Prerequisites and licenses before you start
Before touching any console, lay the foundations. A failed Intune deployment is almost always diagnosed at the licensing or permissions level, not the configuration itself.
Required licenses (minimum):
- Microsoft 365 Business Premium, or
- Microsoft 365 E3 + EMS (Enterprise Mobility + Security), or
- Microsoft 365 E5 (includes EMS E5)
Each targeted user or device must have an active Intune license. A device visible in Entra ID but missing from the Intune console almost always indicates the absence of an Intune license on the account in question.
Minimum role required in Intune: Intune Administrator (or Global Administrator for initial operations). Apply the principle of least privilege: level 1 technicians do not need the Intune Administrator role to check the status of a device.
Useful PowerShell modules for checks:
1# Microsoft Graph PowerShell SDK module — version 2.x recommended2Install-Module Microsoft.Graph -Scope CurrentUser -Force3 4# Verify that a user has an Intune license5Connect-MgGraph -Scopes "User.Read.All", "Directory.Read.All"6$user = Get-MgUser -UserId "jeanluc.picard@contoso.com" -Property "DisplayName,AssignedLicenses"7$user.AssignedLicenses | Select-Object SkuIdCompare the returned SkuId with the SKU identifiers published in the Microsoft Learn documentation to confirm the presence of a plan that includes Intune.
Enrolling Windows 11 in Entra ID (user side)
Enrollment is performed via the Entra ID join (formerly Azure AD Join), which places the device under the authority of Microsoft Intune rather than an on-premises Active Directory domain controller.
Access account settings
Open Settings → Accounts → Access work or school, then click Connect.
Choose Entra ID join
In the dialog box, select the option Join this device to Microsoft Entra ID (not the local Active Directory join). Enter the credentials of the properly licensed end user.
Verify organization and finish
Confirm that the displayed tenant matches your organization, then click Done. A restart is not mandatory, but it is strongly recommended so that Intune policies apply from the first session.
Validate SSO on office.com
After reconnecting with the user's account, open a browser and navigate to https://office.com. Entra ID join activates transparent Single Sign-On (SSO): no password re-entry should be required. If an authentication prompt appears, verify your conditional access policy configuration.
Propagation delay
The device appears in the Intune console under Devices → Windows typically within 5 to 15 minutes following the join. If the device is not visible after 30 minutes, verify the Intune license assignment on the user account.
Admin-side verification in the Intune console
Log in to https://intune.microsoft.com and navigate to Devices → Windows. You should see the newly enrolled device with its hostname.
To verify the device presence programmatically:
1# List Windows devices enrolled in Intune2Connect-MgGraph -Scopes "DeviceManagementManagedDevices.Read.All"3Get-MgDeviceManagementManagedDevice -Filter "operatingSystem eq 'Windows'" |4 Select-Object DeviceName, UserPrincipalName, EnrolledDateTime, ComplianceState |5 Sort-Object EnrolledDateTime -Descending |6 Select-Object -First 10The ComplianceState column returns unknown as long as no compliance policy has been assigned — this behavior is normal at this stage.
From a device's detail page, the Manage button exposes available remote actions:
- Retire (Retire): removes enterprise data without erasing the device
- Wipe (Wipe): completely erases the disk
- Restart remotely
- Antivirus scan
Irreversible operations
The Wipe and Retire actions are irreversible. A full reset erases all local user data. Require dual procedural confirmation (ticket validated by a supervisor) before executing these commands in production.
Creating a configuration policy (Device Restrictions)
The Intune equivalent of an Active Directory Group Policy Object (GPO) is the configuration policy. The Device Restrictions template provides granular control over the user experience.
Create the policy
In Intune, go to Devices → Windows → Configuration policies, then click Create a policy.
