Microsoft Intune for Small Business: A Practical Guide

Every small office has a version of this story. A new hire starts Monday. Someone spends half of Friday unboxing a laptop, running updates, installing Office, setting up the printer, guessing which settings the last laptop had, and writing the local admin password on a sticky note "temporarily." Six months later nobody remembers whether that laptop is encrypted. Then it gets left in an Uber.

Microsoft Intune exists to end that story. It's Microsoft's cloud service for setting up, securing and managing company devices, from Windows laptops to iPhones, without anyone having to touch them in person. Microsoft describes it as a cloud-based endpoint management solution that manages user access and simplifies app and device management across many devices (Microsoft Learn, What is Intune).

I handle device rollouts and day-to-day support for our clients at Beefed Up IT, so this guide is the practical version: what Intune actually does, how Autopilot zero-touch setup works, which policies matter for a 5–50 person office, how to handle personal phones, what to do when a laptop goes missing, and a realistic rollout plan. No IT degree required.

What is Microsoft Intune, in plain English?

Intune is a central control panel for every company device. You decide the rules once (encrypt the disk, install these apps, apply updates within a week, require a PIN), and Intune applies them to every device and reports which ones comply.

A useful way to think about it: your Microsoft 365 account controls who you are. Intune controls what device you're using and whether it's healthy. Put the two together, using Conditional Access in Microsoft Entra ID (Microsoft's sign-in service), and you get a rule like "only let people open patient records from a company laptop that is encrypted, updated and running antivirus." That's the heart of what security people call zero trust: don't assume a device is safe just because it's inside the office.

Intune handles five big jobs:

1. Setup. New Windows PCs configure themselves with Windows Autopilot; new iPhones, iPads and Macs enroll automatically through Apple Business Manager.
2. Configuration. Security settings, Wi-Fi profiles, VPN, printers, browser settings and restrictions are pushed from the cloud.
3. Compliance. Intune checks each device against your rules (encrypted? updated? antivirus on?) and reports whether it passes.
4. Apps and updates. Install Microsoft 365 Apps, line-of-business software and browser extensions; control when Windows updates install.
5. Protection and response. Lock, wipe or retire lost devices, and protect company data on personal phones without managing the whole phone.

Glossary terms if you want the short version: Intune, Autopilot, endpoint, zero trust.

Do I already have Intune? Which licenses include it?

If you have Microsoft 365 Business Premium, Microsoft 365 E3 or E5, you already have Intune Plan 1. Business Basic and Business Standard don't include it.

Microsoft's Business Premium FAQ confirms Premium bundles the security and management tools small businesses need, adding device management and Defender for Business on top of Business Standard (Microsoft Learn, Business Premium FAQ). Intune can also be bought standalone, but for most offices that costs about the same as upgrading to Premium, without the rest of the security tools. Our guide to Microsoft 365 Business Basic vs Standard vs Premium walks through that decision.

Microsoft's licensing reference lists exactly which plans include which Intune capabilities (Microsoft Learn, Intune licensing). Each person who uses an Intune-managed device needs a license; one license typically covers multiple devices for that person.

How does Windows Autopilot zero-touch setup work?

With Windows Autopilot, a new laptop ships directly to the employee. They connect to Wi-Fi, sign in with their work email and password, and the laptop joins your organization, enrolls in Intune, applies your security settings and installs your apps on its own. No imaging, no technician, no Friday afternoon lost.

Microsoft describes Autopilot as a collection of technologies used to set up and pre-configure new devices, getting them ready for productive use, and notes it can also reset, repurpose and recover devices (Microsoft Learn, Autopilot overview).

What the employee sees

1. They unbox the laptop and turn it on.
2. They choose language and connect to Wi-Fi.
3. They see your company name on the sign-in screen and enter their work account.
4. They approve a multi-factor authentication prompt on their phone.
5. A progress screen shows settings and apps installing. Depending on how many apps you push and internet speed, this might take 15 to 60 minutes.
6. They land on a desktop with Outlook, Teams, OneDrive, your printers and your line-of-business apps ready to go, as a standard (non-administrator) user.

