Intune lets you manage every Windows computer in your business from a single web page. No server required. No on-site IT person required. Just a browser and a couple of hours to set it up.

I know what you’re thinking: “That sounds complicated.” It’s not. It’s just unfamiliar. Let me walk you through it.

What Intune Actually Does

Think of Intune as a remote control for your computers. From the Intune admin centre, you can:

• Enrol devices — connect them to your management system
• Push software — install applications automatically
• Enforce policies — require encryption, set password rules, control settings
• Manage updates — control when Windows Updates install (we covered this in a previous post)
• Remote wipe — if a laptop gets stolen, erase it remotely
• See compliance — at a glance, which machines are up to date and which aren’t

For a small business without a dedicated IT person, this is transformative. Instead of walking around to each machine to check settings, you do it all from your desk.

What You Need

• M365 Business Premium (includes Intune — ~NZ$36/user/month, excl. GST, annual billing)
• Windows 10/11 Pro on each device (Home edition doesn’t support Intune enrolment)
• An Intune Administrator or Global Administrator role in M365
• About 2 hours for initial setup

Step 1: Enable Intune

If you’re on Business Premium, Intune is already included. You just need to start using it.

1. Go to https://intune.microsoft.com
2. If it’s your first time, it’ll take a few minutes to provision
3. You’ll see the admin dashboard — this is your new best friend

Step 2: Set Up Automatic Enrolment

This is the magic bit. Once configured, any user who signs into a Windows device with their M365 account automatically enrols it in Intune. No manual setup per machine.

1. In Intune, go to Devices > Enrolment (then the Windows tab)
2. Click Automatic Enrolment
3. Set the scope to All (or a specific group if you want to test first)
4. Set the MDM user scope to All

That’s it. From now on, when someone joins a Windows PC to your Entra ID and signs in, it enrols automatically. Note: the device must be Entra ID joined — simply signing into an app with a work account registers the device but doesn’t fully enrol it for MDM.

Step 3: Create a Compliance Policy

A compliance policy defines what “healthy” looks like for your devices. If a device doesn’t meet the policy, it shows as non-compliant and you can restrict its access to company data.

1. Go to Devices > Compliance > Policies > + Create policy
2. Choose Windows 10 and later
3. Configure the basics:

4. Click Create

Now any device that doesn’t meet these requirements shows as non-compliant in your dashboard.

Step 4: Deploy Your First App

Let’s install something. 7-Zip is a good test — it’s free, small, and useful. It’s available in the Microsoft Store, so this is the easy path:

1. Go to Apps > All apps > Add
2. Select Microsoft Store app (new)
3. Search for “7-Zip”, select it
4. Assign to a group (start with a test group)
5. The app will install automatically on enrolled devices

For apps that aren’t in the Store, you’ll need the Win32 wrapping method:

1. Go to Apps > All apps > Add
2. Select Windows app (Win32)
3. Wrap the installer (.msi or .exe) into the .intunewin format using Microsoft’s Win32 Content Prep Tool, then upload it
4. Set the install command and uninstall command
5. Assign to a group

Yes, Win32 wrapping is the fiddliest part of Intune. Always check the Store first.

Step 5: Set Up a Configuration Profile

Configuration profiles let you control device settings. Here are the ones I’d set up first:

Wi-Fi profile: Push your office Wi-Fi settings so devices connect automatically.

1. Go to Devices > Configuration profiles > Create profile
2. Platform: Windows 10 and later
3. Profile type: Templates > Wi-Fi
4. Enter your SSID, security type, and password
5. Assign to your device group

BitLocker profile: Ensure all drives are encrypted.

1. Go to Endpoint security > Disk encryption > Create policy
2. Platform: Windows 10 and later, Profile: BitLocker
3. Enable BitLocker, set encryption method
4. Assign to your device group

Note: The older path Templates > Endpoint protection still works, but Microsoft now steers toward Endpoint security > Disk encryption.

What This Looks Like Day-to-Day

Once set up, your workflow is:

1. New employee starts — they get a Windows PC, sign in with their M365 account, and Intune automatically enrolls it, installs your apps, and applies your policies. Done.
2. Someone loses a laptop — you go to Intune, find the device, and click Wipe. You’ll be prompted for a 6-digit Recovery PIN. The laptop is erased the next time it connects to the internet.
3. A compliance issue pops up — you see it in the dashboard, and you know exactly which machine and what’s wrong.
4. You need to deploy new software — add it in Intune, assign it, and it installs automatically.

No driving to the office after hours. No walking around to each machine. No “I’ll do it Monday.”

The Honest Limitations

Intune isn’t perfect. A few things to know:

• It needs internet connectivity. Devices check in with Intune periodically — they don’t need to be online 24/7, but they do need to connect now and then to receive policies and report status.
• Mac and iOS management is possible but the experience isn’t as polished as Windows.
• The reporting is basic. It tells you if something’s compliant, but it won’t give you deep diagnostics.
• There’s a learning curve. The first few hours are confusing. It gets easier.
• Windows Home edition doesn’t work. You need Pro. If you’ve got Home edition machines, that’s a problem.

The Bottom Line

If you’re paying for M365 Business Premium and not using Intune, you’re wasting money. It’s not enterprise-only software — it’s designed for exactly your situation: a small business that needs to manage devices without a dedicated IT team.

Set it up once, and it pays for itself in time saved every single week.

