How to Set Up Microsoft Intune for Small Business

Intune is Microsoft's tool for managing devices — laptops, phones, and tablets — that access your business data. If you're on Microsoft 365 Business Premium, you've already got it. Most businesses just haven't turned it on.

This guide covers the basics: getting devices enrolled, setting up security policies, and pushing apps. Enough to get you from zero to 'our devices are actually managed'.

What Intune does

It lets you enforce security settings on every device that connects to your M365 environment. Require a PIN on phones. Enforce BitLocker encryption on laptops. Push antivirus settings. Wipe a lost device remotely.

Without it, you have no visibility or control over the devices accessing your company data. Someone's personal phone with no passcode has the same access as a secured company laptop.

Getting started

Go to intune.microsoft.com and sign in with your admin account.

The first thing you'll see is the dashboard. Don't panic — there's a lot here. Focus on three things: enrolment, compliance policies, and app deployment.

Enrolling devices

For Windows devices, the easiest path is to go to Settings → Accounts → Access work or school → Connect, and sign in with their M365 account. This registers the device with Intune.

For phones, install the Company Portal app from the app store and sign in.

For new Windows devices, you can use Windows Autopilot to have them automatically set up and enrol when someone first turns them on. This is more advanced but worth setting up if you regularly onboard new staff or devices.

Compliance policies

A compliance policy defines the minimum security requirements for a device. If a device doesn't meet the requirements, you can block its access to company data.

Go to Devices → Compliance policies → Create policy.

For Windows, start with: require BitLocker encryption, require a firewall, require antivirus, minimum OS version.

For mobile, start with: require a passcode, minimum passcode length of 6, block jailbroken/rooted devices.

Pair these with a Conditional Access policy that blocks non-compliant devices from accessing M365 apps.

Pushing apps

Go to Apps → All apps → Add. You can deploy Microsoft 365 apps, the Company Portal, and line-of-business apps.

For the Microsoft 365 suite, select Microsoft 365 Apps for Windows 10 and later. Choose which apps to include (Word, Excel, Teams, etc.) and assign it to your device groups.

Apps can be Required (auto-installed), Available (users install from Company Portal), or Uninstall.

Start small

Don't try to do everything at once. Start with enrolment and one compliance policy. Get all devices registered and compliant. Then layer on app deployment and more advanced policies.

Create a test group with a few devices first. Make sure everything works before rolling out to the whole business.

Intune setup is one of those things that's straightforward if you've done it before and a nightmare if you haven't. We set up and manage Intune for businesses as part of our security and device management service.