What happens behind the scenes

There are now two flavors of Autopilot, and it's worth knowing which one your IT provider uses:

• Classic Windows Autopilot relies on registering each device's hardware ID (a "hardware hash") with your organization before first boot. Many business PC resellers and manufacturers can do this registration for you when you order. For existing PCs, the hash can be collected and uploaded.
• Windows Autopilot device preparation is the newer approach. It requires Windows 11 (version 24H2, or 22H2/23H2 with a March 2024 update or later) and Microsoft Entra join. It uses "enrollment time grouping" to add the device to a security group the moment the user signs in, so the selected apps and scripts install during setup, and it gives near real-time deployment reports (Microsoft Learn, Autopilot device preparation). By default, it makes sure users are standard non-administrator users.

Why it matters for a small office

• Consistency. Every laptop gets identical settings. No more "the one Dr. Smith's laptop that's different."
• Speed. A new hire's laptop can be drop-shipped to their home. Onboarding goes from hours of technician time to minutes of the employee's time.
• Recovery. If a laptop gets messed up, an Autopilot reset can return it to a business-ready state remotely instead of hand-rebuilding it.
• Security from minute one. Encryption, antivirus and update policies apply before the employee even opens email.

A real example

Our software startup case study is a good illustration. The company was hiring every month and had valuable source code to protect, but no budget for a full-time IT administrator. We set up zero-touch provisioning so new laptops configured themselves on first sign-in, with a secure configuration from day one and every device checked before it got access. Full-disk encryption, endpoint protection, multi-factor sign-in and Conditional Access meant source code was reachable only from compliant devices, and a lost laptop became "a hardware problem, not a data breach." The result was secure, consistent onboarding for every new hire without building an in-house IT team.

What are Intune compliance policies and why do they matter?

A compliance policy is a checklist each device must pass (encrypted, updated, password set, antivirus healthy). Paired with Conditional Access, devices that fail can't open company email or files until they're fixed.

Microsoft defines compliance policies as "sets of rules and conditions that you use to evaluate the configuration of your managed devices," and notes that integrating them with Conditional Access helps ensure "only compliant devices can access corporate resources" (Microsoft Learn, Device compliance).

A sensible starter compliance policy for Windows

• Require BitLocker (disk encryption).
• Require Secure Boot and code integrity (protects against tampering at startup).
• Minimum operating system version (for example, a supported Windows 11 release).
• Require a password or Windows Hello to unlock.
• Require Microsoft Defender Antimalware to be on, with current definitions.
• Require the firewall to be on.
• Device must be at or under a "low" machine risk score from Defender for Business (this ties endpoint protection to access decisions).

For iPhone, iPad and Android (company-owned)

• Minimum OS version.
• Device passcode required.
• Not jailbroken or rooted.
• Encryption (automatic on modern iOS; enforced on Android).

Two tenant-wide settings people forget

Microsoft points out two settings that apply across your whole Intune environment:

1. "Mark devices with no compliance policy assigned as." The default is Compliant. If you use Conditional Access, Microsoft recommends changing it to Not compliant "to ensure that only devices that are confirmed as compliant can access your resources." Leaving the default is like having a bouncer who waves in anyone without an ID because, technically, they didn't show a fake one.
2. "Compliance status validity period." If a device doesn't check in within this window (30 days by default, configurable from 1 to 120), it's treated as noncompliant. That catches the laptop that's been sitting in a drawer since the summer.

Actions for noncompliance

Each policy can do more than flag a device. You can email the user (and IT) when their device falls out of compliance, give a grace period (say, three days to install an update), remotely lock it, or mark it for retirement after an extended period. A grace period matters: you don't want the office manager locked out of email at 8 a.m. because Windows needed a reboot.

How do you encrypt devices with BitLocker through Intune?

Intune can turn on BitLocker on Windows PCs (and FileVault on Macs) silently, store the recovery keys in Entra ID, and report which devices are encrypted. That report is the proof auditors and insurers ask for.

BitLocker is Windows' built-in full-disk encryption. If someone steals the laptop and pulls the drive, the data is unreadable without the user signing in. Encryption at rest is the general term for protecting stored data this way. See BitLocker and encryption at rest.

Intune can manage encryption for both BitLocker on Windows and FileVault on macOS, and it provides an encryption report showing the status across your devices (Microsoft Learn, Encrypt devices with Intune).

