Device management used to mean a server in a comms cupboard, a domain join, and a group policy object nobody could explain. For Australian businesses running Microsoft 365, that model no longer matches how people work — laptops that never touch the office network, phones owned by staff, contractors on their own hardware, and a compliance expectation that every device accessing company data is patched, encrypted and monitored.
Microsoft Intune is the service that solves this. It is included in Microsoft 365 Business Premium, E3 and E5, which means most Australian businesses are already paying for it and a surprising number are not using it.
What is Microsoft Intune and what does it do?
Microsoft Intune is a cloud-based endpoint management service. It enrols devices, applies configuration, deploys applications, enforces compliance, and protects company data on devices you own and devices you do not.
It covers five functions.
Enrolment. Devices are registered to your tenant — Windows through Autopilot or Entra join, macOS through Apple Business Manager or user enrolment, iOS and Android through Apple and Google enrolment programmes or app protection alone.
Configuration. Settings are pushed centrally: BitLocker and FileVault encryption, Windows Update rings, Defender settings, browser policies, Wi-Fi and VPN profiles, password and PIN requirements, and hundreds of individual settings through the settings catalogue and security baselines.
Application management. Deploy Microsoft 365 Apps, line-of-business software, Win32 packages and store apps; keep them updated; remove them when a user leaves a team.
Compliance. Define what a healthy device looks like — encrypted, patched within a defined window, Defender enabled, no jailbreak — and report on which devices meet the standard. Compliance state feeds directly into Entra ID Conditional Access, so non-compliant devices can be blocked from company data.
Protection and remediation. Remote wipe of a lost device, selective wipe of company data from a personal phone, and app protection policies that prevent copying company data into personal applications.
Intune replaces on-premises Configuration Manager and traditional MDM products for most Australian small and medium businesses, and we manage it for clients through our managed Intune service.
Intune vs traditional MDM solutions for Australian businesses
Traditional MDM platforms — and on-premises Group Policy plus Configuration Manager — still work, but three differences matter.
Integration with identity. Intune device compliance is a native signal in Entra ID Conditional Access. A third-party MDM can usually integrate through a partner connector, but the enforcement is loosely coupled. With Intune, "block access to email from non-compliant devices" is one policy and it applies everywhere Microsoft 365 is accessed.
Licensing. Intune is included in Microsoft 365 Business Premium, E3 and E5 at no additional cost. A standalone MDM adds $4–$12 AUD per device per month on top of licensing you already own. For a 60-person business, that is a meaningful line item to duplicate.
Network independence. Group Policy requires line of sight to a domain controller. Intune policy applies over the internet, which matches how Australian businesses have worked since 2020. Hybrid arrangements exist, but new deployments rarely justify them.
Where traditional tooling still wins: complex on-premises server management, deep OS imaging requirements, and specialised industrial or kiosk hardware with vendor-specific management agents. Most businesses under 500 staff do not have those requirements.
How Intune enforces Essential Eight patching and application control
Four of the eight ACSC Essential Eight mitigation strategies are delivered directly through Intune.
Patch operating systems. Windows Update rings define deferral periods, deadlines and automatic restart behaviour. Maturity Level 2 requires critical operating system patches applied within two weeks — or 48 hours where the vulnerability is being actively exploited. Update rings plus Windows Autopatch meet this, and Intune reports compliance per device so the evidence exists for an assessment.
Patch applications. Microsoft 365 Apps update automatically through the Current or Monthly Enterprise channel configured by Intune. Third-party applications are handled through Win32 app supersedence, the Microsoft Store, or Windows Package Manager, with Defender vulnerability management identifying what is behind.
Application control. App Control for Business (formerly Windows Defender Application Control) is deployed through Intune to allow only approved executables, scripts and installers. Maturity Level 2 requires application control on workstations for user profiles and temporary folders; Maturity Level 3 extends it across all locations with rule sets validated annually. This is the most demanding of the four to implement and requires an audit-mode period before enforcement.
User application hardening and macro settings. Attack surface reduction rules, blocking Office macros from the internet, disabling Flash and legacy content, and hardening browsers are all configuration profiles or Defender policies pushed through Intune.
Combined with Entra ID for MFA and restricting administrative privileges, and Azure Backup for the backup control, a Microsoft 365 Business Premium tenant managed with Intune covers all eight controls at Maturity Level 2. We deliver this configuration as part of Secure Essentials and validate it through managed security services.
Setting up Intune compliance policies for Microsoft 365
A compliance policy is a set of conditions a device must satisfy. The output is a compliant or non-compliant state, which Conditional Access consumes.
