From Zero to Hero: Microsoft Intune Setup Guide for 2026

Microsoft Intune is no longer just a device enrollment tool. It is the platform for endpoint security, app management, compliance, Zero Trust access, Windows Autopilot, mobile device management, and least-privilege administration across hybrid workforces. This guide covers what it costs, the seven setup steps in order, the troubleshooting checklist, and the device actions to decide before anyone leaves.

What Microsoft Intune does in 2026

Microsoft Intune is Microsoft's cloud-based endpoint management platform for managing and securing Windows, macOS, iOS/iPadOS, Android, and supported specialty devices. It works with Microsoft Entra ID for identity, groups, device registration, Conditional Access, and access control.

With Intune, organizations can enroll devices, configure security settings, deploy apps, enforce compliance, protect corporate data on BYOD devices, remotely wipe lost devices, and integrate device risk signals from Microsoft Defender for Endpoint. For most 20- to 500-user organizations, Intune is the practical foundation for Zero Trust endpoint management.

Licensing: what you already own and what the add-ons cost

Before configuring Intune, confirm that your licensing carries the capabilities you need. Intune Plan 1 is the device and app management layer, and most organizations already own it inside a suite. Prices are Microsoft list prices from the October 2026 price list, per user per month on an annual commitment; the subscription is on your own Microsoft invoice and we sell it at the same price.

Plan	Carries	Per user per month
Microsoft 365 Business Premium (up to 300 users)	Intune Plan 1, Entra ID P1, Defender for Business, Defender for Office 365 Plan 1, Microsoft 365 Apps	$22.00
Microsoft 365 E3	Intune Plan 1 and Entra ID P1; since the 1 July 2026 packaging change also Intune Plan 2, Remote Help, and Advanced Analytics	$39.00
Microsoft 365 E5	Everything in E3 plus every Intune Suite component, Entra ID P2, and the Defender and Purview suites	$60.00
Enterprise Mobility + Security E3 or E5	Intune Plan 1 with Entra ID P1 (E3) or P2 (E5), no Office apps	$12.00 or $18.00
Microsoft Intune Plan 1	Core device and app management on its own	$8.00
Microsoft Intune Plan 2 add-on	Microsoft Tunnel for mobile application management, specialty and shared device management, firmware updates	$4.00
Microsoft Intune Suite add-on	Plan 2 plus Remote Help, Endpoint Privilege Management, Advanced Analytics, Enterprise Application Management, and Cloud PKI	$10.00
Single add-ons	Remote Help $3.50; Endpoint Privilege Management $3.00; Advanced Analytics $5.00; Enterprise Application Management $2.00	As listed

Under the New Commerce Experience, subscription terms, billing options, seat changes, cancellation windows, and add-on eligibility matter. Review licensing before rollout so users receive the right services and you avoid gaps in enrollment, Conditional Access, or endpoint security. Our Intune licensing guide has the counting method that avoids paying twice for a component a suite already carries.

Step 1: Prepare your tenant, identity, and groups

Start in the Microsoft Intune admin center at intune.microsoft.com. Do not build policies first; prepare the foundation.

A practical readiness checklist includes:

• Confirm Intune licensing for all users who will enroll or use managed apps.
• Verify the Intune MDM authority for the tenant.
• Confirm Microsoft Entra ID user and device strategy.
• Create Entra ID security groups for pilot users, production users, device types, departments, and exclusion groups.
• Configure role-based access control so administrators have only the permissions they need.
• Decide whether Windows devices will be Microsoft Entra joined, hybrid Microsoft Entra joined, or managed through a staged migration.
• Review existing Group Policy settings if you are moving Windows management from on-premises tools to Intune; our Group Policy to Intune guide lists what translates and what does not.

This planning prevents common deployment problems such as policies applying to the wrong users, Conditional Access blocking enrollment, or conflicting configuration sources.

Step 2: Configure enrollment for each platform

Enrollment should match device ownership and operating system. A single enrollment method is rarely enough.

