Intune and device security basics for small organisations

Email and files in Microsoft 365 are only as protected as the phones and computers people use to reach them. Microsoft Intune is Microsoft’s service for managing devices and apps, and Microsoft Defender for Business is its endpoint security product for smaller organisations. This guide explains the basics of Microsoft Intune for small business as Microsoft’s documentation describes them, and the licences Microsoft lists for each. The steps themselves are on the Microsoft Learn pages linked throughout.

What Business Basic and Standard include

Microsoft’s Business Premium security overview says all three Business plans include Basic Mobility and Security, a simpler built-in device management option. It says Business Premium adds Intune Plan 1, which “improves upon Basic Mobility and Security with more features”, including both device management and app management, and support for more device types, such as macOS.

Microsoft’s Intune licensing page lists Intune Plan 1 in Microsoft 365 Business Premium, Microsoft 365 E3 and E5, Microsoft 365 F1 and F3, and Enterprise Mobility + Security E3 and E5, among others. It states that “Intune isn’t included in licenses not in the previous tables”. The Microsoft 365 licensing and security features reference compares plans side by side.

Enrolment versus app protection

Microsoft describes two broad approaches, which can be used separately or together.

Device enrolment (MDM). The device is enrolled in Intune and managed as a whole. Microsoft says full device wipe, and selective wipe for MDM, “can only be achieved on devices enrolled with Intune mobile device management (MDM).”

App protection policies (MAM). Microsoft says these policies “ensure an organization’s data remains safe or contained in a managed app”, and can be used “with or without enrolling devices”. That makes them relevant to personal devices (often called BYOD, “bring your own device”). Microsoft states that policies “don’t apply when using the app in a personal context”, and that Intune applies them only in a work context.

Examples Microsoft gives of what app protection policies can do:

• require a PIN or fingerprint to open work email on a phone
• stop work data being copied and pasted into personal apps
• restrict work data to approved apps
• block managed apps from running on jailbroken or rooted devices (one of the access settings Microsoft lists)
• remove company app data from an app (a “selective wipe” for MAM).

Microsoft lists requirements including a Microsoft Entra account, an Intune licence assigned to the user, and signing in to the app with that work account. It also notes the Intune Company Portal app is required on Android to receive app protection policies.

Based on Microsoft’s instructions (checked October 2026), app protection policies are created in the Microsoft Intune admin center under Apps > Protection > Create policy, choosing iOS/iPadOS or Android. Microsoft’s guide to creating app protection policies has the full steps.

Compliance policies and Conditional Access

Microsoft describes compliance policies as “sets of rules and conditions that you use to evaluate the configuration of your managed devices”. Examples on its page include a minimum operating system version, device encryption, a PIN or password, not being jailbroken or rooted, and being at or under a threat level set by integrated threat management software.

Compliance on its own is a status. It becomes a gate when combined with Conditional Access in Microsoft Entra ID. Microsoft says that if a Conditional Access policy requires a device “to be marked as compliant”, Conditional Access uses the compliance status “to determine whether to grant or block access to email and other organization resources”.

Microsoft’s Entra licensing page states that Conditional Access requires Microsoft Entra ID P1. The guide to security defaults vs Conditional Access explains how Conditional Access policies work.

One default Microsoft highlights: devices with no compliance policy assigned are treated as compliant unless an administrator changes the setting. Microsoft’s page says that when compliance is used with Conditional Access, changing this to Not compliant ensures “only devices that are confirmed as compliant can access your resources.” Based on Microsoft’s instructions (checked October 2026), the setting is in the Microsoft Intune admin center under Endpoint security > Device compliance > Compliance policy settings; Microsoft’s compliance overview has the latest path.

BitLocker disk encryption

BitLocker is the disk encryption built into Windows. Microsoft’s Intune documentation describes two places to configure it: Endpoint security > Disk encryption policy, which Microsoft marks as recommended, and a Device configuration endpoint protection profile. It says that for “silent” BitLocker enablement, “recovery keys are automatically backed up to Microsoft Entra ID when encryption occurs.” Microsoft names the Cloud Device Administrator, Helpdesk Administrator and Global Administrator roles as including the permission to view recovery keys.

Microsoft lists device requirements for silent encryption: Microsoft Entra joined or hybrid joined, TPM (a security chip) 1.2 or later, native UEFI BIOS mode, Secure Boot enabled, and the Windows Recovery Environment configured and available. For which Windows editions support BitLocker management, Microsoft’s page points to separate Windows documentation.

