Provisioning a Full Intune Baseline in One PowerShell Command
TL;DR
- As the modern desktop replaces traditional GPOs, Intune becomes the policy engine, and configuring it by hand across many clients is repetitive and error-prone.
- A PowerShell runbook can configure an entire Intune environment in a single command, built for the M365 Business SKU.
- The default runbook creates device compliance policies for iOS, Android, and Windows, a BitLocker configuration profile, and enrollment terms and conditions.
- It pushes Office 365 Business as a required app to Windows 10 (uninstalling existing ProPlus) and Microsoft Authenticator as a required app on iOS and Android.
- Every configuration setting can be customized so the runbook becomes a reusable template rather than a fixed script.
The move into the modern desktop means leaning on Intune for policy management in place of traditional GPOs. The problem shows up the second time you do it: configuring Intune by hand is tedious and repetitive across a client base, and every manual step is a chance to introduce human error. Processes that repeat across customers should be automated.
So we built a PowerShell runbook that configures an entire Intune environment in a single command. It was written for the M365 Business SKU, and it is meant to be customized into your own template. See the runbook guide (opens in new tab) for the full walkthrough.
What the runbook builds
Running the command provisions a complete baseline.
Device compliance policies for iOS, Android, and Windows
A compliance policy for each of the three platforms, so enrolled devices are evaluated against your standard from the moment they join.
A BitLocker configuration profile for Windows
A device configuration policy that enforces BitLocker on Windows devices, covering the encryption requirement most baselines and insurers expect.
Terms and conditions for enrollment
Enrollment terms and conditions that users accept when they enroll their device.
Office 365 Business as a required app on Windows 10
Office 365 Business pushed as a required app to Windows 10 devices, with an uninstall of existing ProPlus versions so you do not end up with two Office installs fighting each other.
Microsoft Authenticator as a required app on mobile
Microsoft Authenticator pushed as a required app for iOS and Android devices, putting the MFA app on the phone before the user needs it.
Customize the template
You can customize each configuration setting if you do not want to match the default settings, which are selected as best practices. That is the point: the runbook is a starting template you tune once and then reuse across every M365 Business client you onboard.
Frequently asked questions
What Microsoft 365 license does the Intune runbook target?
It was built for the M365 Business SKU, which bundles Intune. It can be adapted to other licenses, but the default policies and required apps assume M365 Business.
Can the runbook's default policies be changed?
Yes. Every configuration setting is customizable. The defaults reflect a sensible best-practice baseline, but you can edit each policy to match your own standard before running it across clients.
Automate the build, then verify the result
A runbook stamps out the policy. CloudCapsule confirms it stuck. It checks 250+ controls in 60 seconds across every tenant, so you catch the device baseline that drifted after deployment.
Try a free scan
Written by
Nick Ross
CEO · Microsoft MVP · Founder, T-Minus 365
Nick is not just a CEO, he's a respected thought leader and influencer in the MSP space. Tens of thousands of MSPs learn through his YouTube channel, T-Minus365. Nick has been honored as a three-time Microsoft MVP for his educational content; his expertise and influence are the backbone of our mission, ensuring that you are in the best hands when it comes to security.
Nick joined Pax8 in 2017, where he would ultimately oversee product management for PSA and Microsoft integrations. Following his tenure at Pax8, Nick has continued to demonstrate his leadership prowess as an executive at various MSPs, culminating in his most recent role at Sourcepass.
Nick holds a Bachelor's Degree in Business Management from Florida State University, as well as a Minor Degree in Entrepreneurship. In his free time, Nick is an avid hiker, reader, and fitness-junkie.
