Mobile Device Management Microsoft Intune: How It Works

Your bookkeeper checks work email from her personal phone at home. A driver loses a company phone on a job site. A new hire signs in to Teams on a laptop that's months behind on updates. If you can't say who has which device, whether it's encrypted or how you'd wipe it, you've got a problem that mobile device management, Microsoft Intune is built to solve.

Most firms don't need the same control on every device. The useful decision is matching full management, app protection and access rules to who owns the device and how sensitive the data is. Get that choice wrong and you'll either intrude on staff privacy or leave company data exposed.

What Microsoft Intune Manages and Why It Matters

Microsoft Intune is Microsoft's cloud-based service for managing company and personal devices. You run it from the Microsoft Intune admin centre, connected to Microsoft Entra ID for identity and to Microsoft 365 for apps and sign-in. It manages Windows, macOS, iOS and Android from one console.

A building's badge system controls who is allowed entry, which doors open for each individual, and the response when a badge is lost. Enrolment issues the badge, policies determine the doors, and remote actions revoke access quickly.

Eight capabilities that cover most SMB needs

That inventory view matters because you can't secure devices you can't list. Good reporting ties straight into disciplined asset inventory management practices, so every endpoint has an owner and a status.

The Canadian gap is clear. The Statistics Canada analysis of cybersecurity risks to Canadian businesses found that in 2019, 37% of Canadian businesses reported using Internet-connected smart devices, yet only 17% of those businesses assessed the security of those devices. It also found 65% of businesses did not install security updates for software and operating systems monthly or more frequently.

Practical rule: Scan the table and mark the two or three capabilities your business needs first. Start there instead of turning everything on at once.

Choosing Between Full Management and App Protection

Full management (MDM) controls the whole device. App protection (MAM) controls only company data inside approved apps. That single distinction should drive most of your policy choices.

Match the model to the scenario

Users won't close the gap on their own. Statistics Canada's 2018 mobile-device behaviour findings reported that 74% of Canadian Internet users took at least some action to protect their mobile device, but only about 16% used additional cybersecurity measures beyond the device's default protections. Central policy turns uneven habits into a consistent standard.

Say a dental clinic has two hygienists who use personal phones for email. App protection lets them read work email in Outlook, blocks copy and paste to personal apps, and allows a selective wipe of company data when they leave. The clinic never sees their photos or messages.

A logistics firm issuing corporate phones to drivers faces a different risk. The company owns the device, drivers install route apps, and phones go missing in transit. Full MDM is justified there.

I would match the model to who owns the device and how sensitive the data is, not to the phone brand. Give staff a short written explanation of what you can and can't see on personal devices before you enrol anyone.

Licences You Need for Intune in Canada

The main confusion is bundling. Intune often comes inside Microsoft 365 plans, but Intune Suite features and standalone Entra ID tiers are separate add-ons. Conditional Access needs Entra ID P1 or P2, so a plan can include device management yet still lack the access control you planned around.

Check before you budget

• Confirm current subscriptions: Check what you already own in the Microsoft 365 admin centre, including any duplicate or unused seats.
• Count users, not devices: Intune Plan 1 is licensed per user, so one person with a laptop and a phone uses one licence.
• Separate BYOD needs: Decide whether personal devices need only app protection before buying broader coverage.
• Challenge add-ons: Identify which extras, such as advanced analytics or remote help, you'll use in the first year.

Prices in Canadian dollars vary by agreement and change over time, so confirm current rates with a Microsoft partner or provider before budgeting. Our guide to Office 365 licensing choices walks through the common traps.

Check licences before writing policies. A missing Entra ID tier can block the access controls your whole design depends on.

Planning Deployment and Data Residency in Canada

Your first deployment decision isn't a device setting. It's where the tenant lives.

Microsoft's Intune data storage and processing documentation states that tenant geography is determined primarily by the country or region selected when the Microsoft Entra directory is created, and Intune hosts Customer Data at rest in the geography aligned with that setting. Eligible customers may request migration, but the move can take up to 24 months after the request period ends.

Seven steps before enrolment

1. Confirm the Entra directory country or region. This setting drives where Intune data at rest sits, so verify it before devices join.
2. List your data types and rules. Map PIPEDA, provincial privacy laws and sector contracts to the data each device can reach, using our overview of Canadian data privacy laws for businesses as a starting point.
3. Assess data beyond data at rest. Residency doesn't mean every operation stays in Canada, so review data in transit, support data, diagnostics, identity data and integrations such as Microsoft Defender and Microsoft Graph separately.
4. Assign admin roles clearly. We typically get admin access to endpoint management, security tools and infrastructure monitoring, while ERP, CRM and line-of-business systems stay with your team unless explicitly delegated. All access is documented, audited and reviewed quarterly.
5. Build a pilot group. Start with a small cross-department group, for example 10 to 20 devices, so problems surface before a full rollout.
6. Write the privacy notice. Explain what's collected from BYOD devices and collect consent before enrolment, not after complaints start.
7. Set a go-live date. Tell staff exactly what changes on their devices and who to contact when something breaks.

Enrol first and check geography later, and you can lock yourself into a long migration.

Say a clinic enrols every phone in its first month, then discovers during a privacy review that its directory sits in the wrong region for a contract requirement. The devices keep working, but correcting the tenant becomes a slow, disruptive project. A ten-minute check at the start prevents it.

How Enrolment and Conditional Access Work Together

A device doesn't get access just because it's enrolled. Intune reports a state, and Microsoft Entra ID decides. Confusing those two jobs causes most rollout surprises.

