Skip to content

Tenant setup checklist

Use this checklist for a new tenant, or to audit one you inherited. The phases are ordered so that each one builds on the last. You can tick the boxes while you read, but ticks aren't saved, so copy the list into your change tracker if you need a record.

Before you start

Create two break-glass (emergency access) accounts first: cloud-only, excluded from Conditional Access, protected with phishing-resistant credentials such as FIDO2 keys, and monitored for every sign-in. Everything else in this list assumes they exist.

Phase 1: Identity and licensing foundations

  • Licenses assigned. Every user who enrolls a device or uses protected apps needs an Intune license, and Conditional Access needs Microsoft Entra ID P1 or higher. See Licensing.
  • MDM authority shows Microsoft Intune. Check Tenant administration > Tenant status. New tenants are set automatically.
  • Automatic enrollment scope set. Under Devices > Enrollment > Windows > Automatic Enrollment (the Entra Mobility (MDM and MAM) setting), set the MDM user scope to Some (a pilot group) or All. Windows devices only auto-enroll for users in scope.
  • Entra device settings reviewed. In the Entra admin center under Devices > Device settings: who can join devices, the maximum devices per user, whether the registering user becomes a local administrator (usually None or Selected), and Enable Microsoft Entra LAPS set to Yes.

  • DNS records added for each domain users enroll with:

    Type Host Points to
    CNAME EnterpriseEnrollment.contoso.com EnterpriseEnrollment-s.manage.microsoft.com
    CNAME EnterpriseRegistration.contoso.com EnterpriseRegistration.windows.net

    These let Windows find Intune when a user enrolls with their email address.

  • Admin roles designed. Daily work uses Intune roles, not Global Administrator. Privileged roles are eligible through PIM, not permanent. See Admin roles and RBAC.

  • Group naming convention agreed. For example INT-DEV-WIN-Pilot, INT-USR-MacUsers. Consistent names make assignments readable years later.

Phase 2: Platform connections

Set up only the platforms you support, but set them up before users start enrolling.

  • Apple MDM push certificate created with a shared, IT-owned Apple account (not a person's account) under Devices > Enrollment > Apple > Apple MDM Push Certificate. Record who owns the account and the expiry date.
  • Automated Device Enrollment token from Apple Business or Apple School Manager added under Devices > Enrollment > Apple > Enrollment program tokens, with a default enrollment profile.
  • Apps and Books (VPP) location token added under Tenant administration > Connectors and tokens > Apple VPP tokens.
  • Managed Google Play connected under Devices > Enrollment > Android > Managed Google Play, using an IT-owned account.
  • Microsoft Defender for Endpoint connector turned on (Endpoint security > Microsoft Defender for Endpoint) if you use Defender. See Endpoint security.
  • Certificate infrastructure chosen: Microsoft Cloud PKI, or the Certificate Connector for Microsoft Intune for your own CA. See Certificates and network.
  • Intune Connector for Active Directory (version 6.2501.2000.5 or later) installed only if you must deploy hybrid joined devices through Autopilot.

Phase 3: Tenant-wide defaults

  • Compliance policy settings: under Endpoint security > Device compliance > Compliance policy settings, set Mark devices with no compliance policy assigned as to Not compliant. Keep the validity period at 30 days unless you have a reason to change it.
  • Enrollment restrictions: block platforms you don't support, decide whether personal devices may enroll, and set a device limit. See Enrollment restrictions.
  • Windows Hello for Business tenant policy (Devices > Enrollment > Windows > Windows Hello for Business): decide deliberately. Many organizations set it to Not configured and manage Windows Hello with targeted policies instead. See Passwordless sign-in.
  • Default Enrollment Status Page reviewed so it doesn't block every device for every app. See Windows Autopilot.
  • Company Portal branding set under Tenant administration > Customization: company name, IT contact details, support website and privacy statement link. Users trust enrollment more when it looks official.
  • Device categories created if you want users to pick a department at enrollment (Devices > Organize devices > Device categories).
  • Device cleanup rules created per platform (30 to 270 days). See Device actions and lifecycle.
  • Multi Admin Approval protecting at least wipe, retire and delete actions, scripts and RBAC changes. See Admin roles and RBAC.
  • Diagnostic settings sending Intune audit and operational logs to a Log Analytics workspace (Reports > Diagnostic settings), so you keep history beyond the portal views.

Phase 4: First policies

Build these in report-only or pilot mode first, then widen. The Change management guide describes the rollout rings.

  • Compliance policies for every platform you allow, with a sensible grace period. See Compliance policies.
  • Conditional Access: require a compliant device (or app protection on mobile) for Microsoft 365, starting in report-only mode. See Conditional Access.
  • Disk encryption: BitLocker on Windows, FileVault on macOS, with keys escrowed. See Disk encryption.
  • Windows LAPS for the local administrator account. See Windows LAPS.
  • Defender for Endpoint onboarding, antivirus, firewall and attack surface reduction policies. See Endpoint security.
  • Update management: Windows update rings and feature update policies (or Autopatch groups), and DDM software update policies for Apple devices. See Windows updates.
  • App protection policies for iOS and Android, at least for Outlook, Teams, Edge and the Office apps. See App protection.
  • Core apps: Company Portal, Microsoft 365 Apps, Microsoft Edge, Microsoft Authenticator, and your must-have line-of-business apps. See App management.

Phase 5: Ready to operate

  • Rollout groups exist for each platform: IT pilot, early adopters, broad. See Targeting.
  • Renewal dates in a shared calendar: Apple push certificate, ADE tokens, VPP tokens, and any certificates you manage. See the admin calendar.
  • Configuration backed up and stored in version control. See Change management.
  • Help desk runbooks written for enrollment failures, noncompliance and lost devices. See the troubleshooting playbook.
  • Reporting agreed: which dashboards you check daily and weekly. See Reporting and monitoring.

Done?

You now have a tenant that is safe to enroll devices into. Next, pick enrollment methods per platform in Choosing an enrollment method.