Windows LAPS

Microsoft says “every Windows machine has a built-in local administrator account that can’t be deleted”. The guide to Windows security covers how standard and administrator accounts work on a Windows PC. Windows LAPS (Local Administrator Password Solution) manages that account’s password. Microsoft says Intune LAPS policies can enforce password requirements, back up the password to Microsoft Entra ID or on-premises Active Directory, and rotate it on a schedule. Microsoft describes this as helping protect against attacks “aimed at exploiting local user accounts like pass-the-hash or lateral-traversal attacks”.

Microsoft states this needs Intune Plan 1, and that with Entra ID Free “you can use all the features of LAPS”. Based on Microsoft’s instructions (checked October 2026), the policy is created under Endpoint security > Account protection > Create Policy, with Platform set to Windows and Profile set to Local admin password solution (Windows LAPS). Microsoft’s page says LAPS also has to be enabled in Microsoft Entra first; Microsoft’s LAPS policy guide has the full steps. It also notes LAPS supports only one account per device, and that the stored password is lost if the device is deleted in Microsoft Entra.

Microsoft Defender for Business

Microsoft describes Defender for Business as “an endpoint security solution based on Microsoft Defender for Endpoint… designed for small and medium sized business up to 300 users”. Microsoft lists next-generation protection (antivirus), endpoint detection and response, attack surface reduction, automated investigation and remediation, automatic attack disruption, and core vulnerability management. It works with components built into Windows, and with apps for Mac, iOS and Android, with or without Intune.

Microsoft says “Business Premium includes Defender for Business”, and that it’s also available standalone for eligible Microsoft 365 or Office 365 organisations with up to 300 users (its examples include Business Basic, Business Standard and Office 365 E1). Microsoft says protection for Windows and Linux servers “requires extra licenses.”

Things that change

Microsoft notes on its BitLocker and LAPS pages that Windows 10 reached end of support on 14 October 2025, and that Windows 10 devices can still enrol in Intune but “functionality won’t be guaranteed and can vary.” The Windows guide explains what happens when Windows stops getting updates. Intune feature names, menus and licence bundles change often, so the linked Microsoft Learn pages are the places to confirm current requirements.

Common questions

Does Microsoft 365 Business Premium include Intune?

Yes, according to Microsoft’s Intune licensing page, which lists Intune Plan 1 in Microsoft 365 Business Premium, Microsoft 365 E3 and E5, F1 and F3, and Enterprise Mobility + Security E3 and E5, among others. Microsoft says Business Basic and Business Standard include Basic Mobility and Security instead, a simpler built-in option. What Business Basic and Standard include explains the difference.

Can I protect work data on personal phones without enrolling them in Intune?

Microsoft says app protection policies can be used “with or without enrolling devices”, which makes them relevant to personal (BYOD) phones. Its examples include requiring a PIN to open work email, stopping work data being pasted into personal apps and removing company data from an app. Each user needs an Intune licence, and Microsoft says the policies don’t apply in a personal context. Enrolment versus app protection has the details.

Can Intune wipe a staff member’s personal phone?

Only if the phone is enrolled. Microsoft says full device wipe, and selective wipe for MDM, can only be done on devices enrolled with Intune mobile device management. For a phone covered only by app protection policies, Microsoft describes removing company app data from an app instead, a selective wipe for MAM. Enrolment versus app protection compares the two approaches.

How do I block devices that aren’t compliant from Microsoft 365?

Microsoft describes combining Intune compliance policies with Conditional Access, which can use compliance status to grant or block access to email and other resources. Conditional Access needs Microsoft Entra ID P1. Microsoft also notes that devices with no compliance policy are treated as compliant unless an administrator changes the Compliance policy settings. Compliance policies and Conditional Access has the path.

Where are BitLocker recovery keys stored when using Intune?

Microsoft says that for silent BitLocker enablement, “recovery keys are automatically backed up to Microsoft Entra ID when encryption occurs.” It names the Cloud Device Administrator, Helpdesk Administrator and Global Administrator roles as able to view recovery keys. Microsoft marks Endpoint security > Disk encryption as the recommended place to configure BitLocker. BitLocker disk encryption lists the device requirements.

What is Windows LAPS in Intune?

Windows LAPS manages the password for the built-in local administrator account on each Windows device. Microsoft says Intune LAPS policies can enforce password requirements, back the password up to Microsoft Entra ID and rotate it on a schedule, helping protect against attacks such as pass-the-hash. Microsoft says it needs Intune Plan 1 and works with Entra ID Free. Windows LAPS has the policy path and limits.

Related guides

• Microsoft 365 licensing and security features
• Essential Eight explained
• Microsoft 365 security baseline