The sequence from sign-in to decision

1. The user signs in and the device enrols. Intune installs the management certificate that lets it apply policies.
2. Intune applies assigned policies. Configuration profiles set up the device, and compliance policies define the minimum acceptable state.
3. The device checks in. It reports its inventory and compliance status to Intune.
4. Intune forwards that status to Entra ID. The compliance result becomes a signal Entra can use at sign-in.
5. Conditional Access evaluates the request. It weighs the user, app, location and endpoint-security signals together.
6. Access is allowed only if requirements are met. Intune's separate noncompliance actions, such as notifications or retirement, run on their own schedule.

Microsoft's Intune device management documentation describes this flow, noting that if a policy requires a device to be marked compliant, access is allowed only when the compliance requirement is satisfied.

Use this analogy with staff. Compliance is the health check. Conditional Access is the door staff who reads the result and decides whether to let the device in. Passing enrolment alone doesn't open the door.

Conditional Access can also require multi-factor authentication during enrolment. It's a one-time step, and it needs Entra ID P1 or P2, so confirm licensing before you promise it to leadership. Strong identity design underpins the whole chain, as covered in our guide to identity and access management essentials.

Run two checks when access fails. First, confirm the device's compliance state in the admin centre. Second, review the Entra sign-in logs, which show the policy and reason behind each block.

Security Controls and the Rollout Order

A compliance policy sets the minimum device state, but access doesn't change until a matching Conditional Access policy exists. Plan the two together or you'll build checks that don't protect anything.

A defensible baseline

• Encryption at rest: Protects data on a lost or stolen device.
• Automatic screen lock: Limits exposure when a phone is left unattended.
• Required passcode: Sets a minimum bar every user must meet.
• Block rooted or jailbroken devices: Excludes devices whose OS protections have been bypassed.
• Wipe after repeated failed sign-ins: Slows guessing attacks on a missing device.
• Remote lock and wipe: Gives you a response when a device disappears.
• Mobile threat defence: Feeds threat signals into compliance decisions.

That list follows the Government of Canada's Microsoft 365 security playbook, as summarised in Microsoft's overview of what Intune is, which recommends centrally managed mobile endpoints with those controls. Our own endpoint security best practices guide covers how they fit with wider endpoint protection.

Intune enforces only what your approved policy says. Sign off a short document set first, including an Acceptable Use Policy, MFA & Password Policy, Device Policy, Remote/Hybrid Work Policy, Incident Response Plan, Disaster Recovery Plan and a Data Governance Framework based on Canadian standards. The same discipline helps when you audit access across app release pipelines, because documented ownership makes exceptions visible.

Roll out without mass lockouts

1. Pilot compliance signals with a small group, for example five to ten users, long enough to catch false positives.
2. Apply Conditional Access in report-only mode so you can see who would be blocked without blocking them.
3. Review and fix every exception, from outdated operating systems to shared tablets that need a different rule.
4. Enforce access only when the exception list is empty.

Say a 40-person accounting firm pilots with five users for two weeks, finds two partners on unsupported operating systems, and fixes them before enforcement. Tax season access stays intact. Skip the pilot and that discovery happens at a client deadline instead.

Common Enrolment and Compliance Problems and Fixes

Most failures follow a pattern. The cause is usually the compliance state, a licence gap or a policy scope, not a broken device. Start with those three before you rebuild anything.

The network-location trap

Microsoft's Conditional Access integration documentation for Intune states that the compliant-network-location condition is supported only for devices enrolled in mobile-device management. Apply that condition too early and unenrolled devices fail the check and get blocked.

Say a home care agency adds a location rule midway through rollout. Field staff who haven't enrolled yet lose access to Microsoft 365 between visits. The fix is either an exclusion for unenrolled users or an enrolment-first rollout where devices join before the rule applies.

A sync or OS update often clears a single case, while a policy change needs a full evaluation cycle before the result shows in reports. Don't judge a fix in the first few minutes.

Test every new condition in report-only mode before enforcing it. That one habit prevents most enrolment-day outages.

Confirm Your Intune Baseline Before the Next Rollout

Intune drifts if nobody reviews it. New operating systems ship, staff change roles, and exceptions accumulate. A fixed monitoring rhythm keeps the baseline honest.

Review non-compliant devices weekly. Check failed policy installs and blocked sign-ins monthly. Review admin roles and test selective wipe quarterly, then reassess the full baseline once a year against new OS versions.

Baseline checklist

• Confirm full coverage: The compliance report includes every enrolled device, with no silent gaps.
• Check blocked sign-ins: Sign-in logs show who's being stopped and why.
• Test selective wipe: Run it on one BYOD test device and confirm personal content survives.
• Verify update rings: Pilot and production rings apply as intended.
• Confirm offboarding works: When an employee departs, credentials are revoked and access is disabled on the day of departure, and the device is securely wiped and prepared for redeployment, with files kept under your retention policy.

Before your next step, gather device types and counts, current licences, the Entra directory region, your policy documents and a list of BYOD roles. A baseline review assesses your existing stack and integrates tools that already work, such as Microsoft 365, which most of our clients run, while standardising security-critical components. Book that review with CloudOrbis before your next device rollout, not after the first lockout.

CloudOrbis helps Canadian small and mid-sized businesses design, deploy and operate Microsoft Intune with the right mix of full management, app protection and Conditional Access for each role. Book a baseline review before your next rollout and we'll confirm your licences, tenant region, policies and pilot plan so enrolment doesn't disrupt your team. Visit CloudOrbis Inc. to get started.