Skip to content

Intune Admin Handbook

Practical guides for the people who run Microsoft Intune in the enterprise. Enrollment, configuration, security, apps, and the day-to-day operations that rarely get written down.

Start with the tenant checklist Learn the fundamentals

~8 hoursNormal device check-in cycle
365 daysLifetime of Apple push certificates and tokens
1 hourHow often the Windows agent looks for new Win32 apps
500 / dayTenant limit on wipe actions

Find your guide

  • Get started

    How Intune works, a day-zero tenant checklist, 2026 licensing, and least-privilege admin roles.

    Get started

  • Enroll

    Choose the right enrollment method for Windows, Apple and Android devices, then lock enrollment down.

    Enrollment guides

  • Configure

    Settings catalog, targeting with groups and filters, baselines, updates, certificates and scripts.

    Configuration guides

  • Secure

    Compliance, Conditional Access, BitLocker and FileVault, LAPS, passwordless sign-in and EPM.

    Security guides

  • Apps

    App types and assignments, Win32 packaging, app protection for BYOD, and app configuration.

    App guides

  • Operate

    The recurring admin calendar, device lifecycle, reporting, Graph automation, change control and troubleshooting.

    Operations guides

Ten things every Intune admin should know

  1. Apple certificates and tokens expire every 365 days. Renew the Apple MDM push certificate with the same Apple account. If you replace it with a new certificate instead, every enrolled iPhone, iPad and Mac has to re-enroll. See the admin calendar.
  2. Compliance is "compliant" by default. Devices with no compliance policy count as compliant until you change the tenant setting to Not compliant. Do this before you rely on Conditional Access. See Compliance policies.
  3. Exclude break-glass accounts from every Conditional Access policy, and start each new policy in report-only mode. See Conditional Access.
  4. Don't use Global Administrator or Intune Administrator for daily work. Use Intune roles with scope tags, elevate with PIM, and put wipe, retire and delete behind Multi Admin Approval. See Admin roles and RBAC.
  5. New Windows devices should be Microsoft Entra joined. Microsoft no longer recommends hybrid join for new deployments, including through Autopilot. See Windows Autopilot.
  6. Use filters when speed matters at enrollment. Dynamic device groups take time to update after a device enrolls. Filters are evaluated when the device checks in. See Targeting.
  7. Roll out every change in rings. Pilot, then early adopters, then everyone. This applies to policies, apps and updates alike. See Change management.
  8. Back up the BitLocker key and LAPS password before you retire or delete a Windows device. Removing an Entra-joined device's Intune record removes BitLocker key protectors. See Device lifecycle.
  9. Policy changes are not instant. Devices check in roughly every 8 hours, and maintenance syncs are capped at one per 6.5 hours. Push a sync when you are testing. See Timings and limits.
  10. Apple software updates now run on declarative device management (DDM). Apple deprecated the older MDM update commands, so move your update policies to the DDM settings. See Apple and Android updates.

What changed recently

Licensing: Intune Suite features move into Microsoft 365 (from July 2026)

Microsoft 365 E3 now includes Intune Plan 2, Remote Help and Advanced Analytics. Microsoft 365 E5 and E7 add Endpoint Privilege Management, Enterprise App Management and Microsoft Cloud PKI. The rollout is gradual, with a notice in the Microsoft 365 admin center 30 days before your tenant changes. See Licensing.

Conditional Access: the “Require approved client app” grant is read-only (June 30, 2026)

Policies that use the approved client app grant can no longer be created or edited. Existing enabled policies keep working. Build new mobile policies with Require app protection policy. See Conditional Access.

Apple: Apple Business replaced Apple Business Manager (April 2026)

Automated Device Enrollment and Apps and Books still work the same way in Intune, but portal names and some screens changed. See Apple devices.

Windows 10: past end of support

Windows 10 support ended on October 14, 2025. Organizations that bought Extended Security Updates (ESU) receive security fixes through October 12, 2027 (year 2). Plan the move to Windows 11. See Windows updates.

How to use this handbook

Paths in the Intune admin center

Menu paths in this handbook follow the Intune admin center as of October 2026, for example Devices > Manage devices > Configuration. Microsoft reorganizes menus from time to time. If a path doesn't match, search the admin center for the feature name.