Microsoft Intune is a cloud-based endpoint management service that lets organizations enroll, configure, secure, and monitor computers, mobile devices, and applications from a single admin console.
Intune manages an organization’s devices and apps entirely from the cloud, with no on-premises servers required. It supports Windows, macOS, iOS/iPadOS, Android, Linux, tvOS, and visionOS devices, and it works alongside Microsoft Entra ID to check each device’s compliance status before granting access to company resources.
Key Takeaways
- Microsoft Intune is a cloud-based unified endpoint management (UEM) service; it requires no on-premises infrastructure.
- It supports two management modes: mobile device management (MDM) for full device control, and mobile application management (MAM) for app-only control on personal devices.
- Intune relies on Microsoft Entra ID (formerly Azure Active Directory) for authentication, group-based policy targeting, and Conditional Access.
- Administrators manage Intune through the Microsoft Intune admin center at intune.microsoft.com, a dedicated console separate from the general Azure portal.
- Intune is licensed as Plan 1 (base), Plan 2 (adds Microsoft Tunnel for MAM, specialty device management, and firmware-over-the-air updates), or the Microsoft Intune Suite (bundles Plan 2 with Remote Help, Endpoint Privilege Management, Advanced Analytics, Enterprise App Management, and Microsoft Cloud PKI); it is included in most Microsoft 365 E3 and E5 bundles.
Why Organizations Need Endpoint Management Like Intune
Hybrid work put company data on a mix of corporate laptops, personal phones, and bring-your-own-device (BYOD) tablets spread across networks IT doesn’t control. Traditional tools such as Group Policy assume a device stays connected to the corporate network, an assumption that breaks down once employees work from home or use their own hardware.
Without a way to verify a device’s security posture before it touches company data, organizations are left with a narrow choice: block remote and BYOD access outright, or accept the risk of managing endpoints they can’t fully see. Microsoft Intune addresses this by managing devices and apps directly over the internet, so a device only needs a Microsoft Entra ID identity and an internet connection, not a VPN or an on-premises domain join, to be enrolled, configured, and kept compliant.
How Does Microsoft Intune Work?
Intune runs entirely as a cloud service and is administered from the Microsoft Intune admin center, a web console at intune.microsoft.com. Every action taken in the admin center calls the Microsoft Graph API, which also lets administrators automate the same tasks through scripts rather than clicking through the console manually.
Intune supports two management modes, and an organization can use either one on its own or run both side by side:
| Dimension | Mobile Device Management (MDM) | Mobile Application Management (MAM) |
| What it manages | The entire device: settings, security policies, and installed apps | Only the work apps and the data inside them |
| Typical use case | Corporate-owned devices | Personal devices in BYOD scenarios |
| Enrollment path | Company Portal app, Windows Autopilot, Apple Automated Device Enrollment, or Android Enterprise | No full device enrollment required |
| If the device is lost or stolen | The entire device can be wiped remotely | Only company data inside managed apps (e.g., Outlook, Teams) can be selectively wiped |
Intune does not store user identities or perform authentication itself. It depends on Microsoft Entra ID for three things: authenticating users at sign-in (with single sign-on, multi-factor authentication, or passwordless methods), organizing users and devices into groups that Intune uses to target policies, and Conditional Access, where Intune reports each device’s compliance state to Entra ID so it can be combined with user, location, and risk signals before granting access to a resource.
Key Benefits of Microsoft Intune
- Application Lifecycle Management: Intune deploys, updates, and retires applications across enrolled devices, and can enforce OS and app updates automatically.
- Centralized Management: Administrators configure devices, apps, and security policies for the entire organization from one console instead of juggling separate tools per platform.
- Cross-Platform Device Support: Intune manages Windows, macOS, iOS/iPadOS, Android, Linux, tvOS, and visionOS devices, so employees can use company-issued or personal hardware without IT needing separate management tools per platform.
- Security and Compliance Baselines: Administrators deploy prebuilt or custom security baselines and configuration profiles, and Intune continuously audits whether each device still meets them.
