Microsoft Intune for a small business: what it manages, what it costs, and what it leaves to you

Microsoft describes Intune as a cloud-based endpoint management service that secures and manages an organisation's devices and apps. It is used to enrol, configure, secure and update devices, to deploy and protect apps, and to control which users and devices can reach the organisation's resources. It runs entirely in the cloud, with no on-premises infrastructure required, and supports Windows, macOS, iOS and iPadOS, Android and Linux, among others.

Every Microsoft 365 business plan has some of it. Business Basic and Business Standard include Basic Mobility and Security, which Microsoft calls a free mobile device management solution and a subset of Intune. Business Premium includes Intune Plan 1.

Intune works in two ways, which can be used together. In mobile device management (MDM), the device is enrolled and Intune manages all of it: settings, security and apps. An enrolled device that is lost or stolen can be wiped. Microsoft recommends MDM for company-owned devices.

In mobile application management (MAM), Intune manages only the work apps and the data in them. Microsoft describes it as typical for staff's own devices: the person keeps control of their personal apps and content, and when they leave, the business can wipe its data from the work apps without touching anything personal. It cannot factory reset the phone, since that would delete personal data.

A company phone can have both: enrolled in MDM, with app protection on the apps that handle especially sensitive data.

A device joins Intune by enrolment, when Intune installs a management certificate on it and starts applying the business's policies. On a member of staff's own device, the person starts and completes enrolment in the Intune Company Portal app. Devices can also be enrolled automatically, through Windows Autopilot, Apple Automated Device Enrollment or Android Enterprise.

Each kind of device needs a step first. Microsoft's guidance for Business Premium lists an Apple MDM push certificate for Apple devices, a connection to a managed Google Play account for Android, and automatic enrolment set up for Windows. It starts one step earlier still: under that guidance, personal devices the business will protect with MAM, such as staff's own phones, are not enrolled in Intune, so it blocks their enrolment first.

A compliance policy is a set of rules a managed device has to meet for Intune to count it as compliant. Microsoft's examples include a minimum operating system version and a device that is not jailbroken or rooted. Its recommended Windows policy for Business Premium requires BitLocker, Secure Boot, a firewall, antivirus and Microsoft Defender's real-time protection, among other settings. A device that fails can be marked non-compliant or locked remotely, and its user can be sent an email about how to fix it.

On its own, a compliance policy does not stop a non-compliant device reaching email. Microsoft's Business Premium guidance says the policies are not enforced until a device-based Conditional Access policy applies to the device. And by default Intune counts a device with no compliance policy as compliant; Microsoft advises changing that setting to Not compliant where Conditional Access relies on compliance.

Conditional Access comes with Microsoft Entra ID P1, which Business Premium includes. Microsoft says organisations whose Conditional Access policies replace security defaults must turn security defaults off, and should turn the Conditional Access policies on immediately. Two-step sign-in for every Microsoft 365 user gives the baseline policy that keeps two-step sign-in in place when that happens.

App protection policies keep work data inside managed apps, the Microsoft 365 apps among them, without enrolling the phone. Microsoft's examples: a PIN or fingerprint to open work email, no copying and pasting of work data into personal apps, and work data opened only in approved apps. The policies apply only when an app is used for work, and the work data can be wiped from the apps without removing them.

Each person needs an Intune licence. On Android, the Intune Company Portal app has to be on the phone for the policies to arrive. Microsoft also advises using Conditional Access with app protection, to make sure the policies are enforced. Its recommended starting point for Business Premium, for both iOS and Android:

Windows Autopilot sets up new Windows devices from the copy of Windows the manufacturer installed, so there is no custom image to build and keep: it applies the business's settings and policies and installs its apps. Microsoft says the only thing it asks of the user is to connect to a network and verify their credentials; everything beyond that is automated. Its Business Premium guidance uses Autopilot to set up PCs with business-critical apps, policies and features such as BitLocker before they reach the people who will use them.

Enrolling those devices into Intune automatically needs a Microsoft Entra ID P1 or P2 subscription to configure, and Business Premium includes P1. Autopilot Reset prepares a laptop already in use for its next user. Basic Mobility and Security has no Autopilot.

From Microsoft's Irish pages in October 2026: per user a month, paid yearly on an annual subscription that renews automatically, before VAT, in the view each page opens with, which includes Teams. Microsoft's platform service description gives the same split between the business plans. The business plans are for 1 to 300 employees.

Microsoft says an Intune licence is needed for any user or device that benefits from the service. Administrators can manage Intune without one, by default in tenants created after July 2021.

The Irish Intune page priced six add-ons in euro, each per user a month, paid yearly, before VAT, and each needing Intune Plan 1. Microsoft 365 Basic, Standard or Premium for security covers what else Business Premium adds besides Intune.

Microsoft's own documentation sets out the limits. The first is sign-in: two-step sign-in on Microsoft 365 and Google Workspace covers that side.