Most Australian businesses run Microsoft 365, but far fewer have a solid answer to a simple question: how do you actually enforce your security settings on every laptop, phone and tablet your team uses? Microsoft Intune is that answer. It is the device management layer of the Microsoft 365 platform, and it has quietly become the standard way for Australian businesses to control Windows, Mac, iPhone and Android devices without an on-premises server. This guide explains what Intune does, which licence tier includes it, how it compares to the Group Policy tools many businesses still rely on, and how we deploy and manage it for our clients. Mycelium 365 provides Microsoft Intune setup and management services for businesses across Australia — if you're looking for Intune setup services near you, contact us to discuss your device management requirements.
What is Microsoft Intune?
Microsoft Intune is a cloud-based device management platform — part of the Microsoft 365 and Microsoft Endpoint Manager suite — that lets organisations manage, secure, and configure Windows, macOS, iOS, and Android devices from a single console. Intune is what allows IT teams to ensure every device accessing company data meets a minimum security standard: encrypted, up to date, MFA-enrolled, and compliant with company policy. For Australian businesses, Intune is also a core control in the Essential Eight framework — specifically for application control, patching, and restricting administrative privileges across managed devices.
Intune is the modern, cloud-native replacement for the on-premises management tools that dominated the previous era of business IT — most notably System Center Configuration Manager (SCCM). Where those tools required servers in your office and a VPN connection for laptops to receive policy, Intune delivers policy directly from Microsoft's cloud over the internet. That single architectural change is what makes remote and hybrid work practical at scale: a laptop in Perth receives the same compliance rules, applications and security settings as one in the Melbourne head office, the moment it connects.
Intune is also the enforcement layer behind our Essential Eight compliance service. Three of the Essential Eight strategies — application control, patching applications and operating systems, and restricting administrative privileges — are implemented and evidenced through Intune policy across every managed device.
What does Microsoft Intune do?
Intune does five core jobs, and each one replaces a manual IT task with an automated, centrally managed policy.
Device enrolment. Intune enrols devices into management automatically at first sign-in. New Windows devices provision themselves through Windows Autopilot — the user signs in with their Microsoft 365 account and the device configures itself with your policies, applications and security settings. Apple devices join through Apple Business Manager, and Android devices through Android Enterprise. There is no imaging, no manual setup and no IT visit: the device is managed from the moment it is unboxed.
Configuration policy deployment. Configuration profiles enforce the settings that define your security baseline: BitLocker disk encryption, screen lock, firewall state, app permission requests, and email and Wi-Fi profiles delivered to the device automatically. Change the policy once in the Intune console and every enrolled device receives it — no end-user action required.
Application deployment. Intune pushes Microsoft 365 apps, line-of-business applications and browser settings to all devices silently, and keeps them up to date. When a new employee starts, their device receives the full application set on day one without anyone touching it.
Compliance policy enforcement. This is where Intune earns its place in your security stack. Compliance policies define what a "healthy" device looks like — encrypted, patched, enrolled, not jailbroken or rooted. Conditional Access in Entra ID then checks compliance at every sign-in: a device that fails the policy is denied access to Microsoft 365 until it is remediated. Device security and identity security become one system rather than two disconnected tools.
Remote wipe. When a device is lost or stolen, Intune removes company data remotely — mailbox access, OneDrive files, company apps — without touching the employee's personal photos or apps. That separation is what makes device management workable for staff who use their own devices.
Is Microsoft Intune included in Microsoft 365?
Intune is included in Microsoft 365 Business Premium and all E3/E5 licences. It is not included in Microsoft 365 Business Basic or Business Standard. For Australian businesses on Business Basic or Standard, upgrading to Business Premium ($26.10/user/month in AUD) adds Intune, Microsoft Defender for Business, Azure AD P1 (Entra ID), and Azure Information Protection — making it the right licence tier for any business that needs device management.
That licence bundle is why Business Premium is usually the correct tier for Australian SMBs: it combines the Office applications your team already uses with device management, endpoint security and identity protection in a single per-user price. Our Secure Essentials package is built on Business Premium, so every managed device ships with Intune management, Defender for Business and Conditional Access in place from day one.
The licence tier also matters if you are planning an AI rollout: managed, compliant devices are the prerequisite for deploying Microsoft Copilot safely. Read our Copilot deployment guide for Australian businesses before you switch it on.
What is the difference between Intune and Group Policy?
Group Policy is an on-premises Active Directory tool — it only works when devices are on your network or connected via VPN. Intune is cloud-native — it manages devices anywhere, regardless of network. For Australian businesses with remote or hybrid workforces, Intune replaces Group Policy as the device management standard.
The differences run deeper than connectivity. Group Policy only manages Windows machines joined to your domain — macOS and mobile devices are invisible to it, and today those devices carry real company data. Intune manages Windows, macOS, iOS/iPadOS and Android from the same console and the same policy model.
Policy delivery also differs. Group Policy applies when a machine connects to the domain and refreshes on a schedule; Intune applies at device check-in, wherever the device is, and reports compliance state per device. That per-device compliance reporting is what makes Intune audit-ready: you can export evidence of encryption, patch state and admin restrictions for Essential Eight Maturity Level 2 assessments and cyber insurance questionnaires — not just trust that a GPO "probably applied".
The two can run side by side during a transition. Hybrid-joined Windows devices can receive both Group Policy and Intune policy simultaneously, which lets you migrate from an old server environment to cloud management gradually rather than in one disruptive cutover.
How Mycelium 365 deploys and manages Intune
Intune management is included in all Mycelium 365 managed packages. We configure Intune policies for compliance, deploy applications to all enrolled devices, connect Intune to Conditional Access so non-compliant devices cannot access Microsoft 365, and manage Autopilot enrolment for new Windows devices — zero-touch setup from the box. Contact us for an Intune assessment.
In practice, an Intune deployment with us covers four stages. First, we review your licences and confirm every user who needs device management holds a Business Premium, E3 or E5 licence. Second, we enrol your existing devices and apply a policy baseline aligned to Essential Eight Maturity Level 2 — encryption, patching, application control and restricted admin rights. Third, we register new hardware for Autopilot so future devices configure themselves out of the box. Fourth, we roll out Conditional Access in report-only mode first, so you can see exactly which devices would be blocked before the policy is enforced.
From then on, policy changes, application updates and compliance reporting run continuously in the background — which is the point. Device management should be something you notice when you need evidence for an audit, not something your team thinks about on a Monday morning.
When Intune is properly configured, every device in your organisation is enrolled, managed, and compliant — whether it’s in the office, at home, or on a job site.