Intune rollout: what to decide before you enrol devices

Plenty of small and mid-sized organizations run their email and files in Microsoft 365 while their laptops are still set up by hand, phones read company email with no protection, and the only record of who has which device is a spreadsheet nobody updates. Microsoft Intune is the tool meant to close that gap. When someone finally switches it on, the usual mistake is to start clicking through policies before deciding what the rollout is for.

This guide is for owners, operations leads and IT managers at Canadian organizations who want company laptops and phones managed properly. It covers the decisions to make before the first device is enrolled, in an order that protects company data without locking people out of their work on the first Monday.

Decide what you are trying to achieve

Microsoft's own planning guide for Intune starts with objectives rather than settings: which apps people need on which devices, how devices will be kept secure and up to date, and how people will sign in to company resources from all of them.[1] That order matters. A policy that makes sense for a finance laptop may be unreasonable on a warehouse tablet, and a setting copied from a template without a reason behind it becomes the one nobody dares to change later.

Write down, in plain language, what "managed" has to mean for your organization. For most businesses it comes to a short list:

• Company data stays in company apps and storage, and can be removed when someone leaves or loses a device.
• Devices are encrypted, locked with a passcode and kept up to date, with a way to see which ones are not.
• New laptops reach staff ready to work, without IT rebuilding each one by hand.
• Access to email and files depends on the device being in an acceptable state, not only on a correct password.

Settle the ownership question first

The biggest design decision is not technical. It is whether people will use company-owned devices, their own devices, or a mix. The Canadian Centre for Cyber Security describes three common models: corporately owned for business only, corporately owned but personally enabled, and bring your own device. It is direct about the trade-off: with personal devices, the organization has little control over the security measures on the device, and its ability to deal with a compromise is limited because it does not own it.[7]

Its guidance on personal devices recommends providing company-owned devices where possible, and, where personal devices are allowed, writing a policy that sets out which data may be accessed or stored on them, what management software staff must accept, and what happens to company data when they leave.[8]

Intune supports both paths. It treats personal and corporate-owned devices differently and offers more granular settings for devices it identifies as corporate-owned.[2] In practice, many organizations land on a simple split:

• Company laptops: fully enrolled and managed.
• Personal phones: not enrolled; company apps protected instead.
• Company phones, where they exist: enrolled, with the same compliance rules as laptops.

Protect the apps on personal phones, not the whole phone

Staff are rarely comfortable handing full control of a personal phone to their employer, and they do not need to. Intune app protection policies apply to managed apps such as Outlook and Teams and can work without enrolling the device.[4] Microsoft's examples are the controls most businesses actually want: a PIN or fingerprint to open company email, no copying company data into personal apps, and access to company data only through approved apps.[4] The policies apply in a work context only, so personal data on the phone is left alone.[4]

When someone leaves, the goal is to remove company data without touching their photos. The Cyber Centre makes the same point: a full wipe of a personal device should not be performed without the owner's consent, and a selective wipe of work data is preferred.[8] Agree this in the written policy before the first phone connects, so nobody is surprised by it later.

App protection only works if it cannot be bypassed. Microsoft notes that app protection policies should be paired with Conditional Access to make sure they are enforced.[4] Without that pairing, a user can often reach the same mailbox through an unprotected app or browser, and the policy protects only the people who were going to follow it anyway.

Plan how new laptops arrive

Rebuilding every laptop from a custom image is slow, and images drift out of date. Windows Autopilot takes the Windows installation the device ships with and turns it into a business-ready state: it joins the device to Microsoft Entra ID, enrols it in Intune, applies settings and installs apps, with the user only connecting to a network and signing in.[5] The same service can reset a device for a new user.[5]

Before relying on it, settle the practical details:

• How new devices are registered for Autopilot when you buy them, and who keeps that list current.
• Which apps every laptop needs on day one, and which only certain teams need.[1]
• How existing laptops will be brought under management: enrolled in place, or reset and re-provisioned on a schedule.
• Who is allowed to enrol devices at all. Enrollment is open for all platforms by default, and Intune lets you restrict the platforms and number of devices people can enrol.[2]

Write compliance rules you can enforce

A compliance policy is a set of rules a device must meet to count as compliant, such as a minimum operating system version or not being jailbroken or rooted.[3] Each policy can also take actions when a device falls out of line, such as emailing the user, locking the device after a period, or marking it for retirement.[3]

One tenant-wide setting deserves attention early. By default, Intune treats a device that has no compliance policy assigned as compliant. Microsoft recommends changing this to "Not compliant" if you use Conditional Access, so that only devices confirmed as compliant can reach company resources.[3] Leave the default in place and an unassigned device quietly passes every check.

Start with a few rules that matter and that you can explain to staff: encryption on, a passcode set, a supported operating system, and no jailbroken or rooted devices. Add more once you can see how the fleet actually reports.

Connect compliance to access, in stages

Compliance on its own is a report. It becomes a control when Conditional Access uses it. Device compliance status is reported to Microsoft Entra ID, where Conditional Access policies can allow or block access to email, Microsoft 365 and other apps based on that status.[3][6] Conditional Access requires a Microsoft Entra ID P1 or P2 licence, so confirm your plan includes it before you design around it.[6]

This is the step that locks people out when it is rushed. Roll it out in stages:

1. Enrol a pilot group, including someone from each team and at least one executive's devices.
2. Assign compliance policies and watch the compliance dashboard until the pilot devices report as you expect.[3]
3. Fix the devices that fail before anyone is blocked: old operating systems, missing encryption, devices nobody knew about.
4. Require compliant devices or protected apps for the pilot group, then widen in waves.
5. Keep an emergency access account excluded from these policies, so a misconfiguration cannot lock administrators out of the tenant.

Decide who looks after it afterwards

Intune is not a one-time project. Operating system updates, new hardware models, new starters and leavers, and compliance alerts all need someone to act on them. The Cyber Centre's guidance ties device management to onboarding and offboarding procedures: track every device in an inventory, and remove company data and access when someone leaves.[8] Name the person or provider responsible for that before go-live, not after the first lost laptop.

Where this fits

An Intune rollout sits between several kinds of work. Our Microsoft 365 service covers tenant configuration, Intune, compliance policies and Conditional Access design. The managed IT services page explains how device enrolment, updates and leaver processes are handled day to day, and a cybersecurity assessment can establish where devices and access stand today before you change anything.

If you want company laptops and phones managed without disrupting the people who use them, contact HAI Consulting for a free initial consultation. We will look at your current Microsoft 365 plan, how your devices are used, and tell you plainly which decisions need to be made first.