What Is Microsoft Intune? Features and Its Relationship with Entra ID and Active Directory
Section titled “What Is Microsoft Intune? Features and Its Relationship with Entra ID and Active Directory”Microsoft Intune is Microsoft’s cloud-based service for managing organizational endpoints and business applications. IT administrators use the web-based Intune admin center to enroll devices, deploy configuration and apps, and review their status—even when employees work remotely. Microsoft’s overview
Typical tasks include installing software for new employees, configuring laptop encryption, and identifying devices running an outdated operating system. Specifications and requirements in this article were checked on October 24, 2026.
The two foundations: MDM and MAM
Section titled “The two foundations: MDM and MAM”| Management approach | Scope | Typical use |
|---|---|---|
| Mobile device management (MDM) | Enrolled devices, including configuration, security, and applications | Manage company-issued laptops and phones |
| Mobile application management (MAM) | Supported work applications and the organizational data inside them | Protect work email on a personal phone |
Despite its name, MDM includes PCs. MAM can complement device management or, on supported platforms and apps, protect work data without MDM enrollment. App protection overview
Main Microsoft Intune features
Section titled “Main Microsoft Intune features”1. Device management and configuration
Section titled “1. Device management and configuration”Intune manages platforms including Windows, macOS, iOS/iPadOS, and Android. Available settings and actions vary by operating system and enrollment method.
Configuration profiles deliver settings such as Wi-Fi, VPN, and device restrictions to user or device groups. IT can separate company-wide requirements from department-specific settings. Device configuration overview
2. Application deployment and updates
Section titled “2. Application deployment and updates”IT adds applications and assigns them to users or devices. Depending on the app and platform, assignments can require installation or let employees install approved software through Company Portal.
Intune does not automatically keep every application at its latest version. Update behavior differs across store, custom line-of-business, and Windows Win32 apps. Some require replacement packages or explicit update configuration. Test silent installation, detection rules, and restart behavior before broad deployment. App deployment and update methods
3. Protection for data inside work apps
Section titled “3. Protection for data inside work apps”App protection policies can require an application PIN and restrict copying work data into personal apps. They can also support selective removal of organizational data in bring-your-own-device (BYOD) scenarios.
These controls apply to supported applications and platforms, rather than every app on a device. Explain the management scope to employees and validate exactly which data is protected or removed. App protection capabilities
4. Operating system update management
Section titled “4. Operating system update management”For Windows, update rings control deferrals, deadlines, and restart behavior. Feature update policies can target a specific Windows release, allowing IT to validate changes before expanding deployment.
Intune manages update policies; devices normally download update content from Windows Update. Intune is not a repository where administrators upload Windows patches. Other platforms have their own supported update controls. Windows update management
5. Device compliance policies
Section titled “5. Device compliance policies”Compliance policies evaluate whether devices meet configured requirements, such as a minimum OS version or encryption status, depending on the platform.
| Mechanism | Purpose | Example |
|---|---|---|
| Configuration or security policy | Apply a desired setting | Configure disk encryption |
| Compliance policy | Evaluate device state against requirements | Mark an unencrypted device noncompliant |
| Entra Conditional Access | Make access decisions using relevant signals | Restrict access from noncompliant devices |
A noncompliant result does not automatically fix the device or block every service. Design notifications, grace periods, configuration, and access policies together. Compliance here means meeting the configured rules; it does not certify legal compliance or guarantee that a device is safe. Compliance policy overview
6. Endpoint security and remote actions
Section titled “6. Endpoint security and remote actions”Intune can manage supported encryption, firewall, and antivirus settings. Integration with Microsoft Defender for Endpoint adds security signals and workflows. Intune provides management controls; threat detection and investigation rely on the relevant protection capabilities and services. Endpoint security management
Remote actions include synchronization, restart, and wipe, with availability depending on platform and enrollment. A device wipe, retirement from management, and selective removal of app data have different effects. Offline devices cannot receive commands immediately. Document the appropriate action for loss, repair, and employee departure. Remote actions and prerequisites
What MAM can restrict in practice
Section titled “What MAM can restrict in practice”On supported mobile apps, app protection policies control how work data moves and the conditions under which it can be accessed. The following are configuration examples; availability varies by platform, app, and Intune SDK version.
