Our primary use of Microsoft Intune is for device management and improve security. Initially, it focused on management for Windows devices. However, over time, its capabilities have expanded to encompass mobile device management in general, as well as management for other platforms like iPO, Android and Mac OS devices.
To ensure our devices are manageable regardless of location, we transitioned from an on-premises device management solution to Microsoft Intune. This cloud-based approach allows us to manage devices from anywhere, eliminating the need for them to be on our company network or VPN. Intune empowers us to remotely take actions on devices, including software installation, user identification, performance checks, and even triggering a remote lock if a device is compromised.
While most of our devices are company-owned, we also manage a small number of personal devices. Regardless of location, Intune allows us to manage them all.
Intune streamlines mobile application management by offering a single pane of glass for all devices across platforms, including iOS, Android, MacOS and Windows. It integrates seamlessly with the respective app stores for each platform.
Intune is a key component of a zero-trust security architecture. With Intune, we can manage our entire device fleet from a single platform. This enables us to enforce compliance policies. Intune verifies if devices meet our organization's security standards. We can implement zero-trust access control. Non-compliant devices are blocked from accessing company resources. Secure devices are granted access. Intune helps consolidate security management. It simplifies device security by offering features like compliance checks, security posture assessments, and configuration management - all in one place. Finally, Intune reduces management overhead: Intune streamlines device management by eliminating the need for multiple tools for tasks like patching and application deployment. While it may not offer the full functionality of specialized tools, it provides a comprehensive solution for core device security and configuration needs.
Intune offers comprehensive visibility and IT control over devices across various platforms. This allows for remote management, although integration with additional solutions or configuration might be necessary in some cases. However, Intune provides a single point of control for all our devices. Key functionalities include remote device control. We can manage devices remotely and trigger various actions. As well as advanced features to locate devices, enforce data synchronization, and more. It's important to note that certain advanced functionalities, like admin-level remote control, require device approval and may not be as robust as solutions offered by competitors, such as TeamViewer. Additionally, to access features like privileged email access, privileged device management, and advanced remote assistance, additional licensing is required, resulting in increased costs.
For users, Intune offers a seamless experience. Once their devices are enrolled, they typically don't need to do anything further. This is especially true for end users. For administrators, Intune is also an easy-to-use solution. Being cloud-based, it's accessible from a web portal just like any other SaaS application. The company portal experience is straightforward. Once users understand the basics, they can easily check device compliance and install applications. Overall, the user experience is very positive. However, device enrollment might require some training. Not everyone is comfortable managing their devices themselves. Even though the enrollment process is fairly simple and intuitive, some user training and change management might be necessary, especially for mobile device management in Intune. This is because multi-factor authentication is sometimes required to enroll devices, and some users may need help understanding and completing this step.
It provides a centralized solution for viewing all our devices. It also simplifies enrollment for Windows devices. Once we enable automatic enrollment for on-premises devices or upon user sign-in to company applications, enrollment can be seamlessly done through mobile devices. The most significant benefit is undoubtedly patching. Intune automates the process of keeping devices updated with the latest Windows updates and feature updates. This significantly reduces administrative overhead. After setting up the policies, we can be confident that updates are being applied without needing to constantly monitor them. Intune also offers improved visibility into device compliance. Unlike traditional Group Policies, which may only show successful application but not actual implementation, Intune displays the real-time status of enforced policies on each device. This allows us to see if features like BitLocker encryption or security restrictions are truly active, providing greater confidence in our device security posture. In essence, Intune offers a significant improvement in terms of device visibility and configuration management.
Intune's device compliance policies offer organizations valuable visibility into device settings. This includes essential requirements like BitLocker password complexity and minimum Windows or OS versions. Additionally, these policies allow for the deployment of custom compliance settings. This lets us measure compliance against any specific criteria. For example, one of my clients uses Intune to verify if CrowdStrike is running on the required version and if devices have downloaded the latest updates. By ensuring compliance, we can be confident that devices are secure against the latest vulnerabilities and security risks. This provides an extra layer of assurance. When used in conjunction with conditional access, Intune can block non-compliant devices. This guarantees that only compliant devices can access our organization's resources and applications. From a security standpoint, this offers significant peace of mind.
Application deployment in Intune offers several features that streamline the process. These features include applicability rules. We can deploy applications only to devices that meet specific criteria, such as operating system version or name. This ensures users receive the applications they need and avoids unnecessary installations. Device filtering allows us to exclude devices that don't require the application, further optimizing deployment efficiency. While Windows Win32 applications require packaging, the process is straightforward. Although automation would be ideal, packaging becomes easier with practice. Microsoft could potentially improve Intune by allowing seamless import of SCCM application packages. This would eliminate the need for repackaging and streamline migration. Overall, Intune simplifies application deployment for administrators. Features like self-service installation through the company portal empower users and reduce administrative burden. Packaging requirements vary depending on the application type. Standard applications like Office 365 are straightforward to deploy. Additionally, Intune integrates directly with app stores for iOS and Android apps, eliminating the need for manual packaging for these platforms.
