Microsoft Intune for Small Business: Plans and Setup

Microsoft Intune is Microsoft’s cloud service for managing the computers, phones, and tablets that reach your company data. From one web console you can require encryption and a screen lock, install apps, keep devices updated, and remove company data from a lost or departing device. Intune Plan 1 is included in Microsoft 365 Business Premium and can be added to other plans for $8.00 per user per month as of September 2026. Business Basic and Business Standard include only a much smaller tool called Basic Mobility and Security.

What Does Microsoft Intune Manage?

Microsoft describes Intune as a cloud-based endpoint management service (“endpoint” means any device a person works on). Supported platforms include Windows, macOS, iOS and iPadOS, Android, and Linux. There is no server to install. You work in the Microsoft Intune admin center at intune.microsoft.com.

Intune works in two modes, which can be combined:

• Mobile device management (MDM). The device is enrolled and Intune manages the whole thing: settings, security, apps, updates, and remote wipe. This suits company-owned equipment.
• Mobile application management (MAM). Intune manages only the work apps and the data inside them, such as Outlook and OneDrive, and leaves the rest of the device alone. This suits personal phones.

Intune does not handle sign-in. It relies on Microsoft Entra ID for user accounts and groups, and it reports each device’s health back to Entra ID so that Conditional Access can allow or block access based on it.

For the vendor-neutral view, including Apple-only and Google options, see our guide to mobile device management for small business.

Which Microsoft 365 Plans Include Intune?

List prices are per user per month with annual billing, as of September 2026, from Microsoft’s small and medium business security pricing page and its 2026 pricing update.

Plan	List price	Device management included
Microsoft 365 Business Basic	$7.00	Basic Mobility and Security only
Microsoft 365 Business Standard	$14.00	Basic Mobility and Security only
Microsoft 365 Business Premium	$22.00	Intune Plan 1, plus Entra ID P1 and Defender for Business
Intune Plan 1 standalone	$8.00	Intune Plan 1, added to any plan
Microsoft 365 E3 and E5	$39.00 and $60.00	Intune Plan 1, plus some advanced Intune features added in July 2026

Microsoft’s security overview for business plans explains the difference: every Microsoft 365 business subscription includes Basic Mobility and Security, “a limited subset of Microsoft Intune”, while Business Premium adds Intune Plan 1 with both MDM and MAM and support for more device types, including Macs.

Microsoft also sells Intune Plan 2 and the Intune Suite, which add things like remote help and privilege management. A small office rarely needs them to begin with. Plan 1 covers everything in this article. Our Business Premium vs Standard comparison covers the wider upgrade decision.

How Do You Set Up Intune? An Enrollment Outline

The order below avoids the most common problem, which is enforcing rules before devices are ready for them.

1. Inventory and decide ownership

List every device that touches company email or files, who uses it, and whether the company or the employee owns it. Company-owned devices get enrolled (MDM). Personal devices usually get app protection only (MAM), which our BYOD policy outline covers.

2. Confirm licenses and groups

Each managed user needs an Intune license. Create Entra ID security groups such as “Windows laptops” or “All staff”, because Intune assigns every policy and app to groups.

3. Turn on Windows automatic enrollment

In the Intune admin center go to Devices, expand Device onboarding, select Enrollment, open the Windows tab, and choose Automatic Enrollment. Set MDM user scope to Some (a pilot group) or All. From then on, a Windows PC that joins Entra ID with a licensed user enrolls in Intune automatically. This feature requires Entra ID P1, which Business Premium includes.

4. Connect Apple

Managing iPhones, iPads, and Macs requires an Apple MDM push certificate, created under the Apple enrollment settings with an Apple account. The certificate is valid for 365 days and must be renewed every 12 months with the same Apple account. Use a company-controlled Apple account, not an employee’s personal one, and put the renewal date on a shared calendar.

For company-owned Apple devices, linking Apple Business (the free Apple portal that replaced Apple Business Manager in 2026) lets new devices enroll themselves out of the box.

5. Connect Android

Android management requires connecting Intune to a managed Google Play account. After that, personal Android phones can use a work profile (a separate, managed area for work apps) and company-owned phones can be fully managed.

6. Create compliance and configuration policies

Covered in the next section. Assign them to a pilot group first.

7. Enroll a pilot, then everyone

Staff enroll phones and existing computers through the Intune Company Portal app. Fix what the pilot turns up, then widen the groups.

8. Only then, require compliance in Conditional Access

Once devices show as compliant, a Conditional Access policy can require a compliant device to open company data. Run it in report-only mode first.

What Is a Compliance Policy?

