A new hire starts Monday. Someone spends Friday afternoon setting up a laptop by hand: user account, email, the five apps, the printer, the Wi-Fi password, and a reminder to turn on disk encryption that never happens. Six months later the laptop is left in a rental car, and nobody is sure what was on it or whether it was encrypted. Device management, often called MDM, is the fix for both halves of that story.

What it is

Device management is a service that every company laptop, desktop, phone and tablet is enrolled in. Microsoft Intune is the common one for Windows and Android. Apple devices enroll through Apple's own business program. Since April 2026 that program has been Apple Business, a single service Apple launched to replace Apple Business Manager, Apple Business Essentials and Apple Business Connect. Once a device is enrolled, settings, apps and updates are applied to it from one place, and it reports back on its state.

When a device enrolls in Intune it is also registered in Microsoft Entra ID, the directory behind Microsoft 365 sign-ins, and its compliance status is reported there. From then on it checks in with Intune, picks up policy changes and reports whether it meets your rules, for example on operating system version or encryption.

Two kinds of policy do the work. Configuration policies set things, such as encryption, screen lock and the firewall. Compliance policies check things and give each device a verdict, compliant or not compliant, that other systems can act on.

How a device gets enrolled

For company-owned Windows PCs, the route is Windows Autopilot. The PC's hardware hash, a unique fingerprint of its components, is registered with Microsoft and tied to your organization, ideally by the manufacturer, reseller or distributor you bought it from. The person unboxes it, connects to a network and signs in with their work account, and Windows joins Microsoft Entra ID, enrolls in Intune and applies your settings and apps. Automatic enrollment needs a subscription such as Microsoft 365 Business Premium, or Microsoft Entra ID P1 or P2 plus Intune. Microsoft's list of supported editions includes Windows 11 Pro, Enterprise and Education but not Home, so check the edition before you buy.

For company-owned Apple devices, the route is Automated Device Enrollment. You link your Apple Customer Number, or your reseller's or carrier's Reseller Number, to Apple Business and give resellers your Organization ID, and purchases then appear there by serial number; Apple notes that this does not happen automatically, so ask each reseller to submit your orders. You assign the devices to Intune or to the management built into Apple Business, and they enroll as soon as they are activated. iPhones, iPads and Macs enrolled this way are supervised automatically, which gives you more control, and you can stop users removing the enrollment.

Devices you already own can join too. The Autopilot profile setting Convert all targeted devices to Autopilot registers existing company-owned PCs in the groups you assign it to, and Microsoft says to allow 48 hours. Apple Configurator can add an iPhone, iPad or Mac bought elsewhere, but it erases the device, Macs need Apple silicon or a T2 Security Chip, and the person who receives the device then has 30 days in which they can release it from management.

Personal phones are handled more lightly. Apple's User Enrollment, designed for devices the employee owns, lets IT manage the organization's accounts, settings and information, never the user's personal account. On a personal Android phone, a work profile keeps work apps, marked with a briefcase badge, separate, and Microsoft's user guide says IT cannot reach the personal side or reset the phone. Microsoft's Business Premium guidance also allows a lighter route: leave personal phones unenrolled and protect only the work apps, covered below.

Setup without an IT visit

A new laptop or phone ships to the person. They sign in. It sets itself up: accounts, apps, security settings, printers. Day one is a working day.

One setting in the Windows Autopilot deployment profile deserves a deliberate choice. User account type can be Administrator or Standard, and Administrator adds the person to the laptop's local Administrators group. Microsoft calls running as a standard user the recommended and more secure way to use Windows, and a standard user who starts something that needs administrator rights is asked for an administrator's credentials. A separate Microsoft Entra device setting, Registering user is added as local administrator on the device during Microsoft Entra join, also controls whether the person who joins a device becomes its administrator, so check both.

Policies instead of reminders

Disk encryption, screen lock, passcode rules, firewall and the settings your cyber insurer asks about are applied to every device and reported on. Nobody has to remember, and nobody gets a special exception.

On Windows, Intune turns on BitLocker through an Endpoint security disk encryption policy. With Require Device Encryption enabled and Allow Warning For Other Disk Encryption disabled, it encrypts silently on PCs that meet Microsoft's prerequisites, such as a TPM and Secure Boot, and Allow Standard User Encryption covers staff who are not administrators. Microsoft warns that disabling that warning lets BitLocker proceed even where other encryption software is installed, so check for any first. The recovery key is backed up to Microsoft Entra ID, where an authorized administrator can show it from the device's Recovery keys page, and each viewing is logged.

