What is our primary use case?
We use Microsoft Intune for managing devices. We deploy our devices to users using Microsoft Intune Autopilot, which enables us to set up the device for the user and then ship it to them. When they log in, everything is there for them, including all the applications they need. We push applications through Microsoft Intune; for example, we install Zoom through it.
We do not allow users to install their own apps. We use AppLocker, which prevents users from installing their apps. We can use remediation scripts. One script uninstalls Google Chrome if someone installs it because it hasn't been set up in AppLocker yet. If it were, AppLocker would prevent the user from installing Google Chrome. We use Microsoft Edge because it's easier to manage using Microsoft Intune and Microsoft Endpoint Manager. We can prevent users from installing extensions, which is beneficial because password and session token theft often occurs through malicious extensions. We can have a whitelist of extensions that users can install or push an extension to be installed using Microsoft Endpoint Manager. I'm using Microsoft Endpoint Manager and Microsoft Intune interchangeably here because they're practically the same product.
What is most valuable?
The best feature in Microsoft Intune is the ability to wipe a device if it gets lost or stolen. Even if the device goes offline, if you send the command to wipe the device and it appears online, you can still wipe it. If the device breaks or ruins the storage, it doesn't matter because the goal is to ensure they don't have the data. You can also keep the device locked to your tenant if desired. If someone steals the device and tries to install Windows again, it will display 'Welcome to X company' and they cannot proceed past that point.
Another notable feature of Microsoft Intune is application supersedence. For example, if we were using Microsoft Paint and we don't want it on the device but want another paint program, we can specify that Microsoft Paint will be superseded by this new application. It finds the application on the device, uninstalls it, and then installs the new application, providing two actions for the price of one.
Regarding the Enterprise Application Management feature for app discovery, deployment, and automatic updating, we utilize that functionality. We use advanced endpoint analytics with Microsoft Intune. Only one of the global admins needs the license, and the rest of the admins can manage without individual licenses.
What needs improvement?
I’m not sure if Microsoft can do anything to improve this situation. The most frustrating part for me is when we make changes to a device, particularly with our virtual machine setups and test users. These test users need an intern license, so we usually provide them with what the other users have, which is a business premium license—it's the best value for our needs. When we push an application, it’s usually manageable. However, when it comes to configuration changes, the waiting game can be tedious. Sometimes the change takes effect in just two minutes, but other times it can take up to two hours. It’s difficult to be patient while waiting to see if the change works. We could try restarting the Intune management service to prompt it to check for updates, but that’s hit or miss too. I really don’t know how the changes are pushed to devices—whether our changes go into a larger queue with others or not. What frustrates me the most is just waiting and tapping my fingers, uncertain about whether my changes will take effect. I honestly don’t know how they could improve this process, as I’m not familiar with the inner workings. But this delay is the most annoying part for me.
Sometimes, the menu system isn't very user-friendly. You'll find yourself digging through various sections, and the changes to the menu can be frustrating. For example, when you ask Copilot, "Where is this?" it might respond with a sequence of steps to follow, saying you need to go here, here, and then there. However, either Copilot is misunderstanding the situation, or the option has been moved, as it might no longer be where it used to be or it could have a different name. This is something that seems to change frequently. Microsoft tends to update things consistently; they do it with Windows and other products as well.
The most important thing is to stay patient while waiting for these changes to take effect. Additionally, not only do we need to wait for the changes, but we also need access to logs that detail what has changed. It's frustrating when you see the changes happening on the device, and maybe they fail, but then it takes twenty minutes to an hour for that information to be reflected in Intune. This delay hinders your ability to troubleshoot effectively. From Intune's perspective, while I can check the event logs to see why an application might not have installed, I'm more concerned about understanding why Intune itself failed. So, the two main issues are the time it takes for changes to be implemented and the time it takes to report on the effectiveness of those changes.
For how long have I used the solution?
I have been using Microsoft Intune for approximately five years now.
What do I think about the stability of the solution?
