Docs

Appearance

Intune Daily Management Guide ​

Overview ​

Day-to-day Intune operations — enrolling devices, checking compliance, pushing apps and policies, and handling common device issues. All Intune admin work happens in the Intune Admin Center at https://intune.microsoft.com with your @ciriusgroup.com admin account.

For specific investigation procedures see the related runbooks:

What We Manage With Intune ​

Device TypeEnrollmentPolicy
Corporate Windows laptopsMDM (full enrollment via Autopilot or manual)Compliance + configuration policies
Corporate Windows serversNOT in Intune — managed via GPO + Azure Policy—
Personal phones (staff)MAM-only (no device enrollment)App protection policies via MAM
BYOD laptops (contractors)MDM + device certificateCompliance policy, stricter than corporate

Cloud PCs and Azure VMs are not in Intune. Intune scope is physical and contractor endpoints only.

Enrolling a New Device ​

Windows — Autopilot (Preferred) ​

Autopilot lets a new device enroll and configure itself without IT touching it.

Prerequisites:

  • Device hardware hash registered in Autopilot (done by the vendor if ordered through Microsoft 365 Business hardware program, or manually via PowerShell)
  • User has an Intune license (included in M365 Business Premium)

User experience:

  1. Power on the device → Windows Out-of-Box Experience (OOBE)
  2. Connect to Wi-Fi
  3. Sign in with @ciriusgroup.com account
  4. Autopilot detects the device → applies the deployment profile → enrolls in Intune automatically → installs required apps → joins Entra ID
  5. User lands at a configured desktop — IT never needs to touch the device

Check enrollment in Intune: Intune Admin Center → Devices → Windows → select device → verify Entra join type shows Microsoft Entra joined and Compliance shows Compliant.

Windows — Manual Enrollment ​

For devices not in Autopilot (existing hardware, rebuilds):

On the device:

  1. Settings → Accounts → Access work or school → Connect
  2. Enter @ciriusgroup.com account → follow prompts → select Join this device to Microsoft Entra ID
  3. Sign in → device joins Entra + enrolls in Intune simultaneously
  4. Compliance policies apply within ~30 minutes
  5. Required apps deploy within 1 hour

Verify enrollment: Intune Admin Center → Devices → All devices → search for device name.

Registering an Autopilot Hardware Hash ​

For a device not automatically registered:

powershell
# Run on the device being registered (requires admin rights)
Install-Script Get-WindowsAutoPilotInfo -Force
Get-WindowsAutoPilotInfo -OutputFile AutopilotHWID.csv

# Upload the CSV in Intune Admin Center:
# Devices → Windows → Windows enrollment → Devices → Import

Checking Device Compliance ​

Single Device ​

Intune Admin Center → Devices → All devices → search → click device:

  • Overview tab shows compliance state and last check-in time
  • Device compliance tab shows each policy and which specific setting failed (if any)

All Non-Compliant Devices ​

Intune Admin Center → Devices → Monitor → Device compliance

Filter to NonCompliant to see all devices currently failing compliance. This view is useful for weekly hygiene checks.

Compliance Policies in Use ​

PolicyApplies ToKey Requirements
Windows Corporate ComplianceCorporate Windows devicesBitLocker, OS patch level <14 days, Defender active, Secure Boot, TPM 2.0
Windows Contractor ComplianceContractor BYODSame as corporate + stricter password policy
iOS/Android MAMPersonal phonesApp protection only — no device compliance check

For details on what each setting requires and how to investigate failures see Non-Compliance Investigation.

Pushing Apps to Devices ​

Required vs Available Apps ​

  • Required — installs automatically on all devices in the assigned group. User cannot remove it.
  • Available — appears in Company Portal; user installs on demand.
  • Uninstall — removes the app from assigned devices.

Adding a New App ​

Intune Admin Center → Apps → All apps → Add

App TypeWhen to Use
Microsoft Store appModern/UWP apps from the store
Windows app (Win32)Traditional .exe/.msi installers
Microsoft 365 AppsOffice suite deployment
Web appShortcut/bookmark pushed as an app

For a Win32 app (most common for corporate software):

  1. Package the installer as a .intunewin file using the Microsoft Win32 Content Prep Tool
  2. App type: Windows app (Win32)
  3. Upload the .intunewin file
  4. Set install/uninstall commands (e.g., setup.exe /quiet /norestart)
  5. Set detection rules (registry key or file existence that confirms install succeeded)
  6. Assign to the appropriate device group (Required or Available)

Checking App Deployment Status ​

Intune Admin Center → Apps → All apps → select app → Device install status

Shows each device's install state: installed, failed, pending, not applicable.

