Microsoft Intune Initial Setup for Windows Device Management
Microsoft Intune Initial Setup for Windows Device Management is a fixed-fee implementation that establishes Microsoft Intune as the management foundation for your corporate-owned Windows devices in one Microsoft tenant. IT Partner designs the target state, configures enrollment and the full Windows security baseline — compliance, configuration, BitLocker, Microsoft Defender Antivirus and firewall, local administrator control, and Windows updates — and proves it on a pilot of up to 10 devices before an administrator handoff. It is the foundation the whole Intune family builds on: Android, iPhone & iPad, and Microsoft Defender for Endpoint each extend this tenant as separate add-on services, and Windows Autopilot zero-touch deployment is available as the separate [Windows Autopilot - Initial Setup](/services/microsoft-intune-windows-autopilot-setup) service.
What this engagement is
Unmanaged Windows PCs mean inconsistent security, unknown update states, and hours of manual setup per machine. This service establishes Microsoft Intune as the management foundation for your corporate-owned Windows devices: every enrolled PC gets the same approved security baseline, reports its compliance honestly, and can be managed from one console. The engagement covers one Microsoft tenant. IT Partner assesses your environment, designs the target state, configures Windows automatic enrollment with sensible restrictions, builds the security baseline as separate auditable policies, and validates everything on up to 10 pilot devices before handing your team a documented, repeatable operation. This is the first step in our Intune service family — the foundation the add-ons plug into. Microsoft Intune Initial Setup for Android Device Management and Microsoft Intune Initial Setup for iPhone & iPad Management extend the same tenant to mobile platforms, and Microsoft Defender for Endpoint Deployment for Intune-Managed Devices layers endpoint detection and response on top of the managed fleet. Windows Autopilot zero-touch deployment — new PCs shipping straight from the vendor to the employee — is the separate Windows Autopilot - Initial Setup service on this foundation. Who this is for: US commercial organizations of roughly 100–500 seats that are on, or moving to, the Microsoft public cloud. Who it is not for: estates that must keep on-premises domain join (Microsoft Entra hybrid join), or teams looking for a full-fleet hands-on rollout in one engagement — both are separately scoped. The 8-week schedule is elapsed calendar time, not eight weeks of continuous engineering — the pace is set by pilot soak periods and client dependencies such as licensing, decisions, and change approvals.
Success criteria
What you receive
How the work unfolds
Confirm business outcomes, the corporate-owned Windows use case, project governance, success measures, client stakeholders, pilot users and devices, and the eight-week schedule.
Review licensing, identities, device and application inventory, current management state, Group Policy intent, and network access, then document the approved cloud-native target state.
Prepare the Intune tenant, configure Windows automatic enrollment and enrollment restrictions, block personally owned Windows enrollment unless approved otherwise, establish required groups and least-privilege access, and limit initial assignments to the pilot.
Build the approved baseline as separate policies — compliance, device configuration, BitLocker, Defender Antivirus and firewall, local administrator control, Windows updates — and assign them for pilot validation.
Enroll up to 10 agreed pilot devices through the documented procedure and validate policy and application delivery, compliance reporting, and administrative visibility.
Run the approved pilot with cooperative non-VIP users, capture feedback and deployment evidence, and correct in-scope configuration issues before the production readiness review.
Finalize the as-built documentation and rollout recommendations, conduct the administrator handoff, review acceptance criteria and open dependencies, and map the next steps across the Intune family — mobile add-ons, Defender for Endpoint, and Autopilot.
Prerequisites
Who does what
IT Partner
- Lead discovery, readiness assessment, target-state design, implementation planning, and acceptance review for the defined Windows scope.
- Configure the Intune Windows enrollment foundation, approved groups and assignments, and least-privilege administration required for the engagement.
- Build and assign the approved Windows baseline: compliance, device configuration, encryption, antivirus, firewall, local administrator control, and update policies.
- Configure Company Portal, Microsoft 365 Apps where licensed, and up to three additional agreed pilot applications that are already suitable for Intune deployment.
- Assist with enrollment of up to 10 pilot devices and document the repeatable enrollment procedure for future devices.
- Run lab and limited-pilot validation, troubleshoot in-scope configuration issues, document results, and identify dependencies that require separate remediation.
- Provide the as-built configuration, operating and troubleshooting runbook, rollout recommendations, and administrator handoff session.
- Map the follow-on path across the Intune family — Android, iPhone & iPad, Defender for Endpoint, and Autopilot — so each add-on lands on a verified foundation.
Your team
- Provide and maintain the required Microsoft licenses, supported Windows devices, software licenses, and third-party subscriptions.