A sensible Australian baseline for Windows devices:
- BitLocker encryption enabled and Secure Boot required
- Defender antimalware and real-time protection on, with signatures current
- Minimum OS build maintained against supported Windows versions
- Firewall enabled
- Password or Windows Hello required, with a maximum idle lock of 15 minutes
- Device threat level at or below "medium" where Defender for Endpoint is integrated
For iOS and Android:
- OS version at or above a defined minimum
- Jailbreak or root detection
- Passcode required with a minimum length and idle timeout
- Encryption enabled (Android; automatic on iOS with a passcode)
Three configuration details determine whether compliance policies help or generate complaints. Set a grace period — typically 24 to 72 hours — so a device that falls out of compliance triggers a notification before it is blocked. Configure the notification message so users know what to fix and who to contact. And mark devices with no compliance policy assigned as non-compliant only after every device is enrolled, otherwise you block your own staff on day one.
Compliance means nothing until Conditional Access enforces it. Create a policy requiring a compliant or hybrid-joined device for Exchange Online, SharePoint Online and Teams, deploy it in report-only mode, review which devices would be blocked, remediate, then enforce.
Intune for BYOD in Australian businesses
Bring your own device raises a legitimate concern from staff: what can my employer see and control on my personal phone? The answer depends on which of two models you choose, and being clear about it is the difference between a smooth rollout and a resistant one.
Full enrolment (MDM). The device is managed. You can enforce passcodes, push configuration, and perform a full wipe. Appropriate for company-owned devices. Most staff, reasonably, do not want this on a personal phone.
App protection policies (MAM without enrolment). The device is not managed at all. Protection is applied inside the Microsoft applications — Outlook, Teams, OneDrive, Word. You can require a PIN to open Outlook, block copy and paste from company apps into personal apps, prevent saving company files to personal storage, require a minimum app version, and selectively wipe only company data if the person leaves. You cannot see personal photos, browsing, applications, or location, and you cannot wipe the device.
For Australian businesses, app protection policies are usually the correct BYOD answer. They satisfy the data protection requirement, need no device enrolment, work on personal iOS and Android devices, and avoid the privacy objection entirely. Pair them with a Conditional Access policy requiring an approved client application and app protection policy for mobile access, so personal devices can only reach company data through protected Microsoft apps.
Document the arrangement in a BYOD policy that states plainly what the business can and cannot see. Staff cooperate with controls they understand.
HowTo: Enrol devices in Microsoft Intune
Step 1 — Confirm licensing and configure MDM authority
Verify users hold Microsoft 365 Business Premium, E3 or E5, or a standalone Intune licence, and confirm Intune is set as the MDM authority in the admin centre.
Step 2 — Configure enrolment restrictions
Define which platforms are permitted, whether personally owned devices may enrol, and set device limits per user so enrolment matches your BYOD policy.
Step 3 — Connect Apple and Google enrolment services
Upload an Apple MDM push certificate for iOS and macOS, connect Apple Business Manager for corporate devices, and configure Managed Google Play for Android enterprise enrolment.
Step 4 — Create configuration profiles and security baselines
Apply disk encryption, Defender settings, Windows Update rings, password requirements, Wi-Fi and VPN profiles, and the Microsoft security baseline to a pilot group first.
Step 5 — Set up Windows Autopilot for new devices
Register hardware hashes with Autopilot, or have your supplier register them at purchase, and create a deployment profile so new laptops configure themselves out of the box without imaging.
Step 6 — Deploy applications
Assign Microsoft 365 Apps, line-of-business Win32 packages and store applications to user or device groups, and configure supersedence for updates.
Step 7 — Create compliance policies
Define compliance requirements per platform with a grace period and a clear user notification, and assign them to all users.
Step 8 — Enforce with Conditional Access
Create a Conditional Access policy requiring a compliant device for Microsoft 365 access and an approved client application with app protection for mobile, deploy in report-only mode, review, then enforce.
Step 9 — Enrol devices in waves
Enrol a pilot group of 10 to 20 devices, resolve issues, then roll out by department. Provide staff with short instructions for enrolling a device and for what changes on a personal phone.
Step 10 — Monitor and maintain
Review the compliance and update-status dashboards weekly, act on non-compliant devices, and review configuration profiles quarterly as Windows and mobile OS versions change.
Getting Intune deployed properly
The common failure pattern is enrolling devices without ever enforcing compliance through Conditional Access — a management platform with visibility but no control. The second is enforcing too much too quickly and losing staff goodwill.
Mycelium 365 deploys and manages Microsoft Intune for businesses across Australia and New Zealand as a Microsoft Solutions Partner, including Autopilot provisioning, Essential Eight patching and application control, BYOD app protection, and ongoing compliance reporting. If you hold Business Premium licences and are not using Intune, you are paying for the capability already.