Setting Up Microsoft Intune for the First Time

You have just picked up a Microsoft 365 subscription with an Intune-eligible license (Business Premium, or an E3/E5 plan), you open the admin center… and the console sits there, empty. This is the most decisive moment of your device management project: the very first configuration shapes everything that follows. If the MDM authority or automatic enrollment are misconfigured, no device will ever check in, and you will lose hours figuring out why an enrollment fails with a cryptic error.

This article is written for administrators and IT managers at small and mid-sized companies starting Intune without a dedicated Microsoft expert. The goal is not to switch everything on at once, but to give you the logical order of operations: link the tenant, check licensing, set the MDM authority, enable automatic enrollment, then deploy a minimal baseline of policies. Follow this sequence and you start on solid ground.

Understand what Intune actually manages

Intune is not a server to install, nor a separate directory to create. It is a Microsoft cloud service that builds directly on your existing Microsoft Entra ID directory — the very same one that already holds your Microsoft 365 accounts. Everything is driven from the browser, with no on-premises infrastructure. Two ideas frame the start: enrollment, which brings a device under management, and policies, which then define its behavior and security posture.

It helps to distinguish the two broad management styles. Full device management (MDM) suits company-owned machines. App-only management (MAM) protects corporate data on personal devices without taking control of the whole endpoint. Knowing which one you are aiming for guides your later decisions.

Link the tenant and check licensing

Before anything else, make sure the users who will enroll devices actually have an Intune license assigned. This is the number one starting mistake: without a license, enrollment fails with a vague message that often discourages people within the first few minutes. Get into the habit of designating a small pilot group right away, a narrow perimeter on which you test each change before extending it to the whole organization.

The verification steps

1. 1Open the Intune admin center (intune.microsoft.com) with an account holding an appropriate administrator role.
2. 2In Microsoft Entra ID, assign the Intune license to the relevant users or, more cleanly, to a group.
3. 3Confirm that directory synchronization (if you run Microsoft Entra Connect in a hybrid setup) is healthy and error-free.
4. 4Create a security group, dynamic or assigned, to hold your first test machines.
5. 5Assign the license to a real test account and confirm it can sign in to the Company Portal.

Common mistakes at this stage

• Assigning the license to a group but forgetting that Entra Connect has not yet propagated the accounts.
• Testing with a global administrator account instead of a standard user, which hides licensing problems.
• Confusing a Microsoft 365 license with an Intune license: not every plan includes Intune.
• Overlooking the break-glass account that must stay excluded from future Conditional Access policies.

Set the MDM authority and automatic enrollment

The mobile device management authority (MDM authority) designates the system responsible for your devices. On tenants created in the last few years it is already set to Intune automatically, but it remains wise to verify it: this is the prerequisite for enrollments to be accepted. On older tenants that once used Configuration Manager, this setting may differ and deserves a careful check.

Automatic enrollment, in turn, makes a Windows PC joining Microsoft Entra enroll into Intune on its own, with no action from the user. You configure it on the Entra ID side, in the Mobility section, by defining the MDM user scope and the MAM user scope.

• Confirm the MDM authority is set to "Intune" in the enrollment settings.
• Configure the MDM and MAM user scope in the automatic enrollment settings (Entra ID > Mobility).
• Set the scope to "All" or, more sensibly at first, to your pilot group only.
• Leave the MDM terms-of-use, discovery and compliance URLs on the default values provided.
• For brand-new machines shipped by the vendor, consider Windows Autopilot to automate the whole setup through the Enrollment Status Page.

A concrete example: in a thirty-person company, the IT team first limits the MDM scope to a "Pilot-IT" group of three machines. A colleague adds their new laptop to their work account, and it enrolls into Intune on its own within a few minutes. Once the behavior is validated, the scope moves to "All" and the rest of the fleet follows.

Always move in concentric circles: a pilot group first, then a wider rollout. It is the best insurance against accidentally locking down an entire fleet.

Deploy your first policies

Once devices can enroll, resist the temptation to turn everything on at once. Start with a minimal baseline, targeted at your pilot group of a few machines, watch the behavior for a few days, then widen gradually. This caution avoids locking down a whole organization because of one overly strict setting or one forgotten dependency.

The recommended starting baseline

1. 1A compliance policy: BitLocker encryption required, minimum Windows version, antivirus active and firewall enabled.
2. 2A baseline configuration profile: automatic screen lock, Windows Defender Firewall enabled.
3. 3An endpoint security policy for Microsoft Defender Antivirus, with real-time and cloud-delivered protection.
4. 4Windows LAPS to manage and rotate the local administrator password on every machine.
5. 5Windows Update for Business to frame the update cadence without leaving devices to drift.

Next, decide what happens when a device becomes non-compliant. At first, settle for a simple flag, long enough to measure how many devices fall out of line and why. Only then link compliance to a Conditional Access policy that restricts access to corporate resources for non-compliant devices. Moving in stages keeps you from cutting off the whole company overnight.

The classic Conditional Access trap

The most dreaded mistake is creating a Conditional Access rule that requires a compliant device without excluding the admin account or providing a break-glass account. The result: nobody can sign in anymore, including you. Always exclude at least one emergency account from your access policies, and store its password offline.

How AuPoint simplifies this onboarding

This first configuration means hopping between several consoles (Intune, Entra ID, security) and knowing the right CSP settings, often with no explanation. That is the path AuPoint condenses: you connect your Microsoft tenant in a few clicks, with no PowerShell, and deploy a proven policy baseline described in plain language.

• An impact preview before applying, so you know which devices and users will be affected.
• Reversible policies: an overly strict setting is removed as easily as it was applied.
• Built-in break-glass safeguards so you never lock yourself out.
• A framing aligned with the ISO 27001, NIS2 and GDPR frameworks, useful for SMBs and MSSPs.

FAQ

Do I need a server or infrastructure to start with Intune?

No. Intune is a fully cloud-based service that relies on your Microsoft Entra ID directory. There is no server to install and no separate tenant to create. An appropriate license, a browser and an administrator account are enough to get started.

Why isn't my device enrolling into Intune?

The most frequent causes are an Intune license not assigned to the user, an automatic enrollment scope that does not cover their account, or a misconfigured MDM authority. Check these three points in order: in the vast majority of cases, one of them explains the failure.

Should I enable Conditional Access on day one?

It is not recommended. Start by observing compliance in report-only mode, let the fleet enroll, then enable Conditional Access once you are confident in the setup — always excluding a break-glass account so you never risk locking yourself out.

Ready to set up Intune without spending your evenings on it? Connect your Microsoft tenant in a few clicks and deploy your first security baseline with impact preview and reversible changes. Start free at aupoint.io.