- Automated Compliance Enforcement: Compliance checks feed directly into Conditional Access, so a device that falls out of compliance loses access to protected resources without manual intervention.
- Scales Without New Infrastructure: As a cloud service, Intune adds managed devices and users without additional on-premises hardware or servers.
Microsoft Intune Licensing
Most organizations get Intune as part of a Microsoft 365 bundle, such as E3 or E5, rather than purchasing it as a standalone product. Intune capabilities are grouped into three tiers:
- Microsoft Intune Plan 1: The base service, covering cloud-based device and app management.
- Microsoft Intune Plan 2: Additive to Plan 1, adding Microsoft Tunnel for Mobile Application Management, specialty device management (AR/VR headsets, smart screens, conference room systems), and firmware-over-the-air (FOTA) updates.
- Microsoft Intune Suite: Additive to Plan 1, bundling Plan 2’s capabilities with Remote Help, Endpoint Privilege Management, Advanced Analytics, Enterprise App Management, and Microsoft Cloud PKI.
End users whose devices are managed by Intune need an assigned Intune license. Administrators, however, don’t necessarily need one: unlicensed admin access to the Microsoft Intune admin center has been enabled by default for tenants created after July 2021. Features that separately require Microsoft Entra ID P1 or P2, such as Conditional Access, still need those licenses regardless of Intune plan.
How Encryption Consulting Helps
Intune’s device and app policies are only as strong as the certificates and identities behind them. Encryption Consulting’s PKI Services help organizations design and operate the certificate infrastructure Intune relies on for device authentication, Wi-Fi and VPN profiles, and S/MIME email, including CP/CPS development and day-to-day certificate authority operations. For organizations extending Intune-managed devices into passwordless sign-in, EC’s Windows Hello for Business implementation service handles the certificate trust, cloud Kerberos trust, or hybrid deployment model that Intune pushes down as a configuration profile.
Encryption Consulting also offers Microsoft PKI with Intune integration, connecting an organization’s certificate authority directly to Intune-managed device policies so certificates for Wi-Fi, VPN, and email are issued and renewed automatically as devices enroll. For organizations that want managed, cloud-hosted PKI without operating their own certificate authority infrastructure, PKI-as-a-Service closes the gap between endpoint management and the certificate lifecycle it depends on.
Frequently Asked Questions
What Is the Difference Between Microsoft Intune and Microsoft Entra ID?
Microsoft Intune and Microsoft Entra ID are separate but connected services. Entra ID (formerly Azure Active Directory) is Microsoft’s identity platform: it authenticates users and stores the groups Intune uses to target policies. Intune is the endpoint management service: it enrolls devices, pushes configuration and compliance policies, and reports each device’s compliance status back to Entra ID for Conditional Access decisions.
What Is the Difference Between MDM and MAM in Intune?
Mobile device management (MDM) gives Intune full control over an enrolled device, including its settings, security policies, and installed apps, and lets administrators wipe the entire device if it’s lost. Mobile application management (MAM) manages only the work apps and data inside them, which suits personal devices in BYOD scenarios where a full device wipe isn’t appropriate.
Do I Need a License to Use Microsoft Intune?
End users whose devices are managed by Intune need an assigned Intune license, most commonly included in a Microsoft 365 E3 or E5 bundle. Administrators can sign in to and manage the Microsoft Intune admin center without a personal Intune license; this unlicensed admin access has been enabled by default for tenants created after July 2021.
What Operating Systems Does Microsoft Intune Support?
Microsoft Intune manages Windows, macOS, iOS/iPadOS, Android, Linux, tvOS, and visionOS devices from a single admin console, giving organizations one management plane across company-owned and BYOD hardware regardless of platform.
How Does Microsoft Intune Work With Conditional Access?
Intune continuously checks enrolled devices against configured compliance policies and reports each device’s compliance state to Microsoft Entra ID. Conditional Access then combines that compliance signal with user identity, application, location, and risk data to decide, in real time, whether to allow or block access to a given corporate resource.
Ready to Connect Your PKI to Your Intune Deployment?
See Encryption Consulting’s PKI Services in action, or talk to an advisor about Microsoft PKI with Intune integration.