Microsoft Intune
Microsoft Intune consultants in the UK for Windows, Mac and mobile
We plan, build and run Microsoft Intune for organisations in London and across the UK. Windows PCs set themselves up with Autopilot. Macs, iPhones and Android phones follow the same security rules. Already use Jamf for Apple? We connect it to Entra ID. Then one set of conditional access policies covers every device.
Intune services
- Intune consulting and design
- Windows Autopilot rollouts
- Compliance and conditional access
- Windows updates and Autopatch
- Intune for Mac, iPhone and Android
- Jamf and Intune together
- Managed and co-managed Intune
Trusted by teams across UK government, healthcare, education, charities, financial services and global brands
What Intune is, and what we do with it
Microsoft Intune is Microsoft’s cloud service for managing devices and apps. It enrols Windows, macOS, iOS, iPadOS and Android devices. It then applies settings, installs apps, enforces encryption and controls updates.
Intune also reports whether each device is compliant. Microsoft Entra ID uses that result in conditional access. A device that fails your rules cannot reach Microsoft 365 or your other business apps.
Many organisations pay for Intune but use only part of it. Others set it up quickly and now have conflicting policies. We help at every stage.
Consulting
Independent advice before you commit.
- Intune readiness assessment
- Licence review
- Design and security decisions
Rollout
A planned project with a clear finish.
- Build, pilot and phased rollout
- Migration from SCCM, Group Policy or another MDM
- Handover documents and training
Ongoing management
We run Intune for you every day.
- Policy, app and update management
- Compliance monitoring and reporting
- Monthly changes and reviews
Co-managed support
For in-house IT teams.
- Third-line Intune escalation
- Project capacity alongside your team
- Reviews of changes before you make them
Intune for Windows
Most Intune work starts with Windows. These are the areas we design, build and manage.
Windows Autopilot
New PCs ship straight from the supplier to your people. They sign in with their work account and the PC configures itself. We use Windows Autopilot device preparation for new Windows 11 devices that join Entra ID. It is simpler to set up and reports progress in near real time. We use classic Windows Autopilot where you still need hybrid join, pre-provisioning, self-deploying kiosks or Autopilot Reset.
Compliance and conditional access
Compliance policies check encryption, operating system version, Defender status and password rules. Conditional access in Entra ID then decides who gets in. For example, only a compliant device can open Outlook or SharePoint. We start policies in report-only mode, check the results, then enforce them.
Updates, rings and Autopatch
We set update rings for quality updates and feature update policies to control Windows versions. Where your licences include it, we use Windows Autopatch. Autopatch groups release updates to a test ring first, then to everyone. It also manages driver, firmware, Microsoft 365 Apps, Edge and Teams updates.
App deployment
We package line-of-business software as Win32 apps with detection rules and dependencies. We add Microsoft Store apps and Microsoft 365 Apps. Where you have Enterprise App Management, we use its catalogue of pre-packaged apps that Intune updates for you.
Security baselines, BitLocker and LAPS
We apply Microsoft’s security baselines for Windows and Defender, then adjust them for your apps. BitLocker encrypts every disk, with recovery keys stored in Entra ID. Windows LAPS gives each PC a unique, rotated local administrator password.
Privilege management and Remote Help
Endpoint Privilege Management lets people run as standard users. Approved tasks can run with admin rights, with a full audit record. Remote Help gives your helpdesk secure remote sessions with role-based access. Both need extra licences on some plans, as the licensing section explains.
Windows features we configure
Intune for Mac
Intune can manage Macs well. It suits organisations that want one console, one team and one licence for every device. We build and manage both Intune and Jamf, so we can tell you where each one fits.
What Intune does on macOS
- Zero-touch enrolment. Macs bought through Apple Business (formerly Apple Business Manager) enrol through Automated Device Enrollment. They are supervised, and users cannot remove management.
- Settings catalog. Most macOS settings are in the Intune settings catalog. We use it for restrictions, privacy permissions, system extensions and login items.
- Software updates. On macOS 14 and later, Intune uses Apple’s declarative device management (DDM). You set a target version or a delay, and the Mac installs the update by the deadline. Apple has deprecated the older MDM update commands, so we move clients to DDM.
