Skip to content

Get started

This section gives you a working model of how Intune behaves, a checklist for setting up a tenant properly, the licensing picture for 2026, and an admin-role design that won't come back to haunt you.

  • Intune fundamentals

    How devices, users, policies and assignments fit together, and why changes take time to land.

    Read the fundamentals

  • Tenant setup checklist

    The day-zero settings, connectors and first policies every enterprise tenant needs.

    Work through the checklist

  • Licensing

    Plan 1, Plan 2 and the Intune Suite, and what Microsoft 365 E3 and E5 include from July 2026.

    Check your licensing

  • Admin roles and RBAC

    Least-privilege roles, scope tags, just-in-time elevation and Multi Admin Approval.

    Design your roles

The four admin centers you will use

Intune doesn't live alone. Most real tasks touch at least two of these portals.

Portal Address What you do there
Microsoft Intune admin center intune.microsoft.com Devices, apps, policies, enrollment, endpoint security, reports, Intune roles
Microsoft Entra admin center entra.microsoft.com Users, groups, device identities, Conditional Access, Entra roles, PIM, app registrations
Microsoft Defender portal security.microsoft.com Defender for Endpoint onboarding, alerts, vulnerability management, security settings management
Microsoft 365 admin center admin.microsoft.com Licenses, service health, Message center announcements

Read the Message center every week

Microsoft announces Intune retirements and behavior changes in the Microsoft 365 Message center, and the Intune admin center shows the same messages under Tenant administration > Tenant status. Most nasty surprises were announced months ahead.

Inheriting an existing tenant? Check these in your first week

When you take over a tenant someone else built, assume nothing. This list finds the problems that cause outages or security gaps.

Check Where to look Why it matters
Who holds admin rights Tenant administration > Roles > Monitor > Admin permissions, plus Entra role assignments Standing Global Administrator and Intune Administrator accounts are the biggest risk in most tenants. See Admin roles and RBAC.
Apple certificate and token expiry Devices > Enrollment > Apple, and Tenant administration > Connectors and tokens An expired Apple MDM push certificate cuts off every Apple device. See Apple devices.
Who owns the Apple account behind the push certificate Apple Push Certificates Portal You must renew with the same Apple account. If the person who created it has left, sort out access now.
Connector health Tenant administration > Connectors and tokens Certificate connectors, the Defender for Endpoint connector, Managed Google Play and others fail quietly.
Compliance default Endpoint security > Device compliance > Compliance policy settings If devices without a policy count as compliant, Conditional Access has a hole. See Compliance policies.
Conditional Access exclusions Entra admin center > Conditional Access Look for break-glass exclusions (should exist), large exclusion groups (should not), and policies stuck in report-only.
Enrollment restrictions Devices > Enrollment > platform tab Are personal devices allowed to enroll? Is the device limit sensible? See Enrollment restrictions.
Device cleanup rules Devices > Organize devices > Device cleanup rules Without them, reports fill with devices that haven't been seen in a year.
Multi Admin Approval Tenant administration > Multi Admin Approval Protects against a single compromised account wiping your fleet.
Recent changes Tenant administration > Audit logs Shows what changed recently and who changed it.
Policy sprawl Devices > Manage devices > Configuration Look for duplicate, unassigned and conflicting profiles. Conflicts show up per device and per setting.
Failing apps Apps > Monitor > App install status Persistent install failures usually point to a broken package or detection rule.
Backups of configuration Wherever the previous admin kept them If there are none, export your configuration before you change anything. See Change management.

Don't fix everything on day one

Write down what you find first. Changing a widely assigned policy in an unfamiliar tenant is how outages start. Use the change management process even for "obvious" fixes.

Suggested reading order

  1. Intune fundamentals, to build the mental model
  2. Tenant setup checklist, to confirm the foundations
  3. Choosing an enrollment method, for each platform you support
  4. Targeting: groups and filters, before you assign anything at scale
  5. Compliance policies and Conditional Access, to turn management into protection
  6. Operations overview, for the recurring work that keeps a tenant healthy