For a failed install: click the device row → see the error code. Common error codes:

  • 0x80004005 — general failure; check the install command syntax
  • 0x87D1041C — app is already installed; check the detection rule

Configuration Profiles ​

Configuration profiles push Windows settings without requiring Group Policy. Used for things GPO doesn't reach (Entra-joined devices, Azure AD joined only).

Intune Admin Center → Devices → Windows → Configuration profiles

Current profiles in use:

ProfileWhat It Configures
Windows Security BaselineHardened security settings aligned to Microsoft security baseline
BitLocker EncryptionEnforces BitLocker with recovery key escrow to Entra
Defender AntivirusReal-time protection settings, exclusions
Windows UpdateDeferral windows, maintenance schedule, forced restart timing
USB BlockRemovable storage restriction (see USB Storage Block)

Adding a New Configuration Profile ​

  1. Intune Admin Center → Devices → Windows → Configuration profiles → Create → New policy
  2. Profile type: Settings catalog (preferred — searchable settings) or Templates (legacy)
  3. Search for the setting you want to configure
  4. Assign to a device group
  5. Changes deploy within ~8 hours or on next device check-in

Device Actions ​

From any device's detail page in Intune, the ... menu or top action bar gives direct actions:

ActionWhen to Use
SyncForce immediate policy check-in (don't wait 8 hours)
RestartRemote restart — useful after policy application
RetireRemove corporate data from device, un-enroll from Intune. Use on offboarding.
WipeFactory reset. Use only if device is lost/stolen and Retire doesn't work.
Collect diagnosticsDownload Intune logs from device for troubleshooting
Rotate BitLocker keysForce new recovery key if old one may be compromised

Retire vs Wipe:

  • Retire = selective wipe. Removes corporate apps, configuration, and data. Personal data stays. Use for offboarding or when an employee leaves.
  • Wipe = factory reset. Everything gone. Use only for lost/stolen devices where you want to ensure total data removal.

Groups and Assignments ​

Intune uses Entra security groups for targeting. Policies and apps are assigned to groups, not individual devices.

Current Device Groups ​

GroupMembersUsed For
IntuneManaged-CorporateAll corporate Windows devicesCore compliance and config policies
IntuneManaged-ContractorContractor BYOD devicesStricter compliance policy
IntuneManaged-AllUnion of aboveApp assignments targeting everyone

Groups are dynamic in Entra — membership is based on device attributes set during enrollment (e.g., deviceOwnership eq Corporate).

Adding a Device to a Different Group ​

If a device is in the wrong group (wrong compliance policy applying):

  1. Entra Admin Center → Groups → select group → Members
  2. Add or remove the device object
  3. Intune picks up the group change within ~15 minutes

Common Issues ​

Device Shows "Not Evaluated" Compliance ​

The device enrolled recently but the compliance policy hasn't run yet. Wait 30 minutes and sync the device (Intune → device → Sync). If still not evaluated after 1 hour, check that the compliance policy is assigned to a group the device is in.

App Won't Install (Stuck "Pending") ​

  1. Intune → app → Device install status → click the failing device
  2. Check the error code
  3. Force a sync: Intune → device → Sync
  4. If still pending: Collect diagnostics and look in the AgentExecutor.log and IntuneManagementExtension.log for the actual failure reason

Device Enrolled But Policies Not Applying ​

Intune policies push over the Intune Management Extension (IME). Verify IME is running:

On the device:

powershell
Get-Service -Name IntuneManagementExtension
# Should be Running; if not:
Start-Service -Name IntuneManagementExtension

Log location on device: C:\ProgramData\Microsoft\IntuneManagementExtension\Logs\

User Can't Access Resources (Conditional Access Blocking) ​

The Conditional Access policy Require compliant device blocks non-compliant devices from M365 resources. If a user is blocked:

  1. Intune → find their device → check compliance state
  2. Fix the compliance failure (see Non-Compliance Investigation)
  3. Sync the device to pick up the fix immediately
  4. Compliance status updates to Entra within ~15 minutes of the device reporting compliant

Weekly Hygiene Tasks ​

Review these weekly to keep Intune clean:

  • Non-compliant devices — Intune → Monitor → Device compliance → filter NonCompliant. Any device non-compliant for >48 hours without an open investigation ticket needs attention.
  • Stale devices — see Orphaned Devices Runbook. Devices not checking in for >30 days should be reviewed and retired.
  • Failed app deployments — Intune → Apps → select an app → Device install status → filter Failed. Persistent failures on a device usually indicate a software conflict.

Document History ​

DateChangeAuthor
May 2026Initial draft — enrollment (Autopilot + manual), compliance checking, app deployment, configuration profiles, device actions, group assignments, troubleshooting, weekly hygiene.Rory

Internal use only — Cirius Group