Room5.05Floor 5 Microsoft 365
Microsoft Intune setup and device management
We set up Microsoft Intune so every company laptop, Mac and phone is enrolled, encrypted, patched and checked before it touches your data. New laptops go from the box to ready without a technician at the desk.
- Windows, Mac, iPhone and Android
- New laptops ready from the box
- Encrypted, patched and checked
- Included in Business PremiumAs Intune Plan 1
One place to manage every company device
Microsoft Intune is the part of Microsoft 365 that manages devices. It decides how a laptop is set up, which apps it gets, whether its disk is encrypted, when it installs updates and whether it is healthy enough to open company email and files. It does the same for Macs, iPhones, iPads and Android phones, and it works wherever the device happens to be: at a desk in the office, on a kitchen table or in an airport lounge.
For an office of 5 to 250 people, three things change. A new hire’s laptop can ship straight from the supplier to their door and set itself up when they sign in. A lost or stolen device can be locked or wiped from a browser, and because its disk is encrypted, whoever finds it gets nothing. And a laptop that has skipped its security updates is stopped at the door until it installs them, instead of quietly becoming the way in for an attacker.
Intune is not something you switch on and walk away from. It is a set of policies, and nearly all of its value is in how those policies are written, tested and enforced. That is the work we do, for offices across Toronto, Mississauga, Vaughan and Oakville.
You may already be paying for Intune
Plenty of GTA offices own Intune without knowing it. It comes with Microsoft 365 Business Premium as Intune Plan 1, together with Microsoft Entra ID P1, which is what makes Conditional Access possible, and Microsoft Defender for Business. If your staff are on Business Basic or Business Standard, Intune is not part of the plan.
| Plan | Intune | Conditional Access | What it means for you |
|---|---|---|---|
| Microsoft 365 Business Basic | Not included | Not included | Web and mobile Office apps only. Devices can be managed only by buying Intune on its own. |
| Microsoft 365 Business Standard | Not included | Not included | Desktop Office apps, but no device management and no sign-in rules. The plan we most often see upgraded. |
| Microsoft 365 Business Premium | Intune Plan 1 | Included, through Entra ID P1 | Everything on this page, plus Defender for Business. Available for up to 300 users. |
| Microsoft 365 E3 | Intune Plan 1, with Remote Help and Advanced Analytics added in summer 2026 | Included | For organizations above 300 users or with enterprise compliance needs. |
| Microsoft 365 E5 | The full Intune Suite, added in summer 2026 | Included, with risk-based rules through Entra ID P2 | Adds Endpoint Privilege Management and Cloud PKI, among other tools. |
The arithmetic shifted on July 1, 2026. Microsoft raised Business Standard from $12.50 to $14 US per user per month and left Business Premium at $22, so the step up to Premium is now $8 a user. For most offices that is less than a separate device management tool, endpoint protection and sign-in security would cost on their own. We start by reading your current licences and tell you plainly whether an upgrade pays for itself. Canadian prices are set in Canadian dollars, and that is how we quote them.
How each kind of device gets enrolled
Enrollment is the moment a device comes under management. Done properly, it happens once, it happens automatically, and the user cannot undo it. Each platform gets there a different way.
Windows laptops and desktops
New Windows PCs are registered with Windows Autopilot before they reach the user, either by the supplier or by us. When the person opens the lid and signs in with their work account, the PC joins Microsoft Entra ID, enrolls in Intune, installs its apps and picks up every policy. As an authorized Lenovo reseller, we can have ThinkPads registered at the point of sale, so they never have to visit our bench.
Existing PCs can be enrolled too. We usually reset them through Autopilot rather than enrolling them as they are, because a clean start clears out years of old software, saved passwords and local admin accounts.
Macs
Company Macs bought from Apple or an authorized reseller can be linked to your Apple Business Manager account. They then enroll in Intune by themselves during first setup, with management the user cannot remove. FileVault encryption, macOS updates, apps and the office Wi-Fi are pushed the same way as on Windows.
iPhones and iPads
Company-owned iPhones and iPads go through Apple Business Manager the same way and are fully managed. Personal iPhones are better handled with app protection alone, explained in the next section, or with account-driven user enrollment, which keeps work data in its own encrypted space on the phone.