- Provide approved administrative access, tenant information, device inventory, application requirements, policy requirements, and existing-environment documentation — including Conditional Access and Terms of Use policies that can affect enrollment.
- Make the standard deployment decisions: naming, grouping, user account type, application set, security settings, enrollment restrictions, and pilot population.
- Provide physical access or hands-on help for pilot devices where enrollment steps require it.
- Configure or approve required firewall, proxy, DNS, Wi-Fi, VPN, certificate, and on-premises changes that remain your responsibility.
- Back up pilot-device data, make pilot users and support staff available, and perform any physical device steps requested for testing.
- Prepare and send end-user communications, provide first-line user support, and coordinate internal change-management approvals and schedules.
- Review deliverables, provide feedback and decisions within the agreed response time, validate business outcomes, and approve project acceptance.
What's not included
Limitations & technical notes
Frequently asked questions
How does this service relate to the rest of the Intune family?
This is the foundation: it establishes Intune Windows management for one tenant. Three add-ons extend it — Microsoft Intune Initial Setup for Android Device Management for Android Enterprise, Microsoft Intune Initial Setup for iPhone & iPad Management for Apple mobile devices, and Microsoft Defender for Endpoint Deployment for Intune-Managed Devices for endpoint detection and response on the managed fleet. Windows Autopilot zero-touch deployment is the separate Windows Autopilot - Initial Setup service. Each add-on assumes this foundation is in place, so this service comes first.
Who is this service for — and who is it not for?
It fits US commercial organizations of roughly 100–500 seats that are on, or moving to, the Microsoft public cloud and run corporate-owned Windows PCs. It is not the right first step if you must keep on-premises domain join (hybrid join), or if you want a hands-on rollout of the entire existing fleet in one engagement — each of those is separately scoped work that can follow this foundation.
What is included in this Microsoft Intune setup?
The service configures the Windows Intune foundation for one tenant: automatic enrollment with restrictions, pilot groups, the approved Windows compliance and security baseline, Company Portal, Microsoft 365 Apps where licensed, up to three additional Intune-ready applications, validation on up to 10 pilot devices, documentation, and an administrator handoff.
Does this include Windows Autopilot zero-touch deployment?
No — deliberately. Autopilot (new PCs shipping from the vendor straight to the employee and configuring themselves on first sign-in) is its own engagement, Windows Autopilot - Initial Setup, with its own registration logistics and design decisions — and it builds on exactly the foundation this service creates. If zero-touch provisioning is your goal, we scope the two together so Autopilot lands the week this foundation is verified.
How much does the service cost?
The fee is fixed for the defined one-tenant implementation — see the price on this page. It covers up to 10 pilot devices and up to three additional Intune-ready pilot applications beyond Company Portal and Microsoft 365 Apps. Microsoft licensing, hardware, third-party products, full-fleet deployment, and custom application packaging are not included. No out-of-scope work is performed without your written approval.
How long does implementation take — and is it really eight weeks of work?
The schedule is eight calendar weeks, and that is elapsed time rather than continuous engineering. The pace is set by pilot soak periods and client-side dependencies: licensing, administrative access, decisions, change approvals, and user testing. When those arrive on time, the schedule holds.
What Microsoft licenses are required?
Each pilot user needs assigned licensing that provides Microsoft Intune and Microsoft Entra ID P1 or P2 capabilities — Microsoft 365 Business Premium and Microsoft 365 E3/E5 both qualify. IT Partner verifies capability during the readiness review; you purchase and assign all subscriptions.
Are all of our business applications included?
No. The service deploys Company Portal, Microsoft 365 Apps where licensed, and up to three additional Intune-ready applications listed in the project scope. Custom Win32 packaging, dependency engineering, scripting, and vendor troubleshooting are separately scoped.
Do you support hybrid domain join or Configuration Manager co-management?
Not in the standard scope. The included design is cloud-native Microsoft Entra join, because hybrid join and co-management add on-premises connectors, domain-controller, VPN, and workload dependencies that deserve their own assessment. Both can be evaluated and quoted separately.
How many devices are included, and do you deploy our full fleet?
The service validates the baseline on up to 10 pilot devices and prepares it for a phased rollout that your team controls. Hands-on enrollment of the full fleet is not included — if you want IT Partner to run the production rollout, that is quoted as a follow-on engagement sized to your device count.
What happens after the eight weeks?
You receive the validated configuration, pilot results, as-built documentation, enrollment procedure, troubleshooting runbook, rollout recommendations, and an administrator handoff. Natural next steps, each separately scoped: the production fleet rollout, Windows Autopilot - Initial Setup for zero-touch provisioning, the Android and iPhone & iPad add-ons, and Defender for Endpoint deployment across the managed fleet.