How we typically configure it

1. Silent encryption for Entra-joined Windows devices so users aren't asked any questions.
2. Encrypt the operating system drive and fixed data drives with a strong encryption method (XTS-AES 256 is common).
3. Require recovery keys to be backed up to Entra ID before encryption starts, so you never end up with an encrypted laptop and no key.
4. TPM-based unlock (the TPM, or Trusted Platform Module, is a security chip in modern PCs; Windows 11 requires TPM 2.0).
5. Decide about removable drives. For medical and dental practices, consider requiring encryption before anything can be written to a USB drive, or blocking USB storage altogether.
6. Check the encryption report weekly for the first month, then monthly.

Why this matters so much in healthcare

Under the HIPAA Breach Notification Rule, notification obligations apply to breaches of unsecured protected health information. HHS guidance treats PHI encrypted according to its guidance as secured, which means a lost encrypted laptop generally isn't a reportable breach, while a lost unencrypted one may well be (HHS, Breach Notification Rule). This is general information, not legal advice, but the practical lesson is simple: encryption you can prove is one of the best-value controls a practice can have. Our HIPAA Security Rule checklist covers the other safeguards.

How does Intune deploy and update apps?

Intune can install Microsoft 365 Apps, Microsoft Store apps, and your own line-of-business software (packaged as "Win32" apps), automatically or on demand through the Company Portal. It can also keep apps updated and remove them.

The app types you'll actually use

The Win32 app type is the workhorse for business software. Intune can deploy traditional Windows installers, check whether each install succeeded, handle dependencies (install this runtime first) and supersedence (replace version 3 with version 4) (Microsoft Learn, Win32 app management).

"Required" vs "Available"

• Required apps install automatically. Use this for everything every person must have: Office, your antivirus, your practice management client, your VPN.
• Available apps appear in the Company Portal for people to install themselves. Use this for optional tools such as a PDF editor or a screen-capture tool. People get what they need without being local administrators.

Practical tips from rollouts

• Ask your software vendors for silent install instructions. Most dental and medical software vendors have them; a few still expect someone to click "Next" eleven times. Know which is which before you go zero-touch.
• Don't push 30 apps during Autopilot. Install the essentials during setup and let the rest install afterward. Users would rather start working than stare at a progress bar.
• Remove local admin rights. Once apps come from Intune, nobody needs to be an administrator day to day. That's a big win against ransomware. See least privilege.
• Watch for apps that need a special driver, such as signature pads, intraoral sensors, check scanners and label printers. Test those on a pilot machine first.

How should a small office handle Windows updates with Intune?

Use Intune update rings to roll updates out in waves: a few test PCs first, then everyone else a few days later, with deadlines so updates don't get postponed forever. Or, if you have Business Premium, consider Windows Autopatch to automate the wave scheduling.

Microsoft explains that update rings "define how and when Windows updates are installed on devices," controlling deferral periods, restart settings, deadlines, active hours and user notifications, and are "commonly used to create deployment stages—for example, test, pilot, and production" (Microsoft Learn, Manage update rings).

A simple three-ring design for a 10–40 person office

Some key settings and features worth knowing:

• Active hours stop Windows from restarting during the workday. For a practice open 7 a.m. to 7 p.m., set active hours accordingly.
• Deadlines force installation after a set number of days, so the "Remind me tomorrow" button doesn't turn into a three-month habit.
• Pause stops feature or quality updates for a ring for up to 35 days if Microsoft releases a problem update.
• Uninstall lets an administrator roll back the latest quality or feature update across a ring.
• Feature updates policies let you hold PCs on a specific Windows 11 version until you've tested the next one.

If you're still finishing the move off Windows 10, Intune update policies can also help push eligible PCs to Windows 11. Our Windows 10 end of support guide covers that plan.

What about Windows Autopatch?

Windows Autopatch is a Microsoft service that automatically manages update rings and rollout waves for Windows, Microsoft 365 Apps, Edge and Teams. Microsoft lists Business Premium among the eligible licenses (Microsoft Learn, Autopatch prerequisites). For many small offices, Autopatch plus a short exceptions list is less work than hand-built rings. Microsoft notes that when devices are managed through Autopatch, admins typically shouldn't assign their own custom update rings to those devices, so pick one approach per device.

Either way, the goal is patch management you can prove: a monthly report showing every PC is current. See patch management.

How does Intune handle personal phones (BYOD)?