- FileVault. Intune turns on FileVault and stores the recovery key. Users can view their own key through Company Portal if you allow it.
- Platform SSO. Platform SSO with Entra ID lets people unlock the Mac and sign in to Microsoft 365 with one work account. It can now register during Setup Assistant. See our Platform SSO guide.
- Local admin passwords. The enrolment profile can create a managed admin account. Intune gives it a random password and rotates it every six months by default.
- Compliance. Compliance policies check FileVault, macOS version, firewall and Gatekeeper. The result feeds conditional access.
- Apps and scripts. Intune deploys PKG and DMG apps, Microsoft 365 apps and shell scripts. Custom attributes collect extra details for reporting.
Where Jamf goes further
Jamf is built only for Apple devices. For larger Mac estates, or teams with strict security rules, it gives more control:
- Smart groups that update automatically from inventory and extension attributes, so policies target exactly the right Macs.
- Self Service, a branded app store where people install approved software and run fixes without calling IT.
- App Installers from the Jamf App Catalog, which keep common Mac apps patched with little work.
- Jamf Protect for macOS threat detection, and Compliance Benchmarks for CIS-aligned reporting.
- Jamf aims to support new Apple operating system releases on the day Apple releases them.
We manage both, so our advice does not depend on which product you buy. Read Jamf vs Intune for managing Macs for a longer comparison.
iPhone, iPad and Android
Mobile devices need a clear decision first: who owns the device? The answer decides how much control you should have.
Company-owned phones and tablets
We enrol company iPhones and iPads through Apple Business, so they arrive supervised and fully managed. Android devices use Android Enterprise. Staff devices are fully managed. Kiosks and scanners use dedicated mode. Intune then controls apps, Wi-Fi, certificates, passcodes and updates.
Personal phones (bring your own device, BYOD)
Most people will not let their employer manage their personal phone. For these devices we use app protection policies, also called mobile application management (MAM). Intune protects Outlook, Teams and OneDrive without enrolling the phone. It can require a PIN, block copying into personal apps and remove work data remotely. IT cannot see or erase personal photos, messages or apps.
Android Enterprise also offers a personally-owned work profile. It separates work apps into their own space on a personal Android phone. We recommend it when you need certificates or Wi-Fi profiles on personal devices.
Personal and company-owned devices compared
| Area | Personal device (MAM) | Company device (fully managed) |
|---|---|---|
| Enrolment | Personal device (MAM)No enrolment. Users sign in to work apps. | Company device (fully managed)Enrolled through Apple Business or Android Enterprise. |
| What IT controls | Personal device (MAM)Work data inside approved apps only. | Company device (fully managed)The whole device: settings, apps, updates and passcode. |
| Remote wipe | Personal device (MAM)Removes work data only. | Company device (fully managed)Can reset the whole device. |
| Conditional access | Personal device (MAM)Requires an app protection policy. | Company device (fully managed)Requires a compliant device. |
| Best for | Personal device (MAM)Staff who use their own phone for email and Teams. | Company device (fully managed)Shared devices, frontline staff and high-risk roles. |
Intune and Jamf together
Many organisations use Intune for Windows and Jamf for Apple. This works well, if the two are connected properly.
Jamf Pro reports device compliance to Microsoft Entra ID through the Jamf Device Compliance connector in Intune. Jamf decides whether each Mac, iPhone or iPad meets your rules. Entra ID then uses that result, like it does for Windows PCs.
The result is one conditional access design for every device. A policy such as “require a compliant device for Microsoft 365” applies to Windows, Mac and mobile. You do not need a second set of rules for Apple.
This connector replaced Jamf’s older macOS Conditional Access integration, which Microsoft stopped supporting in January 2025. We move clients from the old method to Device Compliance.