For Windows, use automatic MDM enrollment with Microsoft Entra ID for supported users. For new or reset corporate Windows devices, use Windows Autopilot or Windows Autopilot device preparation with the Enrollment Status Page, so the device is configured before the user reaches the desktop. Decide early whether devices should be Microsoft Entra joined or hybrid joined; hybrid join can be useful in transitional environments, but it adds dependencies and should be planned carefully.

For Apple devices, configure the Apple MDM push certificate and put its renewal on a calendar that outlives the person who created it: the certificate is valid for 365 days and must be renewed with the same Apple account. For corporate-owned iPhones, iPads, and Macs, use Apple Business Manager with Automated Device Enrollment where possible. For app licensing, integrate Apple volume purchasing so managed apps can be assigned cleanly. Macs have their own considerations, covered in managing company Macs with Intune.

For Android, connect Intune to Android Enterprise and choose the correct scenario: personally owned work profile, corporate-owned fully managed, corporate-owned work profile, or dedicated device. Use Managed Google Play for app deployment.

For BYOD scenarios, do not assume every device must be fully enrolled. App protection policies can protect corporate data in Microsoft 365 apps on unmanaged personal devices, which is often the better privacy and security balance; the settings are in our BYOD phones guide.

Step 3: Build compliance and Conditional Access together

Compliance policies define whether a device is healthy enough to access company resources. Conditional Access policies in Microsoft Entra ID can then require compliant devices, approved apps, multifactor authentication, or acceptable risk levels before access is granted.

Common compliance checks include operating system version, encryption status, jailbreak or root detection, password or PIN requirements, Microsoft Defender for Endpoint risk level, and device health. Use grace periods carefully so users have time to remediate without weakening security.

Pilot Conditional Access in report-only mode first, validate the impact, exclude emergency access accounts, and then enforce gradually. Intune configuration without Conditional Access is incomplete; Conditional Access without good Intune compliance design disrupts users. Start from the Conditional Access policies every business should have.

Step 4: Apply security settings with modern Intune tools

For security configuration, use the current Intune policy areas rather than relying on broad, legacy-style templates.

Key options include:

• Settings Catalog for granular Windows, macOS, iOS/iPadOS, and Android settings.
• Endpoint security policies for antivirus, firewall, attack surface reduction, endpoint detection and response, disk encryption, account protection, and security baselines.
• Security baselines as a Microsoft-recommended starting point, followed by testing and tuning for your business apps.
• BitLocker for Windows encryption and FileVault for macOS encryption.
• Microsoft Defender for Endpoint integration for threat and device risk signals.
• Local administrator control, Windows LAPS, and least-privilege administration.
• Endpoint Privilege Management through the Intune Suite or the single add-on when users need temporary elevation without permanent local admin rights.

Avoid assigning many overlapping policies to the same settings. Intune can report conflicts, but good policy architecture is better than cleanup after production issues.

Step 5: Deploy and protect applications

Application management is one of Intune's most useful capabilities when it is planned correctly.

For Windows, deploy Microsoft 365 Apps, Win32 applications, Microsoft Store apps, line-of-business apps, and scripts or remediation packages where appropriate. Use detection rules, dependencies, supersedence, restart behavior, and staged assignments to reduce failures.

For Apple platforms, use Apple volume-purchased apps when possible and apply app configuration policies for managed app settings. For Android, use Managed Google Play. For mobile productivity apps, configure app protection policies to prevent data leakage through copy/paste, save-as, unmanaged cloud storage, or unapproved apps.

Use required assignments for mandatory apps, available assignments through Company Portal for self-service apps, and uninstall assignments when software must be removed. Always pilot app deployment with a representative group before broad rollout.

Step 6: Automate Windows provisioning and updates

For Windows endpoints, Intune should support the full device lifecycle: procurement, deployment, configuration, update management, support, retirement, and replacement.

