Defend · Device protection
Intune-managed laptops
For a firm on Microsoft 365, the laptops are managed in Microsoft Intune. This is what we enrol, what we set, in which order, and what is on record for each device.
The laptop is managed from the tenant it signs in to.
Microsoft Intune is the device management built into Microsoft 365: a laptop is joined to your firm’s Microsoft Entra ID, enrolled in Intune, and from then on gets its settings, its protection and its updates from the tenant, wherever it is. The compliance rule Intune applies is what conditional access checks at every sign-in: a device that is encrypted, protected and current is let in; one that isn’t gets as far as the sign-in page. So on Intune, device protection and sign-in protection are one system, and a new laptop is set up the same way every time, from a list, not from memory.
What we set
Enrolment, the rule, the baseline, in that order.
Each step builds on the one before. The compliance rule goes on last, once every laptop meets it, so it never locks out the people it should protect.
-
Enrolled on first start
A new laptop is enrolled the first time it is switched on and signed in to: joined to Entra ID, registered in Intune, and set up from the firm’s list of software and settings. Existing laptops are enrolled in waves, pilot group first.
-
Encrypted, key in the tenant
Disk encryption is switched on by policy, and the recovery key is stored in Entra ID, never on the device and never on paper. A laptop that won’t boot after an update is recovered from the key, not rebuilt.
-
The compliance rule
Intune marks a device compliant only when it is encrypted, protected and at the agreed operating-system version. Conditional access reads that mark at every sign-in. A device that falls out of compliance is told what to fix, and loses access until it does.
-
The documented baseline
The settings a laptop must have are written down once and applied by policy: the protection, the firewall, what the user may install, how the screen locks. A change to the baseline is a decision with an owner and a date, applied to every device.
-
Patched in rings
Windows and the Microsoft 365 apps update from Intune: a pilot ring first, then the rest, with a deferral that keeps a bad update away from the whole firm. Other applications are kept current by the same tested scripts that install them.
-
Lost, stolen or leaving
A lost laptop is wiped from Intune when it next comes online; a leaver’s laptop is retired and its company data removed; a device going back to the leasing company is wiped fully. Each action is on record with its date.
On record
On record for Intune.
- Every laptop with its compliance state, encryption and patch ring
- The compliance rule and the baseline policies, exported as set, with the date
- The recovery keys, stored in Entra ID, with who can read them
- The exceptions, each with its reason, owner and review date
- The wipes and retirements, each with its date
What we find in tenants we take over.
-
Enrolled, but no compliance rule
The laptops are in Intune, so they look managed. Nothing checks whether they are encrypted or current, and conditional access has nothing to read, so any device gets in.
-
The compliance rule switched on before the devices were ready
A rule that requires encryption goes live while half the laptops aren’t encrypted yet. Monday morning, half the firm is locked out, and the rule is switched off by lunchtime, for good.
-
Updates that never arrive
Patching is set up for the ring nobody is in. The pilot group updates every month; the rest of the firm is where it was a year ago.
Questions we get
Our laptops are already joined to Microsoft 365. Isn’t that enough?
Joining gives the laptop a sign-in. Intune gives it a baseline, encryption and updates, and tells conditional access whether the device may open client files. Without the compliance rule, the join only says who the laptop belongs to, not whether it is safe.
How long does enrolment take?
A new laptop enrols itself on first start and is ready when the setup finishes. Existing laptops take longer, because they are enrolled in waves and each one has to meet the baseline before the compliance rule goes on. The order is planned with you, around your deadlines.
What if a laptop is marked non-compliant on a deadline day?
The device shows what it needs, usually an update or a restart, and our engineers see it too. If it can’t be fixed in time, your TechPilot can grant a dated exception, on record, so the person keeps working and the device is fixed the next day.
Start
What does Intune say about your laptops today?
In a first call we look at your tenant as it is: which devices are enrolled, which are encrypted and compliant, and which ones fall through.
- No first level
- No surprises
- Pilot before you buy