On a Mac, FileVault encrypts the internal storage. A device management service can require FileVault to be turned on during Setup Assistant, before anyone starts using the Mac, and can hold the personal recovery key in escrow so that the key does not depend on the user keeping it.

Microsoft's starting point for small businesses on Microsoft 365 Business Premium is a Windows compliance policy that requires BitLocker, Secure Boot, code integrity, a firewall, a TPM, antivirus, antispyware and real-time protection. For other devices it suggests requiring a password to unlock the device and device encryption.

Why encryption is worth proving

Encryption changes what a lost laptop means. Idaho's breach-notification law, for example, defines a breach of the security of the system as the illegal acquisition of unencrypted computerized data that materially compromises the security, confidentiality or integrity of personal information (Idaho Code 28-51-104). The same section treats a resident's name combined with a Social Security number, a driver's license or Idaho ID card number, or a financial account or card number with its access code as personal information only when the name or those numbers are not encrypted. For practices covered by HIPAA, HHS guidance published in the Federal Register in April 2009 says the breach notification rules apply to unsecured health information, and that data at rest encrypted consistent with NIST SP 800-111 is secured as long as the key that could decrypt it has not been breached.

Those are questions for your attorney, and other states and industries have their own rules. Either way, you want to be able to show that the device was encrypted and that the key was not with it. Intune's Encryption report, under Devices, then Monitor, is where that evidence starts.

Updates on a schedule

Operating system and application updates roll out in rings, in a window you approve, so a bad patch hits two devices first, not forty. In Intune, a Windows update ring is a policy assigned to a group of devices, for example a pilot ring of two or three machines with no delay and a broad ring that waits a few days.

Quality updates can be deferred from 0 to 30 days and feature updates from 0 to 365. A deadline of 2 to 30 days forces installation, a grace period of 0 to 7 days sets the minimum time after the deadline before a forced restart, and active hours keep automatic restarts out of the working day.

If a patch misbehaves, a ring can be paused for up to 35 days, and Uninstall rolls back the latest feature or quality update and pauses that update type on the ring. A pause reaches each device only when it next checks in, so a machine that was switched off may still install the update first. Setting Option to pause Windows updates to Disable stops staff from pausing updates themselves.

Supervised Apple devices can defer updates for 1 to 90 days. You can also enforce a specific version by a set date and time, which each device reads in its own local time zone.

Apps where they belong

Microsoft 365 or Google Workspace, your line-of-business apps and the browser extensions you rely on, installed and kept current. Unwanted software blocked.

In Intune, an app assigned as Required installs on its own, while Available for enrolled devices puts it in the Company Portal app for people to install when they need it. Browser extensions are managed through browser policy. In Microsoft Edge, ExtensionInstallForcelist installs the listed extensions silently and users cannot remove them, and ExtensionInstallBlocklist set to an asterisk blocks every extension that is not explicitly allowed.

Lost or stolen devices and leavers

A lost phone is locked and located, then wiped if it does not come back. A leaver's device is wiped or returned the same day, with company data gone and personal data left alone.

The controls differ by platform, and it is worth knowing which ones you actually have:

  • Remote lock in Intune works on iPhones, iPads, Macs and company-owned Android devices, and only if a passcode is already set; a Mac lock sets a six-digit PIN you must record.
  • Windows PCs are not on Intune's Remote lock list, so for a lost Windows laptop, revoke the person's sessions and disable the device in Microsoft Entra ID, which stops it signing in and revokes the tokens stored on it.
  • Locate device works on Windows, on supervised iPhones and iPads in Lost Mode, and on company-owned Android devices where it is enabled, but Windows needs the Let Apps Access Location setting at Force allow before the device goes missing.
  • Wipe returns a device to factory settings, and for a stolen Windows laptop the option to keep wiping through power loss also overwrites free space, though Microsoft warns it can leave some devices unable to start.
  • Retire removes company apps, settings and email profiles and leaves personal data in place, which Microsoft calls ideal for personally owned devices.

Each of these actions reaches a device only when it is connected to the internet, and Microsoft points out that an offline device still has access to any data stored on it. That is why encryption has to be on before the laptop goes missing, not after.

For a leaver, the order matters. In the Microsoft Entra admin center, clear Account enabled and select Revoke sessions at the start of the exit meeting, since access tokens already issued last an hour by default, then wipe or retire their devices. Deregister a PC from Windows Autopilot when it leaves the organization for good. Release an Apple device from Apple Business when it is sold or cannot be repaired, but not while it is with Apple for repair, and turn off Activation Lock first, because Apple Business cannot manage it after release.