There has only ever been one issue with Microsoft Intune, which they fixed quickly in less than a day. That issue concerned displaying incorrect access rights to users. It did not disrupt operations significantly; we simply couldn't test anything for a while.
What do I think about the scalability of the solution?
It's a very scalable solution. You can have thousands of devices connected if you want. It allows you to manage numerous aspects effectively. This system has greatly benefited my company, as we were previously reliant on an inadequate VPN for connecting to our network infrastructure. Now, we have the flexibility to hire employees from places like Arizona and Washington, which wasn’t possible before due to the need for onsite presence. Using Intune has enabled our workforce to operate remotely. Since implementing this solution, our company has grown substantially, and our talent pool has significantly expanded. Although we only hire within the United States, we now have the ability to recruit from virtually anywhere in the country.
Our company has approximately 100 users working with Microsoft Intune, with a more complex setup due to our structure of five separate companies.
How are customer service and support?
We contact our cloud service provider first, who escalates us to level two tech support if needed. Microsoft support can be very inconsistent, warranting a rating of seven out of ten.
How would you rate customer service and support?
Which solution did I use previously and why did I switch?
My last use of SCCM was about eight years ago. Microsoft Intune's interface is superior; SCCM appeared outdated at that time. While I cannot extensively comment on SCCM due to dated experience, Microsoft Intune remains a strong product despite its regularly changing interface.
How was the initial setup?
Our deployment is entirely in the cloud. We used to operate on-premises, but I migrated everyone to use Entra ID instead of Active Directory on-site. I had to accomplish this while everyone was working remotely, which made the process more challenging since using Entra Connect or AD Connect was not feasible for many users. Currently, everyone is fully in the cloud. We do have an office, but people are rarely there. They only come in for meetings and such; most of the time, they are working remotely.
The deployment of Microsoft Intune is relatively straightforward to set up. It's more straightforward than SCCM, though SCCM lacks certain features that Microsoft Intune has, and vice versa. For beginners, completing Microsoft SC-900 provides a foundation, which is more oriented towards Entra. However, MS-900 might be more suitable as it focuses on the admin center.
For new companies implementing Microsoft Intune, setup can be quick with experienced personnel. Transitioning from on-premises to a hybrid solution depends on the number of users. It's crucial to ensure proper ID transfer and appropriate Entra licenses, particularly for write-back functionality. Without write-back enabled, users changing passwords outside the office might end up with two different passwords.
One essential step is onboarding computers to Microsoft Autopilot. A script pushed through Microsoft Intune can accomplish this, though it becomes more complex without automatic enrollment settings. Autopilot facilitates device building and shipping, ensuring everything is set up when users log in. For organizations with small footprints using Microsoft Office and minimal apps such as Zoom and SharePoint, the process is streamlined. When moving to the cloud, consideration must be given to migrating SharePoint from on-premises, for which Microsoft provides migration tools.
Maintenance involves running reports and managing stale devices. Setting up automatic removal of inactive devices helps maintain a healthy Microsoft Defender secure score. When reassigning devices, running an offboarding script ensures proper device management in Microsoft Defender.
What was our ROI?
Regarding return on investment, Microsoft Intune's value becomes apparent when comparing it to licensing costs of other management tools. Since it comes bundled with Microsoft Business Premium, it serves as a powerful tool that proved more valuable than initially anticipated. The overall ROI is positive, and the solution effectively meets our needs. Additionally, we can now deploy Global Secure Access, a VPN solution that protects remote workers and filters internet traffic, adding further value.
What's my experience with pricing, setup cost, and licensing?
The pricing of Microsoft Intune rates around four or five out of ten. The cost structure varies based on requirements. We utilize licensing bundles such as Microsoft 365 Business Premium, which includes the Microsoft Intune license and provides good value. Microsoft Intune alone costs approximately $6 monthly, but considering its device management capabilities, application installation features, and Microsoft Autopilot deployment functionality, the price is reasonable.
What other advice do I have?
