Microsoft Intune

Microsoft Intune is Microsoft's cloud service for managing organization-owned and personal devices, the apps on them, and access to work data. It gives administrators one control plane for enrollment, configuration, compliance, app protection, updates, and remote actions.

itWindows and Microsoft infrastructure

Don't Panic — Microsoft Intune

Somewhere out there is a laptop, a phone, and possibly a kiosk bolted to a wall in a lobby, and somebody in IT needs to know what's installed on it, whether it's encrypted, and whether it deserves access to anything that matters. Microsoft Intune is Microsoft's answer to that problem: a cloud service that manages devices and apps, then reports back on what it found.

It doesn't replace the operating system, and it isn't software that lives permanently on the device either. Before services like this existed, IT staff relied on machines sitting on a wired office network, physically reachable by whoever held the keys, or walked room to room with a USB stick. Intune's job is to reach devices that are neither of those, wherever they are, from a web console.

Three ideas carry the rest of it. Everything is organized around identities, devices, and apps: identity decides who a policy targets, the device is usually where policy lands, and an app can sometimes be protected on its own, independent of the device underneath it.

Second, there are two different ways to manage something. MDM takes responsibility for a whole enrolled device: settings, security, updates, the works.

MAM manages only the organization's data inside a handful of apps, leaving the rest of a personal phone alone. Whichever one is loudest in a given deployment says a lot about whether the organization owns the hardware or just needs one inbox kept honest.

Third, and this is the one that trips people up: the console tells you what it decided, not what happened. Assigning a policy is a click. Getting a laptop to notice, download, and apply that policy is a conversation the laptop has on its own schedule, and the two are easy to mistake for each other.

That third point is the genuine surprise. A policy marked "assigned" hasn't necessarily reached anyone. A laptop closed in an airport lounge isn't broken, it just hasn't had the conversation yet. And "compliant" is a snapshot from the last successful check-in, not a live guarantee, which is exactly why Conditional Access — a separate Entra service, not Intune itself — is the thing that actually stops a risky sign-in, not the compliance flag sitting quietly on its own.

Where to go next depends on what you need explained. The Course tab builds the full architecture: enrollment, assignment, compliance, and how Conditional Access consumes it. The Cheatsheet is the fast lookup once that shape is already in your head. If Intune sits next to tools you're actively comparing it against, the Landscape tab has the field. And if a decade of version history sounds more useful than intimidating, the Timeline is there too.

Don't Panic — Microsoft Intune

Relevant careers