone.
- First step
- Create an Autopilot profile and test it on one device.
Employees want email and Teams on personal phones, but the company must protect its data.
- Approach
- Apply app protection policies to Outlook and Teams without enrolling the phones.
- Role of Microsoft Intune
- Intune protects work data inside the apps and can selectively wipe it.
- Data, infrastructure and skills
- Intune licenses for the users and supported apps.
- Type of benefit
- Data protection on personal devices
- Caveats
- Only managed apps are protected; other apps on the phone are not controlled.
- First step
- Create an app protection policy for a pilot group.
Vulnerabilities pile up and the endpoint team cannot decide which to fix first.
- Approach
- Use the Vulnerability Remediation Agent, which uses Defender data to monitor vulnerabilities and rank remediation by risk.
- Role of Microsoft Intune
- Intune hosts the agent and applies the resulting fixes through its policies.
- Data, infrastructure and skills
- Security Copilot capacity and Microsoft Defender vulnerability data.
- Type of benefit
- Prioritized remediation
- Caveats
- Administrators still review and approve the actions.
- First step
- Enable Security Copilot, then open Agents in the Intune admin center.
Works with
Requires
- Microsoft EntraIntune relies on Microsoft Entra ID for authentication, groups and Conditional Access.
Optional integration
- Microsoft Defender XDRDefender supplies endpoint security signals and vulnerability data used by Intune and its agents.
- Microsoft Security CopilotCopilot in Intune is powered by Security Copilot.
Complementary tools
- Microsoft Defender XDRIntune combines Defender risk signals with device compliance for Conditional Access.
- Windows 11 and Copilot+ PCsWindows AI features such as Recall are controlled by policy CSPs that MDM tools like Intune deploy, and Surface DFCI needs Intune and Autopilot.
Required by
- Windows 365Windows 365 Enterprise users need Intune licenses and Cloud PCs are managed in the Intune admin center.
Optional integration for
- Windows 11 and Copilot+ PCsWindows AI policies are set through MDM CSPs, and Surface DFCI management requires Intune and Autopilot.
- Microsoft EntraIntune relies on Entra ID for authentication and groups and sends device compliance to Conditional Access.
- Azure Virtual DesktopSession hosts can be managed with Intune when Entra joined or hybrid joined (Windows client OS).
- Microsoft Agent 365Local agent discovery and policy controls through Intune and Defender, in preview at launch.
- Microsoft Security CopilotCopilot in Intune is powered by Security Copilot.
- Microsoft 365 E7Microsoft lists advanced Intune capabilities in E7.
Relationship labels follow Microsoft's documentation. "Alternative approaches" does not mean one is better: each profile says when it fits.
Getting started
Start a trial or confirm licenses
Sign up for the 30-day free trial, which also creates a trial Enterprise Mobility + Security subscription, or check existing licenses in Tenant administration > Tenant status.
Check: Total Intune licenses shows a non-zero number.
Prepare groups
Create Microsoft Entra security groups for the users and devices you will target.
Check: The groups list your pilot members.
Enroll and configure
Enroll a pilot device and assign a configuration profile and a compliance policy.
Check: The device shows as compliant in the Intune admin center.
Connect Conditional Access
Create a Conditional Access policy that requires a compliant device for Microsoft 365 apps.
Check: A non-compliant test device is blocked from those apps.
Official resources
Deciding whether you need it?
Three free tools apply Microsoft's own published guidance to your situation, and say when Microsoft Intune or any new technology is not needed.
Sources
Each statement above links to the source it comes from. Labels say who reported it.
- What is Microsoft Intune? (opens in a new tab)
- Microsoft Intune licensing plans and options (Microsoft Learn) (opens in a new tab)
- Microsoft Intune product page (opens in a new tab)
- Security Copilot agents in Intune (Microsoft Learn) (opens in a new tab)
- Manage Recall for Windows clients (Microsoft Learn) (opens in a new tab)
- Surface for Business page (opens in a new tab)
Thank you. Your correction was sent.
The editors check it against the sources. If you left an email address, they may reply about it.