Intune excels at securing hybrid work environments and protecting data on both company-owned and BYODs. It allows for selective wiping of company data from these devices without affecting personal information. However, for data downloaded from company applications like OneDrive, additional security policies might be necessary to ensure its security on downloaded devices, especially BYODs. The good news is that Intune allows the management of BYODs, enabling the deployment of settings, configurations, and security measures to assess the device's security posture. Notably, it's very easy to deploy for BYODs with its mobile application management for iOS and Android. For securing data within applications on Windows devices, Microsoft's Windows Information Protection capabilities seem to have been replaced. There's now a category requirement, likely used to secure data accessed through the Edge browser on privileged devices. This ensures data remains secure when users access it through Edge. It's important to note that some aspects of data security on BYODs might require additional configuration to guarantee complete protection.
Microsoft security signals identify the settings configurations we need to enforce on the devices. Then, it's up to organizations to deploy those settings or configurations. So, it's a good thing. It helps us understand what additional security we need to enable on the devices. Microsoft signals do help us do that, but it may not be enough. We might have various other compliance requirements that not everything would be covered under Microsoft signals, I believe.
Intune's endpoint privilege management is a valuable feature. It allows granting privileges to specific applications instead of giving local admin rights to users or entire devices. This can improve security by minimizing the attack surface. While EPM requires an additional license, it's a worthwhile consideration for many organizations. I've experimented with it in a lab setting, but we haven't deployed it for production use yet.
It has significantly boosted our IT department's productivity by automating many tasks. For instance, we no longer need to create custom images with Autopilot; we can simply deploy application settings configurations. Additionally, Intune seamlessly handles Windows updates and feature updates once they're configured. It's a set-and-forget system. Application deployment is also significantly simplified, saving admins valuable time. Overall, Intune improves IT productivity and empowers users with self-service features. Once trained, users can handle tasks like application installation, device compliance checks, and remediation actions for non-compliant devices.
While Intune isn't designed to identify security breaches directly like Defender does, it plays a crucial role in minimizing our attack surface. This is achieved by deploying the latest updates, configurations, and endpoint security policies. In my experience, Intune has significantly improved our overall security posture by reducing vulnerabilities, but it's not a replacement for breach detection tools.
Intune helps save costs by consolidating multiple endpoint management solutions. For instance, we might have separate solutions for iOS devices, Android devices, and Mac devices. By bringing everything together into a single solution with Intune, we can save on both platform licensing costs and administrative costs. Additionally, Intune reduces the need for additional per-device licensing fees that may have been incurred with separate solutions.
The user interface is well-designed and easy to navigate. It has a simple and well-structured layout, which makes it a pleasure to use. I'm very happy with the overall experience of the Intune portal. They also seem to be continuously improving it, with updates made on a monthly basis.
It streamlined our mobile device management by allowing us to manage both iOS and Windows devices under a single solution. This consolidation reduced the number of consoles and overall management tools required.
The integration of Microsoft Intune with Microsoft 365 and Microsoft Defender for Cloud strengthens cloud management and support for hybrid environments. This unified approach bridges the gap between cloud-based and on-premises device management, allowing organizations to leverage existing infrastructure while transitioning to cloud solutions.
One of the biggest advantages is that it brings the management of Windows, macOS, iOS, Android, and even Linux under a single pane of glass. This means we can manage all our devices from one central location.
A particular advantage is its tight integration for managing Windows devices. Since Intune is a native Microsoft product, it offers a more comprehensive and streamlined experience compared to many third-party solutions.
For mobile device management, Intune includes all the capabilities and features we'd expect from other vendors. However, it goes a step further by allowing us to secure Office 365 apps without needing full device management. This is a significant advantage when compared to other MDM solutions.
We package Win32 applications and import existing packages using solutions like SCCM or third-party tools. While Intune doesn't currently offer third-party application patching, we rely on third-party solutions for that functionality.
A new Intune feature - Enterprise App management allows to deploy Microsoft and Third party apps and keep them up to date but it incurs additional licensing costs. Ideally, this feature should be included in the base license. Similarly, the privilege endpoint management feature also requires additional licensing.
Intune would benefit from offering some core features at no extra cost. The most valuable improvement, in my experience, would be the ability to identify inactive devices through reports. Customizable reporting capabilities within Intune would simplify overall management and allow us to track device activity and inactivity more effectively.
The time it takes to implement Intune depends on two factors: the features we want to enable and the size of our organization. Enabling basic management features for common devices like iOS, Android, Mac, and Windows typically takes one to two weeks. This includes enrolling devices and setting up core functionalities. For a full Intune implementation with all its capabilities, the timeline can vary depending on the organization's size. However, simply enrolling devices and exploring basic features can be done in a couple of days.
While the step-by-step guided scenarios make the initial deployment process easier, it still requires familiarity with Intune and some experience using it.
I would rate Microsoft Intune 9 out of 10.
We have around 20,000 users on Intune and 4 people who work directly with it.
Intune requires annual maintenance to renew push certificates and tokens for business managers. For Windows devices, we might also need to deploy the latest application. Additionally, it's recommended to periodically review devices that are inactive, outdated, or haven't reported to Intune for a set amount of time. While Intune offers a "set and forget" approach for initial configuration, some ongoing maintenance is necessary to ensure its smooth operation.
I recommend Microsoft Intune to others.