Here’s the short version: Microsoft Intune for small business is the cloud tool that enrolls laptops and phones, pushes the settings you already think you have, and lets you wipe a lost device the same day. If you pay for Microsoft 365 Business Premium and nobody has opened the Intune admin center, you bought the gym membership.
We still walk into Valley offices where the “device list” is a Best Buy receipt folder. Someone left last quarter. Their laptop is in a kitchen. Outlook is still open. That is the problem Intune is for.
This is not a tour of every blade in the admin center. It is the decision and the first 90 days. For license choice, start with Microsoft 365 Business Premium vs E3. For tenant controls around identity and mail, use the Microsoft 365 security checklist.
What Microsoft Intune for small business actually does
Microsoft describes Intune as a cloud endpoint management service. You enroll devices, set configuration and security, deploy apps, and keep them current. It runs in the browser. There is no on-premises server to babysit.
It sits on three things:
- Identities in Microsoft Entra ID. Intune does not store passwords. People sign in with the same work account they use for mail.
- Devices you enroll (or refuse to enroll). Windows, macOS, iOS/iPadOS, Android, and a few specialty platforms.
- Apps you protect, even when the phone is personal.
Two modes matter in a 20-person firm:
| Mode | What you control | Typical use |
|---|---|---|
| MDM (device management) | The whole device: BitLocker, PIN, updates, wipe | Company laptop or phone |
| MAM (app protection) | Work data inside Outlook, Teams, OneDrive | Personal phone |
You can use both. A company laptop gets MDM. The same person’s personal iPhone gets MAM so mail does not live in an unmanaged Mail app.
CIS treats knowing your hardware as Inventory and Control of Enterprise Assets. Intune is how a small firm actually produces that inventory instead of a spreadsheet that died in 2023.
Do small businesses need Intune?
Yes, if people open work mail or files on more than one machine and you cannot, today, wipe the one that got left in an Uber.
You do not need Intune because a vendor said “zero trust” on a slide. You need it because:
- Laptops walk. So do phones.
- Consumer Windows Home PCs cannot do the enrollment path you think they can (more on that below).
- Insurers and clients now ask whether devices are encrypted and managed. “We told people to turn on BitLocker” is not an answer.
- Offboarding without a device record is theater. See the employee offboarding IT checklist.
Headcount is a weak filter. A 9-person law practice with 14 laptops and 9 personal phones has more endpoints than a 40-person shop that never issued hardware. Count devices that can open client data.
If every person works only on a locked-down desktop that never leaves the office and never sees a phone, you can wait. We have not met that firm in years.
Decide what a device must look like before it touches mail. Encryption on, PIN on, OS current, and a name in a console. That is the bar.
What you already paid for
Most small firms already own Intune and do not know it.
Microsoft’s Business Premium device guidance is explicit: Business Premium includes Microsoft Intune Plan 1. That is the base MDM and MAM service. E3 also includes Intune Plan 1. You are not shopping for a new product. You are turning on a product on the invoice.
Microsoft’s Intune licensing page splits the rest:
- Plan 1: enroll, configure, protect apps, basic analytics. This is what SMBs use.
- Plan 2: add-on. Remote Help and Advanced Analytics live here.
- Suite: Plan 2 plus extras such as Endpoint Privilege Management and Cloud PKI.
Do not buy Suite because the name sounds finished. Buy it when a named problem (privilege elevation, remote screen control that is not a consumer tool) shows up on a ticket.
Admins can often manage Intune without an extra Intune seat. Users and devices that benefit from the service still need a license. Shared kiosks and “no user” devices are a different SKU. Ask before you enroll the lobby iPad on a user’s leftover license.
Plan 1 versus the Suite
If you are under 300 people on Business Premium, start with Plan 1 and a short policy list. Suite is not the difference between “secure” and “insecure.” Turning on compliance, Autopilot, and a wipe test is.
MDM versus MAM: company laptop versus personal phone
This is where firms either get sane or start a fight with the staff.
Company-owned Windows or Mac: enroll the device. Require BitLocker or FileVault, a PIN or password, a current OS, and Defender or equivalent. Push Office from Intune instead of letting people download whatever installer they find. If the laptop is stolen, retire or wipe it from the console.
Personal phone: do not enroll the whole phone unless the person asked for a company device and you are ready for the politics. Use app protection policies. Those policies can:
- Require a PIN or biometrics to open work Outlook
- Block copy from work mail into personal WhatsApp
- Stop saving work files to personal iCloud
- Wipe only the work account when HR says they are gone
The person keeps photos, texts, and personal apps. You keep the matter files. That is the deal that actually gets adopted.
Treat the phone as a computer that leaves the building every night. If mail is on it, it is in scope.
Windows Autopilot: stop imaging every laptop
Windows Autopilot is how a new PC becomes a work PC without a technician cloning a disk. The OEM Windows install stays. The user signs in with work credentials. The device joins Entra ID, enrolls in Intune, and picks up apps and policies.
