Intune fundamentals¶

Intune is Microsoft's cloud service for managing devices and apps. It sits on top of Microsoft Entra ID, which supplies the users, groups and device identities, and it exposes everything through Microsoft Graph. Most confusion with Intune comes from not knowing which of those three systems is responsible for a behavior. This page explains the moving parts.

What Intune manages¶

Intune also covers specialty devices such as visionOS and tvOS, AR/VR headsets and Teams Rooms devices. Check supported operating systems before you commit to a minimum OS version.

How the pieces fit together¶

flowchart LR
    A[Admin in Intune admin center] -->|Microsoft Graph| I[Intune service]
    S[Scripts and automation] -->|Microsoft Graph| I
    I <-->|identity, groups,<br/>device objects| E[Microsoft Entra ID]
    I -->|"wake-up notification<br/>(WNS, APNs, Google)"| D[Managed device]
    D -->|check-in: pulls policies,<br/>apps and actions| I
    D -->|reports state| I
    I -->|compliance state| E
    E -->|Conditional Access<br/>at sign-in| R[Microsoft 365 and other apps]
    M[Defender for Endpoint] -->|device risk| I

Three things in this diagram explain most day-to-day behavior:

1. Devices pull, Intune nudges. Intune never pushes settings directly. It sends a wake-up notification through the platform push service, and the device checks in to collect what's pending. If the device is offline or can't reach the push service, nothing happens until its next scheduled check-in.
2. Entra ID owns identity and groups. Assignments target Entra groups, so group membership changes (especially dynamic groups) must process before Intune can act on them.
3. Compliance flows back to Entra ID. Intune calculates whether a device is compliant and writes that to the device object in Entra ID. Conditional Access reads it at sign-in. Intune doesn't block anything by itself.

Management models¶

You can and often should combine them. App protection policies can target enrolled and unenrolled devices separately by using filters.

Device identity on Windows¶

A Windows device can be in one of three Entra states. This decides how it enrolls and which features work.

Check a device's state with dsregcmd /status on the device. See Other Windows enrollment for moving away from hybrid join.

Ownership: corporate or personal¶

Every enrolled device is marked Corporate or Personal. Ownership changes what admins can see and do. For example, on personal devices Intune shows only part of the phone number, doesn't inventory apps the user installed personally, and limits some wipe options.

Ownership is set by the enrollment method. Automated Device Enrollment, Autopilot, Android Enterprise corporate methods and device enrollment managers produce corporate devices. Users enrolling through Company Portal produce personal devices, unless the device matches a corporate identifier. An admin can change ownership on the device record later.

How policy reaches a device¶

Devices check in on three kinds of triggers:

• Change-based: when you assign, change or remove a policy, app or group membership, Intune notifies online devices. Delivery ranges from immediate to a few hours.
• Scheduled: maintenance check-ins run about every 8 hours, and Intune allows only one maintenance sync every 6.5 hours. Newly enrolled devices check in much more often for the first hours.
• Manual: an admin runs Sync on the device, or the user syncs from Company Portal.

The Windows Intune Management Extension runs its own schedule for Win32 apps (hourly) and scripts. See Timings and limits for the full table.

What kind of policy do I need?¶

Assignments in one minute¶

• You assign policies and apps to Entra groups of users or devices. You can also use the virtual groups All users and All devices.
• Include and exclude groups let you carve out exceptions. Don't mix user groups and device groups across include and exclude on the same assignment. The results are hard to predict.
• Assignment filters narrow an assignment by device properties (OS version, model, ownership, enrollment profile and more) at check-in time.
• Apps also have an intent: Required installs automatically, Available shows in Company Portal, Uninstall removes it.

The Targeting guide covers this in depth, including how to avoid slow dynamic groups.

When policies conflict¶

Map of the Intune admin center¶

The admin center reorganized its Devices node in 2024 and 2025. Today the important areas are:

Learn more¶

• What is Microsoft Intune?
• Policy refresh intervals
• Microsoft Intune planning guide