Windows Autopilot and Windows Autopilot device preparation reduce hands-on setup by applying profiles during the out-of-box experience. Pair Autopilot with Entra ID groups, deployment rings, required apps, security baselines, and compliance policies.

For updates, configure Windows update rings, feature update policies, driver and firmware management where appropriate, and quality update controls. Eligible organizations can also evaluate Windows Autopatch to automate parts of Windows, Microsoft 365 Apps, Microsoft Edge, and Teams update management through Microsoft's managed update service.

The goal is predictable rollout rings: pilot, early adopters, broad production, and exception groups.

Step 7: Monitor, report, and improve continuously

Intune setup is not a one-time task. After enrollment, monitor device health and user impact from the Intune admin center.

Useful operational areas include:

• Device compliance reports.
• Configuration profile status.
• App installation status and failure details.
• Enrollment failures and enrollment restrictions.
• Policy conflict reporting.
• Endpoint security reports.
• Microsoft Defender for Endpoint device risk integration.
• Audit logs and admin activity.
• Endpoint analytics, and Advanced Analytics where licensed.
• Remote actions such as sync, restart, retire, wipe, BitLocker key rotation, and lost mode where supported.

Create a regular review cycle for policy changes, security baseline updates, app versions, stale devices, administrator roles, and Conditional Access impact.

Retire, selective wipe, or wipe: decide the device action before you need it

Intune offers several ways to remove company data, and the wrong one on a personal phone is a support incident. Retire removes the management profile, the company apps Intune installed, and the company data they held, and leaves personal data alone; it is the action for a BYOD device when someone leaves. A selective wipe of app protection policy data removes company data from the managed apps on a device that was never enrolled. Wipe resets a corporate-owned device to factory state and removes everything on it. Write down which action applies to lost devices, departures, BYOD, and corporate hardware, and who may approve each, before the first request arrives.

Common Intune setup issues and how to troubleshoot them

Many Intune problems come from enrollment configuration, licensing, identity, or policy assignment rather than the device itself.

Use this checklist:

• Device will not enroll: verify the user has an Intune license, enrollment is allowed for the platform, MDM user scope is configured, device limits are not exceeded, and Conditional Access is not blocking enrollment.
• Windows Autopilot does not apply: confirm the hardware hash is imported, the device has an assigned profile, group membership has processed, network access is available, and the deployment profile matches the intended join type.
• Apple enrollment fails: check the Apple MDM push certificate, Apple Business Manager token, Automated Device Enrollment profile, and device assignment.
• Android enrollment fails: verify Android Enterprise binding, enrollment profile type, Google services availability, and user licensing.
• Apps fail to install: check detection rules, prerequisites, architecture, return codes, dependencies, assignment intent, installation context, and whether the device has synced recently.
• Policies conflict: use Intune policy reporting to identify the setting source, then consolidate settings into a cleaner policy structure.
• Device shows noncompliant: review the exact compliance setting, grace period, Defender risk level, encryption state, OS version, and last check-in time.
• Company Portal problems: confirm app version, user sign-in, device registration state, network access, and service health.

When troubleshooting, start with licensing and identity, then enrollment, then assignment, then device logs. That order usually saves time.

Rollout rules for a successful Intune deployment

A strong Intune deployment is designed, tested, documented, and improved over time.

• Start with a pilot group that includes real users from different departments and device types.
• Use Entra ID groups and naming standards that make assignments easy to understand.
• Separate pilot, production, and exception policies.
• Use security baselines as a starting point, not as a blind one-click deployment.
• Combine compliance policies with Conditional Access.
• Protect BYOD data with app protection policies when full device management is not appropriate.
• Use Windows Autopilot for new Windows devices where possible.
• Keep local admin rights limited and consider Endpoint Privilege Management for controlled elevation.
• Document enrollment methods, policy intent, app owners, support procedures, and the device action for each departure scenario.
• Review reports regularly and remove stale devices.
• Test major policy, app, and baseline changes before broad deployment.

Good Intune environments are not the most complicated; they are the ones with clear ownership, clean assignments, and measurable security outcomes.