From the user’s side: unbox, plug in, sign in, wait. From IT: no USB image, no “can you bring it to the office Tuesday.”
Autopilot needs a supported Windows edition, a hardware hash registered to your tenant (or a partner/OEM who does that), and automatic MDM enrollment. Automatic enrollment sits on Microsoft Entra ID P1, which Business Premium already includes.
Use Autopilot Reset when the same laptop goes to the next hire. That is faster than a weekend reimage and cleaner than “just delete the old profile.”
Windows Home is the silent blocker
This is the mistake we see on almost every first Intune project.
Someone bought a stack of consumer laptops on sale. They are Windows 11 Home. Autopilot and Entra join expect Pro or higher. Microsoft’s own enrollment troubleshooting says Autopilot fails on Home: upgrade the edition.
Home can sometimes enroll through Company Portal as a personal device, with fewer controls. That is not a fleet standard. It is a workaround.
Buy Windows 11 Pro (or Business) for staff PCs. If you already own Home machines, budget the Pro upgrade before you promise Autopilot. A $30 license mistake turns into a two-week delay and a room full of people who think Intune “doesn’t work.”
Compliance policies and Conditional Access
Enrollment without teeth is a directory of names.
Intune compliance policies score a device: encrypted or not, PIN or not, OS current or not, jailbroken or not. That score goes to Entra ID.
Conditional Access with Intune then uses the score. Example: Outlook and SharePoint only from a compliant device, plus MFA. A personal PC that never enrolled simply does not get mail. That is zero trust in one sentence, not a framework binder.
Start with a small set:
- Require MFA for all users (MFA first, always).
- Block legacy authentication.
- Require a compliant device for Exchange, SharePoint, and Teams on company laptops.
- For personal phones, require an approved app with an app protection policy instead of a full MDM join.
Give people a grace period the first month. Then enforce. A policy that stays in “report only” forever is a screenshot, not a control.
Lost laptop, same-day wipe
MDM wipe or retire is why you enrolled. Test it on a spare before you need it. Know the difference:
- Wipe: factory reset. Company laptop, gone.
- Retire / selective wipe: remove company data and management. Right action for a BYOD phone.
Put the steps in the offboarding ticket, not in someone’s head.
A first-90-days Intune setup that actually holds
Do this in order. Do not start with 40 configuration profiles.
Days 1 to 15: inventory and licenses
- Export every laptop and phone you can find. OS edition, owner, serial.
- Confirm Business Premium (or E3) is assigned to people who will enroll.
- Turn on automatic MDM enrollment in Entra.
- Create groups: “Windows company,” “macOS company,” “iOS personal,” “Android personal.”
Days 16 to 45: baseline policies
- Windows compliance: BitLocker, PIN, Defender on, minimum OS.
- One Windows configuration: Windows Update rings, Edge homepage, block consumer Microsoft accounts on company PCs if you are ready.
- Deploy Microsoft 365 Apps from Intune.
- App protection for Outlook, Teams, OneDrive on iOS and Android.
- Autopilot profile for new purchases only. Do not Autopilot a messy existing PC on day one.
Days 46 to 90: access and proof
- Conditional Access: require compliant device for company Windows. Require approved client app / app protection for phones.
- Pilot ten people. Fix the printers, VPN, and the one line-of-business app that hates MDM.
- Wipe a spare laptop. Time it. Write the steps next to the offboarding list.
- Lock down Intune admins. CISA’s March 2026 alert is blunt: treat endpoint management as a high-value system. Least privilege, phishing-resistant MFA on admins, watch the console. Intune can push software to every PC. That is a gift to an attacker if the admin account is weak.
If you want this run as a service, managed help desk owns enrollment day to day, including the Conditional Access and admin hygiene around it.
What Intune is not (and why first projects stall)
Intune is not antivirus. Pair it with Defender for Business (in Business Premium) or another EDR. Enrollment without an agent still leaves malware as a separate problem.
It is not a backup. Wiping a laptop does not restore the OneDrive that never synced. Keep Microsoft 365 backup in the same conversation.
It is not a reason to enroll every personal iPad in the building. Over-enroll and people will hide devices. Under-enroll and you will wipe nothing when it matters.
Projects stall for boring reasons:
- Windows Home fleet
- Local admin passwords nobody documented
- A line-of-business app that only installs with a USB stick
- Policies assigned to “All users” that break the owner’s home PC
- No communication. People think IT is “taking the phone”
Tell staff what you will and will not see on a personal device. Then keep that promise.
If you are still on a pile of unmanaged PCs and a hope, start with Business Premium (or confirm you already have it), buy Pro for the next order of laptops, and run the 90-day list. We wrote one rollout up as Microsoft Intune without recalling every laptop. If you want a Canoga Park team to do the enrollment and the wipe test with you, contact Secure Techies.
Frequently Asked Questions
