Microsoft Intune for small businesses: a practical setup guide

Microsoft Intune lets you manage laptops and phones from the cloud: enforce encryption, push updates, install apps and block devices that fall out of compliance. For a small business without an on-site IT team it replaces a lot of manual work.

The risk is rolling it out too fast. A conditional access policy switched on for everyone on a Monday morning can lock out half the company. This guide follows the order we use with clients, so each step is tested before the next one depends on it.

1. Check your licences

Intune Plan 1 is included in Microsoft 365 Business Premium, Microsoft 365 E3 and E5, and Enterprise Mobility + Security plans. Business Premium is usually the right fit for companies under 300 users because it also includes Microsoft Entra ID P1, which you need for conditional access, and Defender for Business.

Microsoft 365 Business Basic and Standard do not include Intune. If some staff only need email, you can mix plans, but every user whose device you want to manage needs an Intune licence.

2. Prepare identity first

• Turn on multi-factor authentication for every user, starting with administrators. Use the Microsoft Authenticator app rather than SMS where you can.
• Create break-glass admin accounts: two cloud-only Global Administrator accounts with long random passwords, stored securely, and excluded from conditional access policies. They are how you get back in if a policy goes wrong.
• Create groups for a pilot (IT and a few willing staff), then for departments. Every policy in this guide is assigned to the pilot group first.

3. Set up enrolment for each platform

4. Define what a compliant device looks like

Compliance policies decide whether a device is trusted. A sensible starting point for Windows:

• BitLocker encryption required
• Secure Boot and a minimum supported Windows version
• Microsoft Defender antivirus on and up to date
• Firewall on
• Password or Windows Hello required

For phones, require a passcode, a minimum OS version and no jailbreak or root. Set a grace period of a few days before a non-compliant device is marked as such, so people have time to fix it.

5. Push configuration and security baselines

Configuration profiles do the actual work: they turn on BitLocker, set screen lock timeouts, configure Wi-Fi and VPN, and control Windows Update. Intune also offers Microsoft-maintained security baselines for Windows, Microsoft Edge and Defender, which apply hundreds of recommended settings at once.

Apply baselines to the pilot group first. Some settings, such as blocking certain legacy protocols or USB storage, can break older printers or line-of-business apps. Fix those exceptions before going wider.

Windows Update rings

Create at least two update rings: a pilot ring that receives updates first, and a broad ring that follows a few days later. This catches a bad update before it reaches everyone.

6. Protect company data on personal phones

Many small teams do not want to fully manage personal phones. App protection policies (MAM) let you protect company data inside Outlook, Teams and the Office apps without enrolling the whole device. You can require a PIN for those apps, block copy and paste into personal apps, and wipe only company data if someone leaves.

7. Turn on conditional access, carefully

Conditional access is where Intune pays off: only compliant devices, or approved apps on personal phones, can open company email and files. It is also where rollouts go wrong. Follow this order:

1. Create the policy in report-only mode, assigned to the pilot group.
2. Check the sign-in logs for a week to see who would have been blocked and why.
3. Fix those devices, then switch the policy on for the pilot group.
4. Expand group by group, with a named contact for each department.
5. Always exclude the break-glass accounts.

8. Document and review

Write down every policy, who it applies to and why. When an auditor or a customer security questionnaire asks how devices are protected, this document is your answer. Review it each quarter, because Microsoft regularly adds new settings and updates the baselines.

A realistic timeline

For a company of 20 to 100 people, a careful rollout usually takes three to six weeks: one week for identity and enrolment setup, one to two weeks of piloting, and the rest for staged rollout and clean-up. Rushing it saves little and risks a day of lost work across the business.