Frequently asked questions

Can Intune work for a small business?

Yes. Microsoft 365 Business Premium includes Intune Plan 1, Entra ID P1 for Conditional Access, and Defender for Business, which is the whole stack a 20- to 300-user company needs for managed Windows PCs, Macs, and phones.

Is Intune only for company-owned devices?

No. Corporate devices enroll fully; personal phones and laptops get app protection policies that protect Outlook, Teams, and OneDrive data without enrolling the device.

Do I need Microsoft Entra ID?

Yes. Intune depends on Entra ID for identities, groups, device registration, and Conditional Access. There is no Intune without it.

Is Windows Autopilot required?

No, but it removes most hands-on setup for new Windows devices: the PC ships to the user, and the profile, apps, and policies apply during first sign-in. Microsoft Intune Initial Setup for Windows Autopilot is $1,300 per project.

Does Intune work with Microsoft Defender for Endpoint?

Yes. The integration feeds device risk into compliance, so Conditional Access can block a device that Defender rates as high risk until it is remediated. Business Premium tenants get this through Defender for Business; E3 tenants add Defender for Endpoint Plan 1 or Plan 2.

What does an Intune setup cost?

Microsoft Intune Initial Setup for Windows Device Management is $6,500 per project; macOS is $3,950, iPhone and iPad $4,500, and Android $1,950; Intune App Protection for BYOD is $5 per user plus a $1,950 tenant fee; and the Managed Microsoft Intune Service is $5 per device per month afterward. Each is quoted in writing before work begins; the Intune licenses stay on your own Microsoft invoice.

Sources

• Microsoft Entra licensing — Microsoft Learn, document dated 18 June 2026, checked 2026-10-11 through the MicrosoftDocs source on GitHub (Entra ID P1 in Business Premium, Microsoft 365 E3 and E5 and EMS E3; P2 in Microsoft 365 E5 and EMS E5)
• What is Conditional Access? — Microsoft Learn, 27 April 2026, checked 2026-10-11
• Add Microsoft Defender Suite for Business Premium to your subscription — Microsoft Learn, 24 September 2025, checked 2026-10-11 (Business Premium includes Intune Plan 1, Entra ID P1, Defender for Business and Defender for Office 365 Plan 1 for up to 300 users)
• Create an Apple MDM push certificate — Microsoft Learn, 12 May 2025, read 27 September 2026 for our Mac guide
• Intune licensing: Plan 1 vs Plan 2 vs the Intune Suite — IT Partner, October 2026, for the 1 July 2026 packaging change and the Intune Suite contents
• Microsoft US commercial price list, October 2026: every list price above

Key takeaways

• Microsoft Intune should be implemented as part of a broader Microsoft Entra ID, Conditional Access, endpoint security, and app protection strategy.
• Intune Plan 1 is included in Business Premium, Microsoft 365 E3 and E5, and EMS; the Intune Suite and single add-ons provide Remote Help, Endpoint Privilege Management, Advanced Analytics, Enterprise Application Management, and Cloud PKI at October 2026 list prices.
• Windows Autopilot, Apple Business Manager, Android Enterprise, and BYOD app protection policies should be planned according to device ownership and user experience.
• Modern Intune security uses compliance policies, Settings Catalog, endpoint security policies, security baselines, Defender for Endpoint integration, encryption, and least-privilege controls.
• Decide the retire, selective wipe, and wipe rules before the first departure; successful deployments rely on pilot groups, staged rollouts, clear Entra ID group design, reporting, and ongoing governance.

If you want a clean Intune deployment from the start, Microsoft Intune Initial Setup for Windows Device Management ($6,500 per project) covers tenant readiness, enrollment, compliance, Conditional Access alignment, security baselines, app deployment, and update rings, with Autopilot setup ($1,300 per project) and the Managed Microsoft Intune Service ($5 per device per month) as add-ons, all quoted in writing before work begins. Book a 30-minute call with your device counts and we will scope it.