I’ve put together a complete Intune enrollment walkthrough on Patreon — with screenshots for every step, recommended compliance policies for small business, and a device enrollment checklist you can follow for each new machine. Get it here.

“Update and restart now.”

So you click “Remind me tonight.” Tonight comes. You click “Remind me in 4 hours.” You keep clicking it until it forces the restart at the worst possible time, and now you’re annoyed at Microsoft.

I get it. I really do. But here’s the thing — that prompt is trying to save your business.

What Updates Actually Do

There’s a misconception that Windows Updates are just Microsoft adding features you don’t want and changing things that work fine. Sometimes that’s true — the occasional feature update does change the look and feel, and it’s annoying.

But the critical updates? The ones that interrupt your work? Those are usually security patches (delivered as part of monthly cumulative updates).

Here’s what that means in practice:

Microsoft’s security team (and independent researchers) find vulnerabilities in Windows. These are flaws that a criminal could use to get into your computer. Some vulnerabilities require no interaction at all — in some cases, just being on the same network with an unpatched machine is enough. Others rely on phishing or user action.

Microsoft releases a patch to fix the vulnerability. That patch gets delivered via Windows Update.

If you install the patch, you’re protected. If you don’t, the door stays open. And criminals know exactly which doors are still open — the patches are public. When Microsoft releases a fix, attackers can reverse-engineer the patch to figure out exactly what to exploit on machines that haven’t updated yet.

Not updating is like locking your front door but leaving the key in it.

The WannaCry Problem

In 2017, a vulnerability called EternalBlue was used to spread the WannaCry ransomware. It infected over 230,000 computers across 150 countries in a few days. Hospitals, businesses, government agencies — all hit.

Microsoft had released a patch for the vulnerability nearly two months before the attack.

Most of the businesses that got hit weren’t running ancient unsupported Windows. Mostly Windows 7 and Server 2008 R2 systems — the same versions many businesses were still running. They just hadn’t installed the update.

WannaCry didn’t care that you were busy. It didn’t care that the update prompt was annoying. It just encrypted everything and demanded $300 in Bitcoin.

The majority of successful ransomware attacks exploit known vulnerabilities with available patches. The gangs aren’t using fancy zero-days — they’re exploiting the updates people didn’t install.

“But Updates Break Things!”

This is the counter-argument, and it’s not wrong. Sometimes updates do break things. A driver stops working. An app compatibility issue pops up. Something that worked yesterday doesn’t work today.

This was more of a problem in the Windows 7/8 era. It still happens occasionally, but Microsoft has gotten significantly better at testing updates before broad release. The “update broke my computer” scenario is far less common than it used to be.

Here’s how to manage the risk without leaving yourself exposed:

Don’t install updates on day one. But don’t wait three months either.

Let the early adopters find the problems. Wait a week or so after “Patch Tuesday” (the second Tuesday of each month — that’s when Microsoft drops their big security updates). Then install.

You can configure this in Windows through Windows Update for Business or Intune (if you’re on M365 Business Premium). Set a deferral period — give feature updates a longer deferral (30-60 days), but keep security updates shorter (7-14 days).

How to Set Up a Basic Update Policy

If you’re running Windows 10/11 Pro (most business machines do), you can configure this without any extra tools:

1. Open Settings > Windows Update > Advanced options
2. Enable Receive updates for other Microsoft products (keeps Office updated too)
3. If available on your version of Windows, under Choose when updates are installed, set:
   • Feature updates: defer by 30 days
   • Quality updates: defer by 7 days

That’s the “set and forget” level. You’ll get security updates within a week of release (early adopters have found any problems by then) and feature updates within a month (plenty of time for news about any issues).

If you’ve got M365 Business Premium and Intune, you can do this centrally for all machines — more on that below.

If You’ve Got Intune (M365 Business Premium)

This is where it gets easier. When we covered M365 licensing, I mentioned that Business Premium includes Intune. One of the best things about Intune is centrally managing Windows updates across all your devices.

You create update rings — groups of settings that control when and how updates install. You can set up:

• A pilot ring: 5-10 machines get updates first. If something breaks, you catch it before it hits everyone.
• Everyone else: Gets updates 7-14 days after the pilot group.

The pilot ring should include non-critical machines and tech-comfortable staff who’ll actually report problems. Don’t put your most important server in the pilot group.

I’ve put together a complete walkthrough on Patreon for setting up Intune update rings — including recommended settings for small business, screenshots, and what to do if an update causes problems.

Other Things Updates Cover

It’s not just security. Updates also include:

• Bug fixes: That weird crash in Excel that happens every Tuesday? Might get fixed in a cumulative update.
• Driver updates: New hardware support and better performance on existing hardware (though these can occasionally cause issues, so some businesses manage them separately).
• .NET Framework updates: A lot of business software depends on this. Missing or mismatched .NET versions are a common cause of app issues.

The Bottom Line

I know updates are annoying. I know they always seem to fire at the worst time. But the alternative — running unpatched Windows in a business environment — is genuinely dangerous.

Configure a deferral so you’re not on day one. Test on a couple of machines first if you’re in a managed environment. But actually install them. Every month. Without fail.

The ransomware gangs are counting on you putting it off. Don’t make it easy for them.

For M365 Business Premium users, I’ve put together a step-by-step Intune update ring guide on Patreon — with recommended settings, pilot group setup, and rollback procedures if an update causes issues. Check it out here.