What we set up
- Jamf Device Compliance connector in Intune
- Smart groups for applicable and compliant devices
- Entra ID registration through Jamf Self Service
- Conditional access exclusions for registration
- Intune licences checked for Jamf users
- Testing with a pilot group before enforcement
Intune for Mac vs Jamf for Mac: when each fits
We are a Jamf Professional Partner and we supply Jamf licences. If Jamf is the better fit, see Apple and Jamf. If Intune is the better fit, we will say so.
| Area | Intune for Mac | Jamf for Mac |
|---|---|---|
| Mostly Windows, with a small number of Macs | Intune for MacUsually the better fit. One console, and no extra licence. | Jamf for MacOften more than you need. |
| Macs are a large part of your estate | Intune for MacWorks, with more scripting and manual work. | Jamf for MacUsually the better fit. |
| Strict security or regulatory requirements | Intune for MacGood baseline controls. | Jamf for MacDeeper control, with Jamf Protect and Compliance Benchmarks. |
| Users expect a self-service app store | Intune for MacCompany Portal covers the basics. | Jamf for MacSelf Service offers more, including user-run fixes. |
| Conditional access in Entra ID | Intune for MacBuilt in. | Jamf for MacBuilt in through Jamf Device Compliance. |
| Small IT team, one skill set | Intune for MacSimpler. One tool to learn. | Jamf for MacTwo tools, unless a partner manages Jamf for you. |
| Existing Jamf investment and skills | Intune for MacA move is possible, but plan it carefully. | Jamf for MacUsually keep Jamf and connect it to Entra ID. |
Intune licensing in 2026
Most organisations already own Intune through a Microsoft 365 plan. Before we recommend anything new, we check what you already own.
Which Microsoft plans include which Intune features
- Microsoft 365 Business Premium. Intune Plan 1, Entra ID P1 for conditional access, Windows Autopilot and Windows Autopatch. For organisations up to 300 users.
- Microsoft 365 E3. Intune Plan 1 and Entra ID P1. Since July 2026, it also includes Intune Plan 2, Remote Help and Advanced Analytics.
- Microsoft 365 E5. Everything in E3. Since July 2026, it also includes Endpoint Privilege Management, Enterprise App Management and Microsoft Cloud PKI.
- Microsoft 365 F1 and F3. Intune Plan 1 for frontline workers.
- Business Basic and Business Standard. No Intune. You need Business Premium or an Intune add-on.
Microsoft is adding the new E3 and E5 features to tenants in stages. Microsoft posts a notice in the Microsoft 365 admin center 30 days before the change reaches your tenant. On other plans, including Business Premium, the advanced features are sold as standalone add-ons or as the Intune Suite.
Three licensing details that often cause problems
- Every user of an enrolled device needs an Intune licence. This includes people whose Macs are managed by Jamf and report compliance through Intune.
- Conditional access needs Microsoft Entra ID P1 or P2.
- Kiosks and shared devices can use cheaper device-only licences, but these do not support app protection or conditional access.
We are a UK Microsoft Cloud Solution Provider (CSP). We can supply your Microsoft 365 licences on the same invoice as your support. See Microsoft 365 licensing.
How an Intune project runs
The same four stages whether you have 25 devices or 2,500. Each stage ends with a written deliverable.
Assess and design
We review your tenant, licences, devices, apps, Group Policy and any SCCM or other MDM. You get a readiness report, then a design document to approve before we build.
Build and pilot
We build a policy baseline and test it with IT staff and a few users from each team. You get a pilot report with issues found and fixed.
Roll out
Devices move in planned waves, with short user guides. You get a progress report after each wave.
Hand over or manage
You get runbooks and admin training. Or we continue to manage Intune for you, or alongside your team.
What you get, and what we need from you
Every Intune project produces documents you keep. They stay useful if your team or supplier changes.
- Readiness report and licence review
- Design document covering enrolment, groups, compliance, conditional access, updates and apps
- Policy baseline, exported and version-controlled
- Pilot report with results and fixes
- Runbooks for enrolment, device resets and common problems
- Admin training and a user guide
What we need from you
- Admin access through a time-limited, approved role
- A named contact who can make decisions
- A list of business apps and their owners
- Pilot users from each team
- Access to Apple Business, if you use Apple devices
- Agreement on rollout dates and user communications
Intune projects we deliver most often
Moving from Group Policy and SCCM to the cloud
We use Group Policy analytics to find which settings still matter. We then rebuild them in the settings catalog. If you use Configuration Manager, co-management lets us move one workload at a time to Intune. The goal is Entra-joined devices with no on-premises dependency. Read our Active Directory to Entra ID guide.