For personal phones, use Intune app protection policies instead of full device enrollment. They protect company data inside Outlook, Teams, OneDrive and other managed apps, and can remove only that data later, without touching personal photos, texts or apps.

BYOD (bring your own device) means employees use their own phones or tablets for work. It's convenient and saves money, but it's also how patient information ends up in someone's personal Gmail.

Microsoft describes app protection policies as rules that ensure an organization's data remains safe or contained within a managed app, and they can work whether or not the device is enrolled in Intune (Microsoft Learn, App protection policies).

What a good BYOD app protection policy does

• Requires a PIN or biometric to open Outlook, Teams and OneDrive (separate from the phone's unlock).
• Blocks "Save As" to personal storage such as personal iCloud or Google Drive.
• Restricts copy and paste from work apps into personal apps (for example, from a Teams chat about a patient into personal WhatsApp).
• Encrypts company data in the app.
• Blocks screenshots of work apps on Android (iOS doesn't allow apps to block screenshots in the same way).
• Requires a minimum app and OS version so old, vulnerable versions can't reach company data.
• Wipes company data after a period offline (say, 90 days without check-in).
• Selective wipe when the person leaves: work email, files and chats disappear from the apps; family photos stay.

Pair it with Conditional Access

App protection is strongest when Conditional Access requires an "approved client app" or "app protection policy" for mobile access. That stops someone from simply bypassing Outlook and adding their work email to the phone's built-in mail app, where your policies don't apply.

When to enroll the whole device instead

Personal Windows PCs deserve a special mention. It's tempting to let staff "just check the schedule from home." For a medical or dental practice, an unmanaged home PC shared with teenagers who download game mods isn't somewhere patient data should land. Conditional Access can allow web-only access with downloads blocked, or block access outright from unmanaged computers.

What do you do when a device is lost, stolen or an employee leaves?

Act in this order: block the account's sessions, lock or wipe the device in Intune, confirm encryption, document what happened, and decide whether it's a reportable incident. Intune gives you the remote tools; the process is what makes them useful.

Intune offers several remote actions (Microsoft Learn, Wipe, retire or unenroll):

A lost-laptop playbook

1. Within minutes: The employee reports the loss (make sure everyone knows who to call, including after hours).
2. Revoke sessions: In Entra ID, revoke the user's sign-in sessions and reset their password. This kicks the device out of email and files even if it's online.
3. Check Intune: Confirm the device is encrypted (BitLocker status) and when it last checked in.
4. Lock or wipe: If it's likely stolen, wipe it. If it's probably in a coat pocket, lock it first.
5. Document: Device name, serial, user, time reported, encryption status, actions taken and times. Your risk assessment and your insurer will want this.
6. Assess: For a healthcare practice, work through your breach risk assessment. An encrypted device with a strong sign-in is a very different situation from an unencrypted one. Our HIPAA breach response plan covers the decision process.
7. Replace: Ship a replacement laptop straight to the employee; Autopilot sets it up.

Offboarding a departing employee

1. Disable the account and revoke sessions on their last day (same day, not "when we get around to it").
2. Retire personal devices (selective wipe) and collect company devices.
3. Convert their mailbox to a shared mailbox if colleagues need access, then remove the license.
4. Transfer ownership of their OneDrive files.
5. Autopilot reset the laptop for the next hire.

What does a realistic Intune rollout plan look like?

For a 10–30 person office, plan two to six weeks across five phases: prepare, pilot, configure, roll out, and operate. Rushing is how you lock the front desk out of the schedule at 7:45 a.m. on a Monday.

Phase 1: Prepare (week 1)

• Inventory every device: computers, phones, tablets, who uses them, Windows version, age and whether they're company or personal. Our Computer Replacement Planner helps here.
• Confirm licensing: Business Premium (or Intune plus Entra ID P1) for every user.
• Decide your join strategy: For most small offices without an on-premises server, Microsoft Entra join (cloud-only) is simplest. If you still have an on-premises Active Directory server, plan whether to move away from it or use hybrid join temporarily.
• List your critical apps and their install requirements. Call vendors if needed.
• Pick a pilot group: three to five people across roles, at least one of whom is honest enough to tell you when something's annoying.

