AdminPlainly

Home › Guides › Devices & Intune

Intune Setup for a 10-Person Office (Business Premium): Step by Step

By Justin N. · Updated 2026-10-22 · This page may contain affiliate links

This is the order I'd set up Intune for a 10-person office on Microsoft 365 Business Premium if I had to do it over a long weekend: identity first, then enrollment, then a small set of policies tested on one or two pilot PCs before anyone else's laptop is touched.

Who this is for: the owner, office manager, or one-person IT shop that already pays for Business Premium and has Windows 10/11 Pro or newer PCs. You don't need on-premises Active Directory for any of this. If you have it, read the hybrid notes at the end before you start.

Before you start: what Business Premium already gives you

Business Premium includes Microsoft Intune Plan 1 and Microsoft Entra ID P1, which are the two pieces this guide uses. Entra ID P1 matters because automatic MDM enrollment and Conditional Access are both premium Entra features. You don't need an extra Intune license for anyone who has Business Premium.

Have these ready before you change anything:

Step 1: Confirm licenses are assigned

Unlicensed users can't enroll. This is the most common "why won't it enroll" problem I see.

  1. Open the Microsoft 365 admin center at admin.microsoft.com.
  2. Go to Users > Active users, select a user, then open Licenses and apps.
  3. Confirm Microsoft 365 Business Premium is checked. Expand Apps and make sure the Intune and Entra ID P1 service plans aren't switched off.

If you expect to grow, use group-based licensing (an Entra ID P1 feature) instead of assigning by hand.

Step 2: Check the custom domain and MDM authority

Users should sign in as [email protected], not [email protected]. Check this under Settings > Domains in the Microsoft 365 admin center.

Then open the Intune admin center at intune.microsoft.com and go to Tenant administration > Tenant status. Under tenant details, the MDM authority should say Microsoft Intune. In newer tenants it's already set, so treat this as a check, not a task.

Step 3: Create a pilot group and an all-devices group

Every policy in this guide gets assigned to a pilot group first. In the Entra admin center (entra.microsoft.com), go to Entra ID > Groups > All groups > New group and create:

A user-assigned policy follows that person to every device they enroll. A device-assigned policy applies to whoever signs in to that PC. For a 10-person office, user groups are simpler. Save device groups for shared PCs.

Step 4: Turn on automatic enrollment (the most important switch)

  1. In the Intune admin center, go to Devices, expand Device onboarding, and select Enrollment.
  2. Select the Windows tab, then Automatic Enrollment.
  3. Set MDM user scope to Some and pick SG-Intune-Pilot-Users. Later, change it to All or to your all-users group.
  4. Set WIP user scope (Windows Information Protection, sometimes labeled the MAM scope) to None.
  5. Leave the MDM terms of use, discovery, and compliance URLs at their defaults, then Save.
The classic mistake: putting the same users in both scopes. Microsoft's automatic enrollment documentation says that when someone is in both, the WIP scope wins on personal devices and the device won't enroll for management. For company-owned PCs, MDM scope set and WIP scope at None is the clean setup.

Step 5: Decide who can join devices, and turn on Windows LAPS

In the Entra admin center, go to Entra ID > Devices > Device settings:

This page also has a toggle labeled Require multifactor authentication to register or join devices with Microsoft Entra ID. Leave it at No (the default). Microsoft recommends using the Register or join devices user action in Conditional Access to require MFA instead, and says this toggle must be set to No if you do. The Conditional Access guide covers that policy.

Step 6: Build a compliance policy

A compliance policy is Intune's definition of a "healthy" PC. On its own it doesn't block anything. It becomes powerful once Conditional Access requires a compliant device.

  1. Go to Devices > Compliance (under Manage devices) and select Create policy. Choose platform Windows 10 and later.
  2. Name it Windows - Baseline Compliance.
  3. Under Device Health, require BitLocker, Secure Boot, and Code integrity.
  4. Under Device Properties, set a minimum OS version that matches a currently supported Windows build. As of October 2026, Microsoft's Windows 11 release information page shows version 24H2 (build 26100) as past end of updates for Home and Pro editions. Version 25H2 (build 26200) and 26H2 (build 26300) are still supported. For Business Premium PCs running Pro, 10.0.26200 is a sensible minimum. Check that page again when you set this, because the oldest supported version changes every year. Any PC below the minimum is marked noncompliant, so upgrade those first.
  5. Under System Security, require Firewall, Antivirus, Antispyware, Microsoft Defender Antimalware, and Real-time protection. Also require a TPM.
  6. Under Actions for noncompliance, keep "Mark device noncompliant" but give it a grace period of one or more days during the pilot. Add an email notification if you want users to get a heads-up.
  7. Assign it to SG-Intune-Pilot-Users.

Then open Endpoint security > Device compliance > Compliance policy settings (Microsoft Learn) and set Mark devices with no compliance policy assigned as to Not compliant. That way, a device that slips past your assignments isn't treated as healthy by default. Do this only after your compliance policy is assigned broadly, or you'll mark the whole office noncompliant on day one.