Android phones and tablets
Android is managed through Android Enterprise. Company phones are set up as fully managed devices. Personal phones get a work profile: a separate, badged set of work apps that IT can manage and wipe without touching anything else on the phone. Intune no longer supports the older device administrator method on phones with Google services, so any phone still enrolled that way needs to be moved.
Personal phones: protect the data, leave the phone alone
Most staff will not hand their own phone over to the company, and they should not have to. Intune app protection policies manage the work apps instead of the device. Outlook, Teams, OneDrive and the other Microsoft apps are told to keep company data inside themselves: no copying into personal apps, no saving attachments to the photo library, a PIN or face unlock to open them, and a selective wipe if the person leaves or loses the phone.
What IT can see and do
- Which work apps are installed and which versions
- The phone’s model and operating system version
- Whether the phone meets your rules, such as a screen lock and a supported OS
- Remove company data from the work apps, and nothing else
What IT cannot see or touch
- Personal email, texts, call history and chats
- Photos, contacts and personal files
- Browsing history and location
- Personal apps, or the rest of the phone in a wipe
We give your staff a short, plain version of these two lists before anything changes. Explaining it up front is the difference between a policy people accept and one they quietly work around.
The security baseline we build
Every Intune setup we deliver starts from the same written baseline, adjusted to your software and your people. It draws on Microsoft’s own security baselines and the CIS benchmarks, and it is tested on a small group of devices before anyone else receives it.
| Policy | What it does | Why it matters |
|---|---|---|
| Disk encryption | BitLocker on Windows and FileVault on Mac, with recovery keys held in your Microsoft tenant | A lost laptop becomes a hardware cost, not a privacy breach you have to report |
| Compliance rules | Define what a healthy device looks like: encrypted, updated, protected and not jailbroken | Conditional Access uses them to keep unhealthy devices away from email and files |
| Windows Update rings | Updates reach a test group first, then everyone, with deadlines that force the restart | Patches land within days, not whenever someone finally reboots |
| No local admin rights | Staff work as standard users, and Windows LAPS gives each PC its own rotating admin password | Most malware needs admin rights, and one shared admin password opens every PC in the office |
| Windows Hello for Business | Face, fingerprint or PIN sign-in tied to the physical device | A stolen password on its own no longer unlocks the laptop or the account |
| Defender onboarding | Every device reports to Microsoft Defender, with attack surface reduction rules switched on | Threats are caught and contained, and we see every device on one screen |
| App deployment | Office, browsers, PDF tools and your own business apps installed and kept current | Nobody installs software by hand on a new PC again |
| OneDrive folder backup | Desktop, Documents and Pictures kept in OneDrive automatically | A dead laptop costs an afternoon, not someone’s files |
| Wi-Fi and VPN profiles | Office Wi-Fi and remote access pushed to each device with its settings or certificate | Staff never need the Wi-Fi password, so they cannot pass it on |
| Device restrictions | USB storage, screen capture and personal accounts controlled where your work calls for it | Keeps client records on company systems in regulated offices |
Compliance rules only protect you once they are enforced. We connect them to Conditional Access in report-only mode first, so we can see exactly who would be blocked before anyone is. The email filtering, multi-factor sign-in and endpoint protection that sit around this baseline are covered on our cybersecurity page.
Moving from Group Policy, a domain or another tool
Most offices that call us are not starting from scratch. Their PCs are joined to a Windows Server domain, settings come from Group Policy, and remote staff connect through a VPN so their laptops can reach the domain controller. Intune can take over from all of that, one piece at a time, with the old way left running until the new one is proven.
Group Policy to Intune
We export your Group Policy objects and run them through Intune’s Group Policy analytics, which shows which settings have a direct cloud equivalent. Most do. The rest are obsolete, replaced by something better, or handled with a small script. No setting is removed from the server until the same setting is confirmed working from Intune.
From domain-joined to cloud-joined
For new and reset PCs, we recommend joining them to Microsoft Entra ID alone, with no on-premises domain. Sign-in, file access and printing all work without a line of sight to a server, which also means no more VPN just to log in. Hybrid join, where a PC belongs to both the domain and Entra ID, is kept only where an older application insists on it, and its retirement goes into the plan. Our Windows Server and Exchange page covers what then happens to the server itself.
From another device management tool
Offices leaving Workspace ONE, ManageEngine, Kaseya or a similar tool move across in waves, since a device can be enrolled in only one management service at a time. Studios that run mostly Macs sometimes do better keeping Jamf or Kandji for the Macs and using Intune for Windows and phones. If that is your situation, we will tell you rather than force everything into one tool.