Phase 2: Pilot (weeks 1–2)

• Configure enrollment, a baseline compliance policy, BitLocker, Defender onboarding, update rings and core apps.
• Enroll pilot devices (fresh Autopilot for new PCs; enroll or reset existing ones).
• Turn on Conditional Access policies in report-only mode so you can see what would be blocked without blocking it.
• Run normal work for a week. Check printing, scanning, practice management, imaging and any signature pads.

Phase 3: Configure and harden (weeks 2–3)

• Adjust settings based on pilot feedback.
• Apply security baselines (Microsoft publishes recommended baseline settings for Windows and Defender).
• Set up app protection policies for personal phones.
• Remove local admin rights; set up Windows LAPS (Local Administrator Password Solution) so each PC's local admin password is unique and stored securely.
• Prepare user communications: what's changing, what they'll see, who to call.

Phase 4: Roll out (weeks 3–5)

• Enroll the remaining devices in batches (department by department, or a few each evening).
• Switch Conditional Access from report-only to on, starting with "require MFA" and then "require compliant device" for sensitive apps.
• Change "devices with no compliance policy" to Not compliant.
• Watch the compliance and encryption reports daily for the first two weeks.

Phase 5: Operate (ongoing)

• Weekly: Review noncompliant devices and Defender alerts.
• Monthly: Review update compliance, encryption status and stale devices (not checked in for 30+ days).
• Quarterly: Review policies, app versions and who has admin roles.
• Yearly: Renew the Apple push certificate (if you manage Apple devices), review your compliance rules against your risk assessment, and update documentation.

What does Intune look like in a dental office, medical practice or CPA firm?

The tools are the same; the priorities differ. Here's how we'd typically approach each.

Scenario 1: A seven-operatory dental practice

The practice has 12 workstations: front desk, operatory PCs connected to intraoral sensors and imaging, the doctors' office and a server closet. Priorities:

• Operatory PCs: Enroll and encrypt, but put them in an exceptions update ring with after-hours restarts only. Test imaging software and sensor drivers before every feature update. A surprise reboot mid-scan is how you end up retaking an X-ray.
• Front desk: Standard users, required apps for practice management and insurance portals, strict Defender settings (front desks receive the most phishing).
• Doctors' laptops: Full Autopilot setup, BitLocker, Conditional Access requiring a compliant device to open SharePoint folders containing patient documents.
• Phones: App protection for personal phones using Outlook and Teams; no patient photos on personal camera rolls.

Our dental office IT guide goes deeper on imaging and network setup.

Scenario 2: A 20-person medical practice with remote billing staff

• Remote billing staff: Company laptops shipped directly via Autopilot. No personal PCs for anything involving patient data.
• Exam room PCs: Shared devices with fast sign-in (Windows Hello for Business or badge-based options, depending on hardware), auto-lock after short inactivity.
• Compliance: Defender risk level tied to compliance; Conditional Access blocks noncompliant devices from the EHR's web portal where supported.
• Documentation: Monthly encryption and update reports saved as evidence for the practice's risk assessment.

Scenario 3: A 15-person CPA firm

• Tax season surge: Seasonal staff get Autopilot laptops that are reset and stored in May, ready for next January.
• Data protection: Block USB storage, require BitLocker, and use Conditional Access so client files only open on managed devices. This mirrors the controls in our accounting firm case study, where managed devices, encryption everywhere and access tied to device health helped the firm pass its client security reviews with no remediation findings.
• FTC Safeguards Rule: Intune's reports become part of the firm's written information security program evidence. See IT security for CPA firms.

Can Intune manage Macs, iPhones and Android devices too?

Yes. Intune manages macOS, iOS, iPadOS and Android alongside Windows, so you don't need a second tool for the doctor who insists on a MacBook. The setup steps are just a little different for each platform.

• Apple devices (company-owned): Connect Intune to Apple Business Manager, Apple's free portal for organizations. When you buy Macs, iPhones or iPads from Apple or an authorized reseller linked to your account, they're assigned to your organization automatically. The first time someone turns one on, it enrolls in Intune, much like Autopilot does for Windows (Microsoft Learn, Apple automated device enrollment). Company iPhones enrolled this way are "supervised," which unlocks extra controls such as lost mode and blocking the user from removing management.
• Apple push certificate: Intune needs an Apple MDM push certificate to talk to Apple devices. It expires every year. Create it with a shared company Apple account, not someone's personal Apple ID.
• Macs: Intune can enforce FileVault encryption, push configuration profiles, deploy apps and check compliance. Mac management is very capable now, though some Mac software still needs a little extra packaging work.
• Android: Use Android Enterprise. Personal phones get a separate "work profile" that keeps work apps in their own container; company phones can be fully managed or locked to a single app as a kiosk.