| Control | Example |
|---|---|
| Copy and paste | Block copying work email into personal messaging or notes apps |
| Sharing between apps | Allow attachments to open only in protected apps such as Word |
| Storage destinations | Restrict saving to personal storage while allowing organizational OneDrive |
| Backups | Exclude work app data from personal backups |
| Printing and screen capture | Block printing or supported screen-capture operations involving work data |
| Web links | Require links from work apps to open in Edge |
| Access requirements | Require an app PIN or biometrics and restrict outdated apps, operating systems, or rooted devices |
| Offline access | Restrict work data access after a configured period without authentication |
Check the iOS/iPadOS settings and Android settings, especially for features such as screen capture.
For example, IT might permit copying from work Outlook to work Teams while blocking pasting into a personal messaging app. Apps supporting multiple identities can separate protected work use from personal use. Selective wipe can remove managed work data when an employee leaves. These controls cannot prevent someone photographing the screen with another camera. Protection scope
Do employees need an additional app?
Section titled “Do employees need an additional app?”Signing in with a work account does not automatically activate MAM restrictions. Administrators must provide the necessary licensing and assign protection policies to supported apps and users. The app then receives the settings associated with the work account.
| Mobile platform | Supporting app requirements |
|---|---|
| Android | Intune Company Portal is required in addition to the protected app |
| iOS/iPadOS | Company Portal is generally unnecessary for MAM alone; Microsoft Authenticator may be required by the authentication configuration |
Outlook and Teams normally use their standard mobile apps. Installing Company Portal is different from enrolling the whole device in MDM. Android MAM can operate without MDM enrollment. Android MAM requirements, authentication broker apps
Can Gmail and Slack use the same restrictions?
Section titled “Can Gmail and Slack use the same restrictions?”Support depends on the application’s Intune integration, rather than whether Microsoft publishes it. The following comparison concerns mobile apps.
| Application | Intune MAM support |
|---|---|
| Outlook and Teams | Supported; assigned app protection policies can apply |
| Gmail app | Not currently listed as a protected app; the same policies cannot be applied directly |
| Slack | Supported through the separate Slack for Intune app |
Slack for Intune requires a Slack Enterprise plan, appropriate Intune licensing, and administrator configuration. Users install the dedicated app; Android also requires Company Portal. Microsoft’s protected apps list, Slack setup requirements
Other management approaches can protect Gmail. For example, an Android work profile can restrict copying from work apps into personal apps. This is device/profile management, rather than enrollment-free Intune MAM. Google’s Android management settings
Blocking a transfer from Outlook to Gmail is different from managing data already inside Gmail. Outlook’s protection policy can control the former; the latter requires a management mechanism that applies to Gmail itself.
What can be restricted on a personal PC?
Section titled “What can be restricted on a personal PC?”Mobile MAM behavior does not automatically extend to desktop Outlook or Slack. Separate the following approaches when evaluating personal Windows PCs and Macs.
| Approach | Scope | Example controls |
|---|---|---|
| Windows MAM | Work data accessed through Edge | Restrict downloads, copying outside the work context, and printing |
| Service-side access controls | Access to supported web services | Browser-only access, blocked downloads and synchronization, or denied access |
| Intune MDM enrollment | Configuration and management of the enrolled PC | Encryption, updates, app deployment, and compliance evaluation |
Windows: protect Edge without MDM enrollment
Section titled “Windows: protect Edge without MDM enrollment”Windows MAM can restrict downloads, clipboard operations, and printing of organizational data in Edge on eligible personal Windows devices. It does not control every app or file on the PC.
