Introduction to Endpoint Management in Microsoft 365

Endpoint management is the practice of centrally controlling, securing, and configuring every device that accesses an organisation's data and applications. An endpoint is any device that connects to a network – a laptop, a desktop, a smartphone, a tablet, or even a virtual machine in the cloud. Microsoft Intune is the cloud-based service that performs this management for Microsoft 365 environments.

Before cloud-based endpoint management, IT administrators managed devices using an on-premises approach called Group Policy. On-premises means software and servers that live in a physical office building that the company owns. Group Policy (often called 'GPO') is a feature of Windows Server that lets administrators configure security settings, install software, and enforce rules across domain-joined devices in a local network. Domain-joined means a device is permanently registered to a company's local network domain (like 'contoso.local'). The problem with GPO is that it only works when the device is connected to the corporate network or connected via a virtual private network (VPN). A VPN is a secure, encrypted tunnel over the public internet that makes a remote device behave as if it were physically in the office. GPO also struggles with modern devices like iPhones, Android phones, and personal laptops that employees bring from home (BYOD – Bring Your Own Device).

Microsoft Intune solves these problems because it is a cloud-based service. Cloud-based means the software and data live in Microsoft's data centres, accessible from anywhere with an internet connection. Intune does not require a company to own or maintain its own servers to manage devices. Intune communicates with devices through the internet, using a secure, encrypted connection. This means an administrator in London can enforce a security policy on a device being used in Sydney, as long as that device has an internet connection.

The core purpose of Intune is to enforce compliance. Compliance means a device meets the security and configuration requirements set by the organisation. For example, a company might require that every device has a screen lock password and that the operating system is up to date. Intune can automatically check for these things. If a device is not compliant, Intune can block it from accessing company email or data. It can even wipe the device – remove all corporate data – if the device is lost or stolen. This is called a remote wipe.

Intune also handles enrolling devices. Enrolment is the process of registering a device with Intune so it can be managed. When an employee receives a new company laptop, they sign in with their work account (part of Microsoft Entra ID, the identity service). The device automatically enrols in Intune, which then pushes down the required configuration: connect to Wi-Fi, install specific apps, set up company email, enforce security settings like encryption, and install antivirus.

Another key concept is Mobile Device Management (MDM). MDM is the part of Intune that manages the entire device – ownership, settings, and apps – often used for company-owned devices. Mobile Application Management (MAM) is the part that manages only specific apps and their data, leaving the rest of the device personal.

Intune also integrates with Windows Autopilot. Autopilot is a feature that allows an IT department to pre-configure new Windows devices before they ship. The device arrives at the employee, they unbox it, connect to Wi-Fi, sign in, and the device automatically sets itself up exactly as the company requires – no custom imaging or manual configuration needed. This replaces the older method of 'imaging', where a technician would manually install the operating system and software on each new device.

Finally, Intune provides a single dashboard – the Microsoft Intune admin centre – where administrators can see the status of every managed device, run reports, and take actions like remotely restarting a device or wiping it. This contrasts with the older 'siloed' approach where different operating systems had different management tools, and none of them talked to each other.

Imagine a mid-size company called 'GreenTech Solutions' with 500 employees. Half work in a London office using company-owned Windows laptops. The other half work remotely from home using a mix of personally owned Windows laptops and company-issued iPhones. The IT team consists of two people: Sarah and James. Before Intune, they had a nightmare: each new laptop required manually installing the operating system, 15 standard business applications, connecting to the VPN, and configuring email. A remote employee who lost their phone meant a frantic call to the mobile carrier to deactivate the SIM.

Sarah and James decide to implement Microsoft Intune. Here is what the real world looks like after deployment:

First, they set up Microsoft Entra ID as the identity provider. Every employee gets a work account (e.g., sasha@greentechsolutions.com). They install the Company Portal app on all company-owned and BYOD devices. Company Portal is the app employees use to access company apps, install approved software, and see their device's compliance status.

Next, they create compliance policies. A compliance policy is a set of rules a device must meet. For example:

They assign these policies to all devices. Now, if an employee sets a weak PIN, the device becomes non-compliant and loses access to company email and OneDrive for Business. Intune also sends a notification to the employee's phone asking them to fix the issue.

Then they use Intune to deploy applications. For Windows devices, they use Intune's built-in capability to deploy Microsoft 365 Apps (Word, Excel, Outlook) automatically. For iPhones, they push the Outlook and Teams apps from the Apple App Store to the Company Portal. Employees install them with one click.

When a new remote employee, David, joins, Sarah orders a Windows laptop pre-configured with Windows 10 Enterprise. She creates a Windows Autopilot deployment profile that sets the device to automatically enrol in Intune when David signs in. David unboxes the laptop, connects to his home Wi-Fi, and signs in with his work account. The laptop automatically:

David is productive in 20 minutes. Sarah never touched the laptop.

Later, an employee loses their iPhone. Sarah logs into the Intune admin centre, selects the device, and chooses 'Retire'. This removes all corporate data from the phone, including email, OneDrive files, and installed company apps. The employee's personal photos and apps remain. If the device were company-owned, Sarah would choose 'Wipe', which resets the phone to factory settings.

Weekly, Sarah runs a compliance report to see which devices are out of compliance. She notices several Android devices are missing security patch updates. She sends a push notification through the Company Portal reminding employees to update. She also creates a dynamic Microsoft Entra ID group that automatically adds all non-compliant devices, which allows her to automatically block those devices from accessing SharePoint Online through a Conditional Access policy. Conditional Access is a feature of Microsoft Entra ID that enforces access controls based on conditions like device compliance, location, and user risk.

The result: GreenTech maintains a secure, compliant device environment without requiring employees to bring devices to the office for setup, and without needing an expensive on-premises server infrastructure.