How much does Intune cost, really?

If you have Business Premium, Intune itself costs nothing extra. The real costs are setup time, any hardware refresh and ongoing management. Here's how to think about it:

• Licensing: Included in Business Premium. If you're on Business Standard, the upgrade to Premium is usually the most economical way to get Intune plus the other security tools. See our plan comparison for current list prices.
• Setup: A one-time project to design policies, test apps and enroll devices. Whether you do it yourself or hire help, budget real time for testing, not just clicking.
• Hardware: Autopilot device preparation needs Windows 11, and Windows 11 needs a TPM 2.0 chip. Very old PCs may need replacing anyway.
• Ongoing management: Someone needs to review reports, approve updates for exception devices, package new app versions and handle lost devices. That's typically part of a managed IT agreement. Our managed IT cost guide explains how providers usually price it.

Compare that to the cost of a single lost, unencrypted laptop full of patient or client records, and Intune is one of the cheapest insurance policies an office can buy.

What mistakes should you avoid with Intune?

Most Intune problems come from rushing, skipping the pilot, or turning on blocking policies before checking what they'll block. Here are the ones we see most often:

• Leaving "devices with no compliance policy" set to Compliant while relying on Conditional Access. It quietly undermines the whole setup.
• Turning on "require compliant device" for everyone on day one. Use report-only mode first. Always exclude a break-glass emergency admin account from Conditional Access.
• Not backing up BitLocker recovery keys to Entra ID. An encrypted laptop with no recovery key is just a very secure paperweight.
• Forgetting the Apple push certificate renewal. If it expires, you may have to re-enroll every Apple device. Put it on the calendar with two reminders.
• Using personal Apple IDs or a departed employee's email for Apple Business Manager or the push certificate. Use a shared, company-owned account.
• Too many policies with overlapping settings. Conflicts are hard to troubleshoot. Keep a short, documented set.
• Skipping app testing. Practice management, imaging and accounting software often have quirks. Test them in the pilot.
• Treating Intune as "set and forget." Reports only help if someone looks at them.
• Giving everyone local admin rights "to make installs easier." Use the Company Portal instead.
• Not telling staff what's changing. A two-paragraph email and a five-minute huddle prevent most support calls.

Intune quick-start checklist

Use this as a working checklist for a small office rollout:

1. Confirm every user has Business Premium (or Intune Plan 1 plus Entra ID P1).
2. Set up MFA for everyone, plus two break-glass admin accounts excluded from Conditional Access.
3. Configure automatic Windows enrollment for Entra-joined devices.
4. Create an Autopilot profile (or Autopilot device preparation policy for Windows 11).
5. Ask your PC vendor to register new devices to your tenant.
6. Create a Windows compliance policy (BitLocker, Secure Boot, firewall, Defender, minimum OS, device risk).
7. Set "devices with no compliance policy" to Not compliant (after the pilot).
8. Create a BitLocker policy with recovery keys backed up to Entra ID.
9. Onboard devices to Defender for Business.
10. Create update rings (or enroll in Windows Autopatch).
11. Package and assign required apps; publish optional apps to Company Portal.
12. Configure Windows LAPS and remove local admin rights.
13. Create app protection policies for iOS and Android.
14. Connect Apple Business Manager and create an Apple push certificate if you use Apple devices.
15. Build Conditional Access in report-only mode, then turn it on.
16. Document everything, and schedule weekly and monthly reviews.

The bottom line

Intune turns device management from a pile of individual favors into a system: every laptop set up the same way, encrypted, updated and protected, with reports to prove it. For a small office, that means faster onboarding, fewer "why is my computer doing this" calls, and a lost laptop that's an inconvenience instead of a crisis. And since it's included in Microsoft 365 Business Premium, many offices are already paying for it without using it.

If you want help planning or running an Intune rollout, our device management and deployment service handles Autopilot, Intune policies and Apple device enrollment, all part of our broader managed IT services. Book a free 20-minute call and we'll look at what you have and what it would take.