What is Microsoft Intune? An explanation and what Intune management costs for SMBs

Microsoft Intune is Microsoft's cloud service for managing and securing your employees' laptops, PCs, phones and tablets. In one place you set which settings, apps and updates a device receives, and which requirements it has to meet before it can reach your company data. You don't need a server in the office for this: devices fetch their settings over the internet, wherever your employee is working.

For most SMBs, Intune is already part of a licence they have or are considering: Microsoft 365 Business Premium includes Intune Plan 1. So the cost rarely sits in the licence, but in the work: setting Intune up properly and keeping it up to date afterwards. Below you can read what Intune does, what it doesn't do, which licences include it and where the cost of management lies.

What exactly is Microsoft Intune?

Microsoft calls Intune an endpoint management service. An endpoint is any device someone works on. Intune runs entirely in the cloud and you manage it from the Intune admin centre in your browser.

It comes down to three questions: who is signing in, on which device and with which apps? Intune doesn't handle identity itself. For that it relies on Microsoft Entra ID: that is where the accounts live, the groups you assign policies to and the Conditional Access rules. Intune supplies the information about the device, Entra ID decides whether someone gets in. A domain controller in the office isn't needed: Microsoft itself recommends deploying new Windows devices as cloud-native, joined to Entra ID.

MDM and MAM: two ways to manage

Intune has two forms of management, and you can combine them.

• MDM (mobile device management): the whole device is enrolled. Intune manages the settings, the security and the apps. If you lose the device, you wipe it remotely. This is the standard for company laptops and phones.
• MAM (mobile application management): Intune only manages the work apps and the data inside them, such as Outlook and Teams. The rest of the device stays the user's. When someone leaves, you only wipe the company data. This suits personal phones.

What do you manage with Intune?

In practice you use Intune for these parts:

• Compliance. You set requirements for a device: disk encryption on, a PIN or password, a minimum operating system version, Microsoft Defender active. Intune checks this and flags devices that don't comply.
• Conditional Access. Intune passes that compliance status to Entra ID. With Conditional Access you make sure only a device that meets your requirements can reach your mail and files. This requires Entra ID P1, which is included in Business Premium.
• Configuration profiles. Wi-Fi, VPN, browser settings and OneDrive, for example so that Desktop and Documents move to OneDrive automatically. This replaces the Group Policy of the past.
• Apps. The Microsoft 365 apps, Store apps and your own installation packages, either required or made available in the Company Portal app.
• Updates. With Windows Update for Business (now called Windows Update client policies) you decide when updates arrive: first for a test group, then for everyone else. Windows Autopatch, also available with Business Premium, automates this and includes the Microsoft 365 apps, Edge and Teams.
• Encryption. BitLocker on Windows, with the recovery key stored in Entra ID, and FileVault on the Mac.
• The local administrator account. With Windows LAPS every device gets its own administrator password that rotates automatically and is stored encrypted.
• Remote actions. Lock, restart, reset to factory settings, or remove only the company data and leave personal data in place.

Which devices can you manage with Intune?

Intune supports Windows, macOS, iOS and iPadOS, Android and a number of Linux versions (Ubuntu and Red Hat). Company iPhones and Macs can be enrolled automatically through Apple Business Manager, Android devices through Android Enterprise.

Two practical points for Windows. Buy business laptops with Windows 11 Pro or higher: Windows Autopilot only supports the Pro, Enterprise and Education editions. And Windows 10 has been out of support since October 2025. Intune shows which Windows version runs on each device, so one overview tells you which machines still need to move. What waiting costs you is explained in Windows 10: 13 October 2026 is your real deadline.

Company device or personal phone?

Company devices are fully managed with MDM. For personal phones (BYOD, bring your own device) you usually choose MAM: the employee installs Outlook and Teams, and Intune only protects the work data in those apps. That way you can, for example, stop someone saving an attachment from their work mail into a personal app. On Android a work profile is a middle ground: work apps and personal apps sit separately on the same phone.

So what can the employer see? According to Microsoft, never your call and browsing history, email and text messages, contacts, calendar, passwords, photos or the content of your own documents. What is visible includes the model, the serial number and the operating system version.

Many businesses don't allow personal Windows PCs to enrol. A home computer that is half managed by the company causes more hassle than certainty. Intune blocks this with enrolment restrictions.

Windows Autopilot: a new laptop without manual work

Windows Autopilot works together with Intune and handles the initial setup of a Windows device. The supplier or you register the laptop with Autopilot in advance. Your employee unpacks it, connects to the internet and signs in with their work account. The laptop joins Entra ID, enrols itself in Intune and fetches its settings and apps. IT never needs to handle the laptop. Autopilot can also reset a device so it is ready for the next employee. How that works step by step is explained in Windows Autopilot explained.

Which licences include Intune?

You usually don't need to buy Intune separately. This is the overview according to Microsoft:

Basic Mobility and Security lacks, among other things, Mac management, app protection for personal phones and Autopilot. If you want real management, Business Premium is usually the logical step; it also includes Microsoft Defender for Business. What the licences cost is on Microsoft 365 licences and prices. Extras such as Remote Help, which lets the helpdesk view a screen remotely, are not part of Plan 1. For most SMBs, Plan 1 is enough.

What doesn't Intune do?

Intune is not a solution for everything.

• It isn't a virus scanner. Detection and protection come from Microsoft Defender. Intune configures Defender and shows whether it is on.
• It doesn't make backups. Intune can make sure files end up in OneDrive, but a backup of Microsoft 365 is something you arrange separately, for example with Microsoft 365 backup.
• It doesn't manage accounts. Users, passwords and MFA live in Entra ID.
• It isn't for servers. Windows Server is not on Microsoft's list of operating systems Intune supports.
• It doesn't set itself up. An empty Intune environment enforces very little. It only delivers once someone creates, tests and assigns policies.

What does Intune management cost?

The cost has three parts.

The licence. If you have Business Premium, you already have Intune. If you have Business Basic or Standard, an upgrade comes on top.

The setup. This is where the thinking happens: which devices may enrol, which requirements you set, how Conditional Access works, which apps are required, how updates run and what you do with personal devices. Then you test with a small group, because a policy that is too strict locks people out and one that is too loose protects nothing.

The upkeep. New employees and devices, apps that need an update, devices that no longer comply, changes from Microsoft and employees who leave. This is not a one-off job.

If you have someone in-house with the time and knowledge, you can do this yourself. Many SMBs outsource it, because the work is ongoing and mistakes only show when something goes wrong.

How we do it

We work with a fixed baseline that we add to for each client. It includes, among other things: Autopilot for new Windows laptops, employees as standard users without local admin rights, LAPS for the local administrator account, Microsoft Defender with fixed security rules, automatic Windows updates and a block on enrolling personal Windows PCs. After that, we keep it up to date. Our Intune device management costs from €10 per device per month. If your employees work on laptops we manage for you, managed own laptops explains how that fits together; ongoing management of the whole workplace is covered under workplace management. Want your company to be ISO 27001, NEN 7510 or NIS2 compliant? Then choose Virtual Computing.