Microsoft Intune for a Small Business: First Setup Steps

Check your licence before you start

Intune is part of several Microsoft 365 plans, but not the cheaper ones. Microsoft's Singapore plan comparison lists endpoint management with Intune Plan 1 under Business Premium, not under Business Basic or Business Standard.

If only some staff need managed devices, you can mix plans: Business Premium for people with company laptops, Basic or Standard for the rest. Each person whose device you manage needs the licence assigned to them; Microsoft's Autopilot requirements make the same point for automatic enrolment.

Not sure whether Intune or another tool suits you? Our Intune vs Google endpoint management comparison covers the choice for Google Workspace offices.

First Intune setup: the safe order

The usual mistake is applying strict policies to everyone on day one. Do it in this order and nobody gets locked out.

1. 1

   Create a pilot group

   In the Microsoft Entra admin centre, create a security group with two or three users, including yourself. Every policy below is assigned to this group first.

2. 2

   Turn on automatic Windows enrolment for the pilot

   In Intune, go to Devices, Windows, Enrollment, Automatic Enrollment. Set the MDM user scope to Some and pick the pilot group. Microsoft's automatic enrolment page explains the None, Some and All options.

3. 3

   Set enrolment restrictions

   Decide whether personally owned Windows PCs may enrol. Most small firms block personal Windows enrolment and use app protection for personal phones instead.

4. 4

   Enrol two test devices

   On a company Windows 11 Pro laptop, sign in with the work account under Settings, Accounts, Access work or school. Check it appears in Intune under Devices within the hour.

5. 5

   Apply the baseline policies

   BitLocker, Windows Update rings, Defender and a compliance policy, all assigned to the pilot group. The next section lists the settings.

6. 6

   Widen the scope

   After a week without problems, set the MDM user scope to All (or a larger group) and enrol the remaining devices.

Enrol Windows PCs: Autopilot or manual?

Windows Autopilot lets a new laptop set itself up from the box: the user signs in with the work account and the device joins Entra ID, enrols in Intune and installs apps. It needs a supported edition such as Windows 11 Pro (Home isn't supported) and the device's hardware hash registered in Intune, which a reseller can upload for you or you can collect yourself.

Existing PCs running Windows Home must be upgraded to Pro first. Microsoft's plan page lists a Windows 11 Pro upgrade among Business Premium's features, so check that before buying separate upgrade keys.

Baseline policies: BitLocker, updates, Defender, compliance

Four policies cover most of the risk for a small office. Keep them simple and resist adding dozens of settings in the first month.

Microsoft's compliance overview notes that devices with no compliance policy are treated as Compliant by default. That matters when you later add Conditional Access to block unmanaged devices; our Conditional Access guide covers that next step.

iPhones, iPads, Macs and Android

Company-owned Apple devices should come in through Apple Business (formerly Apple Business Manager) so they enrol automatically. You upload an Apple push certificate to Intune, link Intune as an external device management service in Apple Business, and sync the devices. Our Apple Business setup guide covers the Apple side, and Microsoft's automated Apple enrolment page covers Intune's side.

• Apple push certificate: renew it every year with the same Apple Account, or every Apple device must re-enrol. Note which account you used.
• Company Android phones: use Android Enterprise fully managed or corporate-owned work profile.
• Personal Android phones: Android Enterprise personally owned work profile, which separates work apps from personal ones.
• Macs: FileVault with the recovery key escrowed in Intune, plus macOS update deadlines.

BYOD: protect company data without enrolling personal phones

Most staff don't want IT managing their personal phone, and you rarely need to. Intune app protection policies work without enrolling the device: they apply to Outlook, Teams, OneDrive and other Microsoft apps, and can require a PIN, block copy-paste into personal apps, and wipe only company data when someone leaves.

Write down what you will and won't do on personal devices before rollout. Our BYOD policy and MDM guide includes the points to cover.

Do it yourself or get help?

An admin who is comfortable in the Microsoft 365 admin centre can enrol a small office in a few days if they follow the pilot-first order. The common traps are an all-users scope on day one, a BitLocker policy without key backup, and an Apple push certificate created on someone's personal Apple Account.

Our Device Encryption & Management package (S$490) sets up Intune enrolment, BitLocker and FileVault with key escrow, update rings, Defender and compliance policies, and app protection for personal phones. Pair it with Microsoft 365 / Google Security Lockdown (S$590) for MFA and Conditional Access.