What your staff notice, and when
A good Intune rollout feels like a non-event to the people using the devices. These are the only moments they should notice anything at all.
A note before anything changes
A short message from you, which we draft, says what is changing, what IT will and will not be able to see, and when it happens.
The pilot group
Five to ten people, with someone from each department and at least one Mac or phone user, receive every policy first. Problems with a particular app, printer or plug-in surface here, in front of a few patient colleagues rather than the whole office.
Enrollment of existing devices
Windows PCs either enroll in place or are reset by Autopilot overnight, with files already safe in OneDrive. Phone users get a one-page guide with screenshots for the Company Portal or the Outlook app.
The first Patch Tuesday
Microsoft releases Windows security updates on the second Tuesday of each month. The first cycle under Intune is the real test of the update rings, so we watch it closely and send you a short report of what installed, what failed and why.
Every new hire after that
A new laptop ships to the person, they sign in, and it finishes setting itself up while they read their welcome email. Departures are just as quick: the account is disabled and the device wiped or reset for the next person in minutes.
Intune projects we quote
Intune setup is quoted as a fixed-price project, based on the number of devices, the platforms you use and how much of your current setup has to move across. Day-to-day help after that, such as enrolling a new phone or fixing a laptop that has fallen out of compliance, goes through our help desk on the managed IT plan. Not sure what you already own? We start every Intune project with a licence check, and you can also get one as part of an IT assessment.
- Intune setup for a small office on Business PremiumFixed quote
- Windows Autopilot for new Lenovo laptopsFixed quote
- Group Policy and domain-joined PCs moved to IntuneFixed quote
- Company and personal phones brought under managementFixed quote
- Mac fleet enrolled through Apple Business ManagerFixed quote
- Review and repair of an existing Intune setupFixed quote
Questions people ask
Do we need Microsoft 365 Business Premium to use Intune?
Not strictly. Intune Plan 1 can be bought on its own. But Conditional Access, which is what actually blocks unhealthy devices, needs Entra ID P1, and Business Premium includes both along with Defender for Business. For most offices of up to 300 people, Premium is the simpler and cheaper route. We check your current licences before recommending anything.
Can Intune see the photos and messages on my personal phone?
No. On a personal phone we normally use app protection only, which manages the work apps such as Outlook and Teams. IT can see the phone model, OS version and which work apps are installed. Personal email, texts, photos, browsing history and location stay private, and a wipe removes only company data from the work apps.
How long does an Intune setup take?
For a small office it is usually a matter of weeks, and most of that time is the pilot group testing policies against real work. Larger offices, mixed Windows and Mac fleets, or a move away from Group Policy take longer. You get a timeline with the fixed quote.
Can Intune manage Macs as well as Windows PCs?
Yes. Macs linked to Apple Business Manager enroll automatically during setup and receive FileVault encryption, updates, apps and Wi-Fi settings. Studios that run mostly Macs sometimes keep a Mac-specific tool such as Jamf and use Intune for everything else, and we will advise which suits you.
What happens to a laptop when someone leaves?
Their account is disabled, their access ends everywhere at once, and the laptop is either wiped or reset through Autopilot so the next person can sign in to a clean machine. Their files are already in OneDrive, so nothing has to be copied off the device first.
Do we still need a server once devices are in Intune?
Not for managing devices or signing in. Laptops joined to Entra ID do not need a domain controller. You may still have a server for file shares or an older application, and we plan those separately, often by moving files to SharePoint.
Will Intune slow our computers down?
No noticeable amount. Policies apply in the background, apps install quietly, and update restarts are scheduled with deadlines that give people warning. The main change staff notice is that they no longer have admin rights on their PC.
Can you take over an Intune setup someone else built?
Yes. We review every policy, compliance rule and Conditional Access setting, fix conflicts and gaps, and document what is there. Many inherited setups have policies that were created but never assigned, or compliance rules that are not enforced.
Tell us what’s going on
Pick how urgent it is and leave a way to reach you. The help desk replies by phone or email. If work has stopped, call 647-812-3775 instead.
Something broken, or something to plan?
For anything urgent, call. A technician answers the emergency line 24/7. For everything else, open a ticket and tell us what is going on.