Guides / intune
intune-from-zero · Chapter 1 of 11
Preparing a Microsoft 365 tenant for Intune
Licensing that actually matters, two accounts to create before anything else, and the automatic enrolment setting that almost no guide bothers to mention.
Everything in this series assumes a tenant that is ready. Most of what makes it ready takes twenty minutes, and one of those things is a single toggle that, if missed, makes Autopilot appear to work right up to the point where the device never enrols.
Licensing: what is actually required
Intune needs two things: Microsoft Intune itself, and Entra ID P1 for the parts that involve Conditional Access and dynamic groups.
For a small organisation the practical answer is Microsoft 365 Business Premium, which bundles:
- Microsoft Intune — device and policy management
- Entra ID P1 — dynamic groups, Conditional Access
- Defender for Business — endpoint security
- Microsoft 365 Apps — the Office suite
Two things it does not include, worth knowing before you plan around it:
- Windows Server. Business Premium covers Windows client licensing, not server. A domain controller needs its own licence, or a 180-day evaluation for lab purposes.
- Entra ID P2, and therefore PIM. Privileged Identity Management — just-in-time role activation — requires P2. With P1 you assign roles directly and permanently. That is a real limitation, not a detail: it means an account that has Global Administrator has it all the time.
Two accounts, before anything else
The break-glass account
A cloud-only Global Administrator, with MFA, without a licence, whose credentials live somewhere physical rather than in the password manager you sign into with the account you might be locked out of.
It exists for one purpose: to get back in when a Conditional Access policy, a federation problem or a directory sync failure has closed the door on everyone else.
Two of them, ideally. One credential lost should not end the discussion.
The operational administrator
A second cloud-only account for day-to-day administration, also unlicensed. Not your everyday mailbox account.
The reason is the same reason the break-glass account is cloud-only: high-privilege roles should not sit on synchronised users. A synced account is created and governed on-premises, where a different set of people can modify it, and where a compromise of the on-premises directory becomes a compromise of the tenant.
Unlicensed because an administrative account does not need a mailbox, and a mailbox is an attack surface.
Automatic MDM enrolment
This is the setting that almost no guide mentions, and without it Autopilot stops halfway.
Entra → Mobility (MDM and MAM) → Microsoft Intune
| Setting | Value |
|---|---|
| MDM user scope | All |
| MAM user scope | leave as needed |
MDM user scope set to All means every user who joins a device to Entra ID gets that device enrolled. You can narrow it to a group, but on a tenant where every managed device should be in Intune, All is the honest setting.
Security defaults, and the moment they have to go
New tenants have Security Defaults enabled. They are a reasonable starting point: MFA for administrators, blocked legacy authentication, no configuration needed.
They also block the device code flow, which is what the Autopilot hash import uses. And they are mutually exclusive with Conditional Access — you cannot have both.
So there is a moment, early, where they have to be turned off. The important part is what happens next:
Before moving on
- Licences assigned to the users who need them — and not to the administrative accounts.
- Two cloud-only break-glass accounts, MFA registered, credentials stored physically.
- An operational administrator account, cloud-only, unlicensed.
- MDM user scope set to All in Entra → Mobility.
- A decision made about security defaults, and Conditional Access ready to replace them.