ASD's Blueprint for Secure Cloud

Microsoft Intune is a Microsoft 365 service that provides Mobile Device Management (MDM) and Mobile Application Management (MAM) capabilities for Apple iOS/iPadOS and macOS, Chrome OS, Android, Linux, and Microsoft Windows devices to enhance security and protection. It is a component of Endpoint Management and Security (EMS) and natively integrates with other EMS components such as Entra ID and Microsoft Purview Information Protection (MPIP). Intune enables management of device security including data access and sharing, and provides enforcement of device configuration to ensure continuous assessment of device protection controls and does this via:

• Device Enrolment Profiles - Prior to managing devices in Intune they must be enrolled as either Personal or Corporate devices. These can either be self-enrolled or automatically enrolled.
• Device Compliance Policies - Device Compliance Policies are rules, such as device PIN length or encryption requirements, that can be applied to devices. These rules must be met before a device is considered compliant. Device Compliance can then be used by services such as Conditional Access.
• Device Configuration Profiles - Device Configuration Profiles provide the ability to control settings and features on supported endpoints. These include device and user settings, browser settings and hardware settings. Device Configuration Profiles can be deployed to specific users or devices in Entra ID groups.
• Device Security Baselines - Device Security Baselines are pre-configured groups of Windows settings that are recommended by Microsoft security teams. The security baselines are templates that are used to create a profile that is specific to the environment for deployment.
• Client Applications - Client Applications can be delivered to devices registered in Intune based on device type and group membership. Application types that can be distributed include store apps, Microsoft Office suite, Microsoft Edge browser, web links, line of business and Win32 applications. Monitoring of application distribution is provided.
• Software Updates - Software Update policies store the configuration of updates without the updates themselves. This prevents the need to approve individual updates enabling a faster turnaround time. Individual policies can be created and targeted to different groups of devices.

When devices are enrolled into Intune, authorised administrators are able to view:

• Hardware details
• Device usage (how the device is being used)
• Current compliance levels for:
  • Device software
  • Hardware
  • Operating system

Through customisation of the Company Portal, administrators can give end users the ability to install pre-approved applications and launch selected websites. This enables granular visibility of all endpoints within the Enterprise Mobility Management sphere and simplifies the approach for management.

To complement this visibility, an Intune Data Warehouse can be deployed to capture and create custom reports from Intune data using a reporting service. This can help provide insights into operating system and device breakdowns, which users are using Intune, what licences are being used and compliance trends. The Data Warehouse also has the capability to export directly to Power BI and create interactive and dynamic reports.

Clients managed by Microsoft Intune are configured to refresh their status on an 8-hour interval. During this refresh, policy compliance, configuration profile and app assignments are checked. If the client is recently enrolled then the compliance, non-compliance and configuration check-in runs more frequently.

Cloud native deployments

Hybrid deployments

Organisations can integrate their existing Microsoft Endpoint Configuration Manager (MECM) solution with Microsoft Intune using a configuration known as Co-Management. For a deployment to be enabled for Co-Management, devices must be Entra ID hybrid joined, be enrolled in Microsoft Intune and have the MCM client installed. Once Co-Management is enabled, management tasks such as compliance policies, Windows Update policies, resource access policies, and endpoint protection can be moved from MECM management over to Intune as required.

Microsoft cloud-hosted services offer the benefit of maintaining cadence with the latest technology updates from Microsoft with reduced effort required by IT departments. Microsoft Intune and Microsoft’s Co-Management strategy is constantly evolving with additional services published regularly.

Intune deploys and manages first-party Microsoft applications in a simple manner. However, does not allow for large scale customisations of update schedule, granular application deployment or application add-ons. Intune does not provide the ability to deploy and update third-party applications in a simple manner at time of writing.

Intune also provides a patching mechanism which simplifies the deployment of Microsoft first-party updates for applications and Windows 10, but does not allow granular control over patches.

The following figure provides an overview of Co-Management.

Related information

Security & Governance

• None identified

Design

• None identified

References

• Supported operating systems and browsers in Intune
• What is co-management?
• Tutorial: Enable co-management for existing Configuration Manager clients