Step 7: The first configuration policies

Start with security settings that are hard to argue with, then add convenience settings. I'd create these under Endpoint security, which gives cleaner profiles than the generic settings catalog for security work:

Then, in Devices > Configuration > Create > New policy with profile type Settings catalog:

Microsoft's security baselines (Endpoint security > Security baselines) change many settings at once. Pilot them only.

Step 8: Updates with Windows Autopatch or update rings

Microsoft's Windows Autopatch prerequisites list Business Premium as an eligible license, with update rings, quality and feature updates, driver and firmware updates, and Autopatch groups all available (Autopatch support requests aren't included for Business Premium). Hotpatch is also available on Business Premium for Windows 11 version 24H2 or later. Devices must be corporate-owned and already enrolled in Intune. Personal (BYOD) devices are blocked.

For 10 people, keep it simple with two rings: a pilot ring (you) with no deferral, and a broad ring with a few days' deferral and a deadline so reboots actually happen. As of October 2026, Microsoft documents these paths in the Intune admin center:

Pick one. Microsoft advises against assigning your own update rings to devices that Autopatch manages. Both approaches work best with device groups. Microsoft's tip is to assign update rings to device groups so the policy applies before anyone signs in, and Autopatch groups only accept device-based groups.

Step 9: Deploy apps

  1. Microsoft 365 Apps: go to Apps > All apps > Create (also labeled Add) and choose Microsoft 365 Apps > Windows 10 and later. Business Premium includes Microsoft 365 Apps for business, and Microsoft's Intune documentation says that edition must be configured with the Enter XML data option, not the configuration designer. In the XML, use the product ID O365BusinessRetail (from Microsoft's list of Office Deployment Tool product IDs), 64-bit, and an update channel (Monthly Enterprise Channel is a sensible default). Assign it as Required to your user group.
  2. Company Portal: add it from Microsoft Store app (new) so users can install optional apps themselves.
  3. Everything else: use the Microsoft Store (new) app type where possible. EXE installers need wrapping as Win32 apps (.intunewin) with the Win32 Content Prep Tool.

Step 10: Connect Defender for Business

Business Premium includes Microsoft Defender for Business, which adds endpoint detection and response on top of Defender Antivirus. When you first open Defender for Business in a tenant that already has Intune-enrolled devices, Microsoft says it asks whether to keep managing security in Intune or switch to the simplified configuration in the Defender portal. Since this guide manages policies in Intune, keep using Intune. Defender for Business also offers automatic onboarding for Intune-enrolled Windows devices, and Microsoft recommends choosing the "all devices enrolled" option so new PCs are onboarded as they enroll.

If you connect the services by hand, Microsoft's Intune documentation gives this order:

  1. In the Microsoft Defender portal (security.microsoft.com), go to System > Settings > Endpoints > General > Advanced features, turn Intune connection on, and select Save preferences.
  2. In the Intune admin center, open Endpoint security > Defender for Endpoint (Microsoft Learn) and check that the connection status shows Enabled (it can take up to 15 minutes). Turn on Connect Windows devices to Defender for Endpoint under compliance policy evaluation.
  3. Onboard Windows devices from Endpoint security > Endpoint detection and response > EDR Onboarding Status > Deploy preconfigured policy, or create an Endpoint detection and response profile assigned to your pilot group first.

Step 11: Enroll the pilot PCs

For an existing PC with nothing important on it, the fastest path is from the PC itself: Settings > Accounts > Access work or school > Connect, then choose Join this device to Microsoft Entra ID and sign in with the pilot user's account. Because of Step 4, it enrolls in Intune automatically.

Within the hour, check:

Live with it for a week. Fix what annoys you before you roll out to anyone else.

Step 12 (optional): Windows Autopilot for new PCs

If you buy new PCs a few times a year, Autopilot lets the PC ship straight to the employee and build itself at first sign-in. Ask your reseller to register devices to your tenant, or import hardware hashes yourself under Devices > By platform > Windows > Device onboarding > Enrollment > Windows Autopilot > Devices. Then create a user-driven, Microsoft Entra joined deployment profile with the user account type set to Standard, assigned to SG-Autopilot-Devices.

Microsoft also offers the newer Windows Autopilot device preparation. Microsoft's comparison page shows the trade-offs as of October 2026:

For a small, cloud-only office buying Windows 11 PCs, device preparation is usually enough. Choose classic Autopilot if you need any of the features only it has, such as pre-provisioning, Autopilot Reset, or hybrid join.

Rolling out to everyone

  1. Move the MDM user scope and every policy assignment from the pilot group to the all-users group.
  2. Enroll a couple of people a day, not all 10 at once.
  3. Write down what happens when someone leaves: retire or wipe their devices in Intune as part of the offboarding checklist.
  4. Decide how to handle personal phones. If you don't want to enroll them, Intune app protection for BYOD phones protects work data inside the apps instead.
  5. Once every PC shows compliant, create the "require compliant device" Conditional Access policy in report-only mode. The Conditional Access starter policies guide walks through it.

Mistakes I'd avoid

Sources

Useful links for this guide: Microsoft's Windows LAPS overview · enabling passkeys (FIDO2) and security keys for admins. These are ordinary links, not affiliate links.

Accuracy note: Microsoft changes admin center menus and licensing often. Paths and prices were checked against Microsoft documentation on 2026-10-22. If something has moved, tell me at [email protected].