Bring your own device safely

Staff who use their own phone get company mail and apps in a managed container. The company part can be removed without touching their photos.

With Intune app protection policies, the container is the apps themselves. Outlook, Teams, Word and the other Microsoft 365 mobile apps can require a PIN, encrypt work data, and block saving copies of org data to personal storage or pasting it into personal apps, without enrolling the phone. A selective wipe removes the work data and leaves the rest of the phone alone. Each user needs an Intune license, and Android phones need the Company Portal app installed even though they are not enrolled.

Microsoft's Business Premium guidance suggests blocking iTunes and iCloud backups of org data, sending org data only to policy-managed apps, and allowing saved copies only in OneDrive and SharePoint. Personal devices protected this way are not enrolled in Intune, and a device platform restriction stops them enrolling by accident. Microsoft also recommends pairing app protection with Conditional Access, whose Require app protection policy control keeps work accounts out of apps that the policies do not cover.

Compliance you can show

A device that falls out of line, encryption off, update missing, no passcode, shows up on a board and is fixed or blocked from company data until it is. When an insurer or an auditor asks for proof, it is a report, not a promise.

Blocking is a separate step from reporting. A compliance policy marks a device noncompliant; Microsoft Entra Conditional Access, with the grant control Require device to be marked as compliant, is what keeps that device away from email and files. Microsoft's Business Premium guidance says compliance policies are not enforced until such a policy applies. Conditional Access needs Microsoft Entra ID P1 licenses, and Microsoft says Business Premium customers can also use it.

By default, a failing device is marked noncompliant immediately. You can add a grace period, an email to the user and, on phones and Macs, a remote lock after a set number of days, and Microsoft's Business Premium guidance suggests a one-day grace period.

The story from the top under management

The rental-car laptop: the owner calls the help desk, and within minutes the person's sessions are revoked and the laptop is locked out of company accounts and located. When it does not turn up, it is wiped. The record shows it was encrypted and what was on it, so the insurer gets a report rather than a guess. Monday's new hire, meanwhile, opened a box, signed in and started work. Nobody spent Friday afternoon on it, and nobody had to guess what was on the lost one.

What it is not

It is not spyware. Managed settings control company data and security on the device. On a personal phone with a managed container, the company sees the container, not the camera roll or the texts. A good provider will show you exactly what is and is not visible.

Microsoft publishes that list for Intune. On an enrolled device, your organization cannot see calling or browsing history, email and text messages, contacts, calendar, passwords, photos, or the content of documents people create. It can always see the owner, device name, serial number, model, manufacturer, operating system version and IMEI. On a personal device, the app list it sees is normally limited to managed work apps, the phone number shows only its last four digits, and the location is not visible.

It is also not a one-off project. Devices come and go, people join and leave, and the policies need a person who reviews what the board says each day.

Silence is one of the things to review. By default Intune treats a device that has not reported its compliance within 30 days as noncompliant, a window you can set from 1 to 120 days. A laptop that has gone quiet is in a drawer, broken or gone, and each of those needs a different action.

Who needs it

Any business with more than a handful of devices, anyone whose staff carry company data on phones, and anyone who has been asked a security question by an insurer or a customer. If your current answer to "is every laptop encrypted" is "I think so," that is the sign.

It also suits the business that has grown from five people to twenty and still sets laptops up by hand. The afternoon it takes to enroll the first ones is the last afternoon spent that way.

Check what you already pay for before buying anything. Microsoft 365 Business Premium, which Microsoft designs for organizations of up to 300 users, includes Microsoft Intune Plan 1. On Google Workspace, basic mobile management is on by default and covers screen lock enforcement and wiping the work account from a phone. Advanced management, which adds device approvals, full device wipe, iOS app management and Android work profiles, is not available on Business Starter or Business Standard.

How to check that it works

A console that says everything is compliant proves less than it seems. Run these checks yourself, or ask your provider to show you the results:

  • Compare the number of enrolled devices with your purchase records, because every gap is a device nobody manages.
  • Open the Encryption report in Intune and confirm every Windows laptop shows as encrypted.
  • Open the Recovery keys page for a few laptops, since Intune shows No BitLocker key found for this device when the key is not in Microsoft Entra ID.
  • From a personal computer that is not enrolled, try to open company email, which should be refused if you require compliant devices.
  • On a spare device, run the lost-device drill from lock or disable through locate and wipe, and time each step.
  • On a volunteer's phone, run an app selective wipe and confirm the work data is gone and the photos are not; the app has to be opened, and the wipe can take up to 30 minutes.
  • In the Windows Autopilot devices list, confirm a new laptop's profile status reads Assigned before it ships.

