Standing Up Intune From Scratch on M365 Business: The Onboarding Sequence
TL;DR
- This Intune build assumes an M365 Business license; it also applies to EMS licenses, but Conditional Access and Windows Autopilot are not covered there.
- A clean implementation follows an order: device groups first, then autoenrollment, then policies and profiles.
- Applications and per-platform enrollment for Apple, Windows, and Android come after the policy layer is in place.
- The build ends by enrolling a real device to confirm the configuration behaves as intended.
- Doing the steps in sequence avoids the rework that comes from configuring policies before the groups and enrollment they target exist.
Intune rewards a clean build order. Configure policies before the groups and enrollment they target exist and you end up redoing work. The sequence below lays out an implementation from an empty tenant to a working enrolled device, written for the M365 Business license. It also applies to EMS licenses, with one caveat: Conditional Access and Windows Autopilot are not covered there because they depend on the licensing M365 Business carries.
For the full step-by-step with screenshots, see the implementation guide (opens in new tab). When you finish, you will have a tenant with device groups, autoenrollment, policies, apps, platform enrollment, and a verified test device.
Build the targeting layer first
Create your device groups
Start with the device groups your policies and apps will target. Everything downstream assigns to these groups, so they come first.
Configure autoenrollment
Set up autoenrollment so devices join Intune automatically rather than requiring a manual add for each one.
Apply the policy layer
Configure policies and profiles for devices
With groups and enrollment in place, configure the policies and profiles that define your device standard and assign them to the groups you created.
Add apps and platform enrollment
Add applications
Add the applications that should land on managed devices.
Set up enrollment for Apple, Windows, and Android
Configure enrollment per platform so Apple, Windows, and Android devices each have the correct path into Intune.
Prove it works
Enroll a device to Intune
Enroll a real device to confirm the groups, policies, apps, and enrollment paths behave the way you configured them. This last step is the difference between a tenant that looks configured and one you have verified.
Frequently asked questions
Does this Intune guide apply to EMS licenses as well as M365 Business?
It assumes an M365 Business license. It can apply to EMS licenses, but some features are not covered there, specifically Conditional Access and Windows Autopilot, which depend on the licensing in M365 Business or higher.
What order should you configure Intune in?
Device groups first, then autoenrollment, then policies and profiles, then applications, then per-platform enrollment for Apple, Windows, and Android, and finally enroll a test device. Each step depends on the one before it.
A clean build is step one, not the finish line
Once Intune is stood up, settings drift as clients change. CloudCapsule re-checks 250+ Microsoft 365 controls in 60 seconds across every tenant, so the baseline you built is the one you can prove.
See how it works
Written by
Nick Ross
CEO · Microsoft MVP · Founder, T-Minus 365
Nick is not just a CEO, he's a respected thought leader and influencer in the MSP space. Tens of thousands of MSPs learn through his YouTube channel, T-Minus365. Nick has been honored as a three-time Microsoft MVP for his educational content; his expertise and influence are the backbone of our mission, ensuring that you are in the best hands when it comes to security.
Nick joined Pax8 in 2017, where he would ultimately oversee product management for PSA and Microsoft integrations. Following his tenure at Pax8, Nick has continued to demonstrate his leadership prowess as an executive at various MSPs, culminating in his most recent role at Sourcepass.
Nick holds a Bachelor's Degree in Business Management from Florida State University, as well as a Minor Degree in Entrepreneurship. In his free time, Nick is an avid hiker, reader, and fitness-junkie.