A new Autopilot rollout
We register devices with your supplier or through device preparation, build the enrolment experience and test it. New PCs then go straight to users. Existing PCs are reset and enrolled at the next refresh or in planned waves.
Securing personal phones
We set app protection policies for Outlook, Teams and OneDrive, and conditional access to require them. Staff keep using their own phones. Work data stays inside work apps.
Adding Macs to an Intune estate
We connect Apple Business to Intune and design enrolment, Platform SSO, FileVault and updates. If Jamf is the better fit, we set up Jamf with Device Compliance instead.
Fixing a messy Intune tenant
Years of quick changes create duplicate and conflicting policies. We map every policy and assignment, and find conflicts. We then consolidate to a clean, documented baseline without breaking devices that work.
Moving from another MDM to Intune
We rebuild your policies in Intune first. Devices then move from the old mobile device management (MDM) tool in planned waves.
Further reading
Jamf vs Intune for managing Macs
An honest comparison, and how to use them together.
Read the guidePlatform SSO with Entra ID
What it does, what you need and how it fits with Jamf Connect.
Read the guideActive Directory to Entra ID
How to move from on-premises Active Directory to cloud-only identity and devices.
Read the guideFrequently asked questions
Can’t see your question? Call us on +44 20 7550 9103 or book a call.
What does an Intune consultant do?
An Intune consultant designs how your devices are enrolled, secured, updated and supported. They then build and test it. We also document every decision and train your team, or we manage Intune for you afterwards.
Is Intune included in our Microsoft 365 licences?
Intune Plan 1 is included in Microsoft 365 Business Premium, E3, E5, F1 and F3. It is not in Business Basic or Business Standard. We check your current licences before we recommend anything new.
What changed in Intune licensing in 2026?
From July 2026, Microsoft 365 E3 includes Intune Plan 2, Remote Help and Advanced Analytics. Microsoft 365 E5 adds Endpoint Privilege Management, Enterprise App Management and Cloud PKI. Microsoft is rolling this out to tenants in stages. Other plans still need add-ons for these features.
What is the difference between Windows Autopilot and Autopilot device preparation?
Device preparation is the newer version. It is simpler, supports Windows 11 with Entra join, and reports in near real time. Classic Autopilot still supports hybrid join, pre-provisioning, self-deploying mode and Autopilot Reset. We choose per scenario, and some clients use both.
Can Intune manage Macs properly?
Yes. Intune handles Mac enrolment, settings, FileVault, DDM software updates, Platform SSO and compliance. For large Mac estates or strict security needs, Jamf usually offers more control. See our Jamf vs Intune guide.
Can Intune and Jamf work together?
Yes. Jamf Pro reports Mac, iPhone and iPad compliance to Entra ID through the Jamf Device Compliance connector. One set of conditional access policies then covers Windows and Apple devices. Each Jamf user still needs an Intune licence.
Do we need to enrol personal phones?
Usually not. App protection policies protect work data in Outlook, Teams and OneDrive without enrolling the phone. Staff keep their privacy, and you can remove work data if they leave.
Can we keep SCCM or Group Policy while we move to Intune?
Yes. Co-management lets Configuration Manager and Intune share devices, and you move one workload at a time. Most clients then move to cloud-only management, with Entra-joined devices.
Can you fix an Intune set-up that someone else built?
Yes. We start with a review of every policy, assignment and conflict. You get a written report, then we fix the issues in agreed stages.
We have our own IT team. Can you still help?
Yes. Our co-managed IT service gives your team third-line Intune support and project capacity. Your team keeps control of the tenant.
How do you access our tenant?
We use Microsoft’s granular delegated admin privileges (GDAP). You approve only the roles we need, for a set time, and you can remove access at any time.
Where do you support Intune?
We support organisations on site in London and remotely across the UK. We also have an office in Dubai. Intune is cloud-based, so most work is done remotely.
Talk to an Intune engineer
A new Autopilot rollout, Macs in Intune, a Jamf connection or a tenant that needs fixing: book a 1-hour call. We will tell you honestly what you need and what you already own.
London head office
Postremo IT Limited
Level 24, One Canada Square
Canary Wharf
London E14 5AB
+44 20 7550 9103
info@postremoit.com
Also in Dubai
Business Bay, Dubai