Microsoft Intune is a cloud-based management service that enables organisations to manage devices, applications, and security policies centrally. Intune is not dependent on on-premises servers, configuration data and policy definitions reside in the cloud and managed endpoints communicate via the internet.
What does Intune manage?
Intune employs two complementary approaches:
MDM (Mobile device management) enforces policies and settings on devices. This allows administrators to manage device configuration, operating system updates, security settings, and inventory.
Mobile app management (MAM) is concerned with the security of corporate data within apps, not with managing the device itself. Even devices that aren't enrolled still have MAM policies applied, so it's a good solution for BYOD scenarios.
Many organisations use a combination of MDM and MAM, for example, a corporate-owned phone may be fully enrolled with MDM, while an employee's personal tablet only receives app protection policies.
How does the Intune architecture function?
Intune runs in the Microsoft 365 cloud and connects to other services such as Microsoft Entra ID (for identity and device registration) and the Microsoft Intune admin center (for configuration). Devices communicate with Intune over secure HTTPS channels. When a device is enrolled, it registers itself and gets a management profile that establishes a trust relationship.
These policies and configurations are created in the admin center, assigned to user or device groups in Entra ID and then delivered to the appropriate endpoints. Intune monitors compliance status, reports inventory data and can execute remote actions like wipe or lock.
The diagram below shows how Microsoft Intune and Microsoft Entra ID work together to deliver policies from the cloud to managed devices.
Diagram of Microsoft Intune and Microsoft Entra ID pushing policies from the cloud to managed devices.
Job Duties and Responsibilities
Admins work with the Microsoft Intune admin center. Typical roles include:
Global administrator – full access to all Intune and Azure AD settings
Intune administrator – manages policies, apps, and devices but cannot view billing or user licenses.
Device compliance administrator—responsible for creating and tracking compliance policies.
Role based access control (RBAC) allows you to limit permissions so that each administrator only sees what is relevant to their job. For example, help desk staff might have rights to wipe lost devices without seeing user licensing details.
How is Intune important
With the increasing prevalence of working from home and managing multiple devices, consolidating management into a cloud service reduces complexity and cost. Intune's integration into the broader Microsoft 365 ecosystem means you can enforce security, deploy apps, and monitor health across Windows, macOS, iOS/iPadOS, and Android without a VPN or on-premises infrastructure.
At the end of this unit, you should be able to describe the basic components of Intune, the difference between MDM and MAM, and who does what in the service.
Conclusion
Microsoft Intune offers organisations a modern, cloud-based approach to central management of devices, applications and security policies. It integrates Mobile Device Management (MDM) and Mobile Application Management (MAM) to allow companies to secure corporate and personal devices and protect corporate data. Integration with Microsoft Entra ID allows administrators to apply policies, monitor compliance, deploy applications, and perform remote management tasks across Windows, macOS, iOS/iPadOS, and Android devices. Role-based access control (RBAC) allows organizations to delegate administrative duties securely and efficiently. Microsoft Intune makes endpoint management easier in general, security more robust and supports today's flexible and remote working environments.