Microsoft Intune
In plain English
Plain definition
Microsoft Intune is Microsoft's cloud-based unified endpoint management service that enrols, configures, secures and retires Windows, macOS, iOS and Android devices via policy.
Technical Definition
Microsoft Intune is a cloud-based unified endpoint management (UEM) platform within the Microsoft Endpoint Manager ecosystem. It provides mobile device management (MDM) and mobile application management (MAM) capabilities across Windows, macOS, iOS/iPadOS and Android. Intune enrols devices through platform-native management channels (for example, Apple’s MDM protocol, Android Enterprise, or Windows MDM/Autopilot), applies configuration and compliance policies, distributes applications, and enforces conditional access in conjunction with Microsoft Entra ID. Administration is performed through the Microsoft Intune admin center, with policy state and device telemetry visible per device and per policy assignment.
Operational Relevance
Intune matters operationally wherever an organisation needs consistent device posture without physical access to each endpoint: enforcing disk encryption, requiring a minimum OS version, restricting corporate data to managed apps, or blocking access from unmanaged or non-compliant devices. Policy changes made in Intune do not apply instantly; they depend on device check-in intervals, which vary by platform and connectivity, so operational planning must account for propagation delay rather than assuming immediate effect.
Architecture Relationship
Intune does not operate alone. It depends on Microsoft Entra ID for identity, device registration and conditional access enforcement, and on the Microsoft Graph API for programmatic policy and reporting access. On Windows, Intune commonly works alongside Windows Autopilot for zero-touch provisioning and Microsoft Defender for endpoint security signal exchange via conditional access. On Apple platforms, Intune relies on Apple Push Notification service (APNs) and, for supervised deployment, Apple Business Manager. This layered dependency means an Intune policy failure can originate outside Intune itself, for example an expired APNs certificate or an Entra ID conditional access misconfiguration.
Example
An administrator creates a compliance policy in the Intune admin center requiring BitLocker encryption and a minimum Windows build. The policy is assigned to an Entra ID security group. Enrolled devices in that group evaluate the policy at their next check-in; devices that fail are marked non-compliant, and a linked conditional access policy in Entra ID can then block those devices from accessing Microsoft 365 services until the setting is corrected.
Misunderstanding
A common misunderstanding is treating Intune as a real-time enforcement tool that immediately blocks non-compliant devices the moment a policy is created. In practice, enforcement is asynchronous: it depends on device check-in cadence and, for access blocking, on a separately configured conditional access policy in Microsoft Entra ID. Intune reports compliance; Entra ID conditional access is what actually restricts access based on that compliance state.
Related Terms
- Microsoft Entra ID — identity and conditional access provider that Intune relies on for enrolment and access enforcement.
- Mobile Device Management (MDM) — the general protocol category Intune implements for device enrolment and policy delivery.
- Windows Autopilot — a zero-touch provisioning service commonly paired with Intune for Windows device deployment.
- Microsoft Graph API — the programmatic interface used to read and manage Intune policy and device data at scale.
Further Reading
Consult the official Microsoft Intune documentation for current policy types, supported platform versions and enrolment method details, since these change with product updates and should be re-verified against the specific tenant configuration and licensing in use.