Set up Microsoft Intune for Windows

Intune manages Windows PCs through the Microsoft 365 account your company already has. If you pay for Microsoft 365 Business Premium, you already own it.

Before you start

Turn on automatic enrollment

Automatic enrollment brings a PC under management the moment someone joins it to your company account with their work sign-in. It is set up once:

1. Sign in to the Microsoft Intune admin center at intune.microsoft.com as a Global Administrator.
2. Go to Devices, expand Device onboarding, and select Enrollment.
3. Open the Windows tab and select Automatic Enrollment.
4. Set MDM user scope to All, or to Some if you want to start with a pilot group.
5. Leave the terms of use, discovery and compliance addresses at their defaults.
6. Set WIP user scope to None.
7. Select Save.

Enroll a company PC

For a PC the company owns, join it to your company account. The easiest moment is during Windows setup: when it asks how the PC will be used, choose work or school and sign in with the person’s work account.

For a PC that is already set up:

1. Open Settings, then Accounts, then Access work or school.
2. Select Connect.
3. Under the alternate actions, choose Join this device to Microsoft Entra ID (older versions of Windows call it Azure Active Directory) and sign in with the person’s work account.
4. Restart when asked. The PC enrolls in Intune and starts receiving your settings.

A staff-owned PC can be enrolled by selecting Connect on the same page and signing in, without choosing to join. Intune then treats it as a personal device, which limits what the company can see and do on it.

Turn on BitLocker

Encrypt every company PC, and make sure the recovery key is saved before encryption starts. A BitLocker key that exists only on the laptop is no help on the day the laptop asks for it.

1. In the Intune admin center, go to Endpoint security, then Disk encryption, and select Create Policy.
2. Choose Windows and the BitLocker profile.
3. Set BitLocker backup to Microsoft Entra ID to enabled, and back up both recovery passwords and key packages.
4. Require the device to back up its recovery information to Microsoft Entra ID before encryption is allowed.
5. Assign the policy to your company devices.

To find a key later, open the device in the Intune admin center and look under its recovery keys, or drill in from the encryption report.

Keep Windows up to date

1. Go to Devices, then By platform, Windows, Manage updates, Windows updates.
2. Open the Update rings tab and create a ring.
3. Set how long quality updates may be deferred, and a deadline for installing them, so a PC cannot put an update off indefinitely.
4. Review and create it, then assign it to your devices.

A deferral of about a week with a deadline of a few days suits most small offices: the rest of the world finds any bad update first, and then it installs whether or not anybody remembers.

Check devices are compliant

A compliance policy says what a healthy device looks like and flags the ones that are not. For Windows, start by requiring BitLocker, a password, and a supported version of Windows.

Give Virtisphere access

Use a named account with the Intune Administrator role, or a delegated relationship through Microsoft’s partner program. Both are explained in Give Virtisphere access.