The user experience has been good. There is some crossover with Microsoft Entra ID. You can access groups and users from Microsoft Endpoint Manager when onboarding a device. This can be set up using Microsoft Endpoint Manager. If someone receives a new device, they can sign in for work purposes, and if you are familiar with Microsoft Windows, they will have the option to choose whether the device is for home or work use. Once we see the device in Microsoft Endpoint Manager, we can begin assigning profiles and encrypting the drive, making it easier for us to remain compliant. We utilize the CIS framework for compliance, which provides guidelines on tasks such as drive encryption and ensuring all settings are appropriately configured.
Additionally, we implement conditional access policies. For instance, if someone is outside the United States, we can require them to re-authenticate using Microsoft Authenticator for security verification. This measure ensures that if an unauthorized person managed to steal someone’s MFA token and attempted to sign in from outside the country, they would be prompted to complete another MFA session, which adds an extra layer of protection. Furthermore, we can restrict actions on mobile devices. For example, we can prevent users from copying and pasting content from Word documents into applications like Apple Notes. This feature is particularly useful for maintaining security.
If you are a Microsoft shop, these processes streamline operations significantly. However, for larger enterprises, costs may escalate. In such cases, it would be necessary to contact Microsoft to establish a suitable arrangement, similar to agreements made with Microsoft Azure for their resources. For small to medium-sized businesses, getting set up with these systems is straightforward and can assist in achieving compliance. It's important to note that this information pertains to Microsoft Purview and is distinct from Intune, which I will not discuss further.
We do use Copilot, but we have it turned off for email due to a current exploit. There are hidden Copilot commands that can pull data from sources a user might have access to and then email it to someone else, which is why it's disabled for mail. We only have a handful of licenses, and they are primarily for people who have limited time during the day and receive a lot of emails. It's a time-saving feature for them. Sometimes, they use it to write scripts quickly, like in PowerShell, which I then review to understand what it does. You can trust it, but you should always verify its output. Copilot is also helpful for creating a basic outline for documents, such as policies, where you can simply fill in the blanks. However, the pricing is not great. Additionally, you are locked into a one-year subscription with no month-to-month option. The cost is around $360 a year per person, which adds up quickly, so you have to be sure the person really wants it. Consider purchasing one license first to let someone try it out. If they find it beneficial, they can keep it, and we can buy additional licenses for others who express interest. Currently, we have very limited licenses due to the high cost. If they were half the price, I believe everyone would have access to it.
For those implementing Microsoft Intune, if you plan to have remote workers, consider whether you want to provide them with actual physical devices or if you can offer cloud PCs instead. Cloud PCs can be managed through Intune, and anyone with access to a Chrome-based web browser can use a desktop from anywhere with an internet connection. This approach also helps you avoid issues with retrieving physical devices from users, as they are not legally obligated to return them, potentially leading to a loss of significant investment.
Additionally, there are compliance issues to consider when providing devices. For instance, if you give a physical device to a contractor, they may be legally considered your employee under laws in certain states, such as California. Therefore, think carefully about your deployment strategy. Decide whether you'll be using physical devices, which may require more effort to manage, or cloud PCs, which might save you headaches in the long run. You also need to be proficient in PowerShell, as you may have to write remediation scripts. If you're not comfortable with PowerShell and prefer a simpler solution, be aware that there may not be many alternatives. This also aligns well with Microsoft Windows.
If you prefer to use Apple products, keep in mind that you can't just purchase a MacBook from a store. You'll need an Apple business account to obtain a certificate required for managing the device through Microsoft Intune. This rule applies to iPhones and iPads as well. In contrast, with Android devices, you don’t have these management restrictions. So, before making any decisions, consider your deployment strategy and the existing device ecosystem you have in place. I'm not familiar with using SCCM or other management tools, but be sure that with Microsoft Intune, simply buying a MacBook will not allow you to manage it without following the necessary procedures.
I would rate Microsoft Intune overall as an eight out of ten.
Which deployment model are you using for this solution?
Public Cloud
Disclosure: My company does not have a business relationship with this vendor other than being a customer.