A device compliance policy is a set of rules a device must meet to be considered healthy. Microsoft’s examples include a minimum operating system version, not being jailbroken or rooted (modified to remove built-in protections), and staying under a set threat level. Typical small office rules also include disk encryption (BitLocker on Windows, FileVault on Mac), a password or PIN, and active antivirus.

A compliance policy checks and reports. It does not change the device. Pushing the actual settings, such as turning BitLocker on, is the job of a configuration profile. You usually want both.

When a device fails, the default action marks it noncompliant. You can add actions such as emailing the user, locking the device remotely after a period, or flagging it for retirement. Combined with Conditional Access, a noncompliant device loses access to company data until it is fixed.

One setting deserves attention. Under Endpoint security > Device compliance > Compliance policy settings, the option “Mark devices with no compliance policy assigned as” controls how Intune treats a device that no policy covers. Microsoft recommends setting it to Not compliant if you use Conditional Access, so that only devices confirmed as healthy get in.

What Is Windows Autopilot?

Windows Autopilot sets up a new Windows PC for work without anyone building a custom image. The device is registered to your organization, often by the reseller at purchase. The employee unboxes it, connects to the internet, and signs in with a work account. Windows then joins Entra ID, enrolls in Intune, and receives your settings and apps.

Microsoft lists Business Premium among the subscriptions that meet Autopilot’s licensing requirements. Microsoft also offers a newer variant called Windows Autopilot device preparation. Either way, Autopilot only delivers what you have already built in Intune, so it comes after the policies and apps are in place.

For an office that buys one or two computers at a time, Autopilot is a convenience. It matters more when staff are remote and devices ship straight to their homes.

Retire or Wipe: Removing Company Data

Intune has two main removal actions, both under Devices > All devices after selecting a device:

• Retire removes company apps, settings, and data and unenrolls the device, leaving personal content intact. Microsoft describes it as ideal for personally owned devices.
• Wipe resets the device to factory settings. Use it for company-owned devices that are lost or being reassigned.

Both belong on your offboarding checklist.

When You Do Not Need Intune

• A very small office with a few company computers and no compliance obligations. Turning on encryption and automatic updates by hand, plus MFA, may be enough for now.
• An all-Apple office. Apple Business now includes built-in device management at no charge, which may cover your needs without Intune.
• An office on Google Workspace. Google’s own endpoint management is the natural first look.
• Phones only, email only. Basic Mobility and Security, included in every Microsoft 365 business plan, can require a PIN and wipe company data from phones.

Intune becomes worthwhile when you have Windows PCs to keep consistent, personal phones carrying company email, remote staff, or a framework such as HIPAA that expects device-level safeguards.

Common Mistakes

• Requiring compliant devices in Conditional Access before devices are enrolled, which blocks everyone.
• Creating the Apple push certificate with a personal Apple account, then losing access to it when that person leaves.
• Letting the Apple certificate expire. Microsoft allows a 30-day grace period after expiry to renew.
• Leaving devices with no assigned policy treated as compliant.
• Fully enrolling personal phones when app protection would do, which creates privacy concerns for no benefit.
• Setting policies and never reviewing the compliance report afterward.

Common Questions

Is Intune included in Microsoft 365 Business Standard?

No. Business Basic and Business Standard include Basic Mobility and Security, a limited subset of Intune for phones, tablets, and basic Windows settings. Full Intune Plan 1 comes with Business Premium, or you can add it to any plan for $8.00 per user per month as of September 2026.

Can Intune see personal photos or messages on an employee’s phone?

No. Microsoft’s list of what an organization can see states that it can never see browsing history, email, messages, contacts, calendar, passwords, or photos. It can see the device model, serial number, operating system version, and work apps. It cannot view a personal device’s location.

Does Intune manage Macs?

Yes. Intune Plan 1 supports macOS, including requiring FileVault encryption, deploying apps, and managing updates. You need the Apple MDM push certificate first. Offices that are entirely Apple should also compare Apple Business and Apple-focused tools, which we cover in our mobile device management guide.

Does Intune replace antivirus?

No. Intune manages settings and checks device health. Threat detection comes from a security product such as Microsoft Defender for Business, which is also included in Business Premium. Intune can deploy Defender’s settings and use Defender’s risk rating as a compliance rule.

How Coastal Growth Co. Can Help

We set up Intune for small businesses in Orange County: device inventory, enrollment for Windows, Apple, and Android, compliance and configuration policies, app protection for personal phones, and the Conditional Access rules that tie it together. We also document the Apple certificate renewal and other recurring tasks. Scope and price are agreed before paid work begins. See our Microsoft 365 and cloud services or contact us.