Eligibility includes being unmanaged by MDM; Microsoft Entra joined or MDM-managed devices have different applicability. Windows MAM does not apply to macOS. Windows MAM settings and prerequisites
Windows and Mac: limit access to the browser
Section titled “Windows and Mac: limit access to the browser”SharePoint and OneDrive can use Entra Conditional Access to provide limited browser-only access from unmanaged PCs. Restrictions include preventing downloads, printing, synchronization, and access through desktop Office applications. Administrators can also control browser editing. This is not an Intune MAM-only feature. Unmanaged-device access controls
For other supported web services, Defender for Cloud Apps session controls may restrict downloads, copying, and printing. Plan native application access as well, so users cannot bypass browser controls. Check licensing and supported application/browser combinations. Browser session controls
Enroll the PC in device management
Section titled “Enroll the PC in device management”MDM enrollment allows management of supported settings on personal Windows PCs and Macs, with capabilities varying by OS and edition. Explain the scope, deployed software, and retirement or deletion actions before enrollment. Administrators can see information such as device name and OS version. Information visible after enrollment
For personal PCs, first assess whether browser-only access and download/synchronization restrictions meet the requirement. If local business applications are essential, evaluate device management or a virtual desktop as part of the design.
How Intune relates to Microsoft Entra ID
Section titled “How Intune relates to Microsoft Entra ID”Microsoft Entra ID, formerly Azure AD, handles organizational identity, authentication, and access control. Intune manages device and application posture.
A common access-control workflow is:
- Entra ID authenticates the employee.
- Intune supplies the device’s compliance status.
- Entra Conditional Access evaluates relevant conditions and allows or restricts access to the targeted resource.
Identity authentication and Intune enrollment are separate processes. Conditional Access remains an Entra capability even when configured through the Intune admin center. Verify the required entitlements, such as Entra ID P1/P2. Conditional Access integration
How Intune differs from Active Directory
Section titled “How Intune differs from Active Directory”Here, Active Directory means Windows Server Active Directory Domain Services (AD DS).
| Area | Microsoft Intune | Active Directory Domain Services |
|---|---|---|
| Primary purpose | Device and app configuration, deployment, and status management | Domain identities, computer accounts, and authentication |
| Infrastructure | Microsoft-hosted cloud service | Domain controllers operated for the organization |
| Configuration tools | Configuration profiles and security policies | Group Policy Objects (GPOs), among other tools |
| Main scope | Supported endpoint platforms and applications | Windows domain environments and related resources |
| Connectivity to plan | Access to internet-based management services | Access to domain controllers and related services |
Installing Intune does not replace AD DS authentication or its directory services. Plan identity and endpoint management separately, including the distinction between AD DS and Entra ID. AD DS and Entra ID comparison
Intune configuration and Group Policy overlap, but an existing GPO estate cannot be assumed to transfer unchanged. Assess supported settings, assignment scope, and conflicts during migration. How Group Policy works
How Intune differs from Windows Autopilot
Section titled “How Intune differs from Windows Autopilot”Windows Autopilot streamlines initial Windows setup and enrollment. Intune delivers applications and settings and continues managing devices after onboarding.
A typical workflow uses Autopilot to prepare a new employee’s PC, then Intune to maintain it. See the Windows Autopilot article for the deployment sequence.
Benefits and suitable use cases
Section titled “Benefits and suitable use cases”Intune is worth evaluating when an organization needs to manage remote endpoints, coordinate device requirements with Microsoft 365 access, or apply different protections to corporate-owned and personal devices.
- Standardized administration: Assign common configuration and applications by role or department.
- Less physical handling: Reduce tasks that require returning a device to IT.
- Clearer operational visibility: Identify deployment failures and noncompliant devices that need attention.
Match the service to your requirements. Purchasing records, stockroom tracking, accounting, comprehensive user-activity recording, and file backup may require additional systems.
Planning a rollout
Section titled “Planning a rollout”- Define scope: Identify platforms, ownership, shared-device scenarios, and required controls.
- Verify licensing: Separate Intune Plan 1 from additional capabilities and related services. Inclusion in Microsoft 365 depends on the subscription. Licensing documentation
- Choose enrollment methods: Select the appropriate Windows Autopilot, Apple, or Android enrollment workflow.
- Pilot gradually: Test configuration, application delivery, updates, and Conditional Access. Check interactions with existing GPOs and management products.
- Establish operating procedures: Define failure review, exceptions, lost-device response, offboarding, and BYOD communication.
Successful deployment goes beyond making devices appear in a console. IT needs to verify that intended settings arrive and establish a reliable way to address failures.
Further reading
Section titled “Further reading”The following Japanese-language articles informed the introductory topics and use cases. Use the Microsoft documentation linked above for technical requirements.