Common mistakes and how to spot them

These are the gaps worth looking for:

  • Compliance without enforcement. If a device marked noncompliant can still open email, no Conditional Access policy requires a compliant device.
  • A default that passes devices with no policy. In Compliance policy settings, Mark devices with no compliance policy assigned as starts at Compliant, so a device that missed its policy still counts as healthy.
  • Everyone is a local administrator. Check the Administrators group on one laptop, the Autopilot User account type and the Entra join setting.
  • A baseline that blocks silent encryption. Microsoft notes that the Security baseline for Microsoft Defender can turn on a TPM startup PIN and key, which stops BitLocker from enabling silently.
  • Location switched off. Hiding privacy settings in Autopilot turns location services off by default, so Locate device fails unless a policy turns them back on.
  • Deleting a lost laptop's records. Deleting a device in Microsoft Entra ID removes its BitLocker keys for good, and retiring or deleting a BitLocker-protected PC in Intune suspends BitLocker, so wipe a lost device and leave its records alone.
  • Company iPhones on personal Apple Accounts. With Find My on, Activation Lock can tie the phone to that person's account, and an administrator can turn it off in Apple Business only if the device was added there before the lock went on and has not been released.
  • Devices bought outside your accounts. A device from a seller that does not register purchases to your Apple Business account or for Autopilot has to be added afterward, which for Apple devices means erasing it, so ask your supplier about registration before the next order.

A worked example

Imagine a fifteen-person engineering firm on Microsoft 365 Business Premium, with eleven Windows laptops, three MacBooks, and staff who read email on their own phones. The office manager knows who has each laptop but not whether any of them are encrypted.

In week one, the office manager downloads the device list from the Microsoft Entra admin center and compares it with purchase records, finding two laptops that were never joined and a MacBook bought at a retail store. The firm creates the Apple MDM push certificate that Intune needs, links its Apple Customer Number and its reseller to Apple Business, links Apple Business to Intune, and asks the reseller to register future Windows purchases for Autopilot.

In week two, two pilot laptops get a silent BitLocker policy, a compliance policy, a pilot update ring with no deferral, and Microsoft 365 apps assigned as Required. A Conditional Access policy requiring compliant devices runs in report-only mode with Mac, iOS and Android excluded, because Microsoft warns those platforms can prompt users for a device certificate even in report-only mode. On Friday the firm runs the lost-device drill on a spare laptop and times each step.

In week three, the other laptops join a broad ring that defers quality updates by five days, with a three-day deadline and a two-day grace period. The MacBooks are backed up, added to Apple Business with Apple Configurator, which erases them, and set up again through Automated Device Enrollment. Personal phones are blocked from enrolling with a device platform restriction and get app protection for Outlook, Teams and OneDrive, backed by a second Conditional Access policy that requires app protection on iOS and Android. Then the firm sets Mark devices with no compliance policy assigned as to Not compliant, removes the Mac exclusion now that the MacBooks are enrolled, and switches the compliant-device policy to On.

After that, someone spends a few minutes each morning on noncompliant devices and devices that have stopped checking in. When a project engineer leaves in month two, the office manager disables the account and revokes sessions at the start of the exit meeting, and the laptop is prepared for the next hire with Windows Autopilot Reset, which removes personal files, apps and settings but keeps the laptop joined to Microsoft Entra ID and enrolled in Intune.

What to do this week

These are small enough to start this week:

  • List every laptop, desktop, phone and tablet that touches company data, with its user and whether the company or the person owns it.
  • Ask for the encryption report, not an answer, and note every device that is missing from it.
  • Check which Microsoft 365 plan or Google Workspace edition you have, and what device management it includes.
  • Ask whoever sells you hardware whether they can register new devices for Windows Autopilot and Apple Business at purchase.
  • Write down what happens on a leaver's last day, step by step, with a name against each step.
  • Decide which personal devices may reach company data, and with which controls.

What ALCO does

We inventory every device that touches company data, enroll them, set one set of policies for everyone, roll out updates in agreed windows, and watch the board. Each device has an owner, a warranty date and a record in myALCO, so replacements are planned, not panicked. You own the Intune and Apple Business accounts and ALCO administers them, so if you ever leave, the devices and the configuration stay yours. When a laptop asks for a BitLocker key or someone cannot install something, the help desk picks up; it is staffed 24 hours a day, including holidays, and calls are answered by a person.

ALCO's Google Workspace clients get managed Chrome and mobile management too. The page at alcohq.com/services/device-management sets out the full scope, and alcohq.com/services/asset-management describes the asset record kept for every device.

Sources