- Platform: Windows 10 and later
- Profile type: Templates → Device restrictions
Name and configure restrictions
Give the policy an explicit name (example: OSL01-DeviceRestrictions-Corp). Browse through the categories and enable restrictions appropriate to your context:
- Control Panel: block access to network settings, language, time, region
- Applications: restrict installation from unmanaged sources
- Games: remove the Games section from the Start menu
- Power options: block user modification
Assign to device group
Click Next → Assignments, add the targeted Entra ID group (e.g., IT-Devices). You can exclude specific sub-groups from the same screen.
Finalize
Click Create. The policy is published immediately; it will apply to the device at the next Intune sync cycle (every 8 hours in normal operation, or on demand).
Creating a compliance policy
Compliance is distinct from configuration: it defines what the device must comply with to be considered healthy. Non-compliance can trigger automatic actions (conditional access blocking, notifications, device retirement).
Key settings available for Windows 11:
| Category | Setting | Recommended value (example) |
|---|---|---|
| Device integrity | BitLocker required | Yes |
| Device integrity | Secure Boot (Secure Boot) | Required |
| Device integrity | Code integrity | Required |
| Device properties | Minimum OS version | 10.0.22621 (Win 11 22H2) |
| System security | Password required | Yes |
| System security | Windows Hello for Business | Required |
| System security | Firewall enabled | Required |
| System security | TPM required | Yes |
1# Check device compliance via Graph2Connect-MgGraph -Scopes "DeviceManagementManagedDevices.Read.All"3$deviceName = "WS-PICARD-01"4$device = Get-MgDeviceManagementManagedDevice -Filter "deviceName eq '$deviceName'"5Write-Output "Compliance: $($device.ComplianceState)"6Write-Output "Last sync: $($device.LastSyncDateTime)"Possible values for ComplianceState: compliant, noncompliant, unknown, notApplicable, inGracePeriod, configManager.
Grace period
By default, a non-compliant device is not immediately blocked. Configure a grace period (e.g., 24 hours) and non-compliance actions (email to user, then blocking) to avoid unexpected service disruptions.
Deploying an application from the Microsoft Store
Intune supports the new Microsoft Store (WinGet-based), which greatly simplifies the deployment of third-party applications without having to manually manage MSI packages.
Add the Microsoft Store connector
In Intune, go to Applications → Windows, click Add, and select Microsoft Store application (new).
Search for the application
Use the integrated search field to find the desired application (example: Zoom Workplace). Select the Universal Windows Platform version for maximum compatibility. Metadata (icon, description, publisher) are imported automatically.
Configure and assign
Define an application owner if necessary, then in the Assignments tab:
- Required: silent and mandatory installation on devices in the group
- Available: visible in the Company Portal, on-demand installation
- Uninstall: forced removal
Assign to the IT-Devices group with Required mode, then click Create.
To verify installation status from PowerShell:
1# App installation status on devices2Connect-MgGraph -Scopes "DeviceManagementApps.Read.All"3$app = Get-MgDeviceAppManagementMobileApp -Filter "displayName eq 'Zoom Workplace'"4Get-MgDeviceAppManagementMobileAppDeviceStatuses -MobileAppId $app.Id |5 Select-Object DeviceName, InstallState, LastSyncDateTime |6 Format-Table -AutoSizeThe installed state confirms successful deployment. A failed state is accompanied by an error code viewable in the device detail page.
Force synchronization and verify policy application
After publishing configurations, compliance, and applications, force synchronization rather than waiting for the automatic 8-hour cycle.
From the Intune console: Devices → select the device → Sync.
From the device (user side): Settings → Accounts → Access work or school → click the connection → Info → Sync.
Via PowerShell (trigger remote sync):
1# Trigger MDM synchronization on a managed device2Connect-MgGraph -Scopes "DeviceManagementManagedDevices.ReadWrite.All"3$deviceId = (Get-MgDeviceManagementManagedDevice -Filter "deviceName eq 'WS-PICARD-01'").Id4Invoke-MgSyncDeviceManagementManagedDevice -ManagedDeviceId $deviceId5Write-Output "Synchronization triggered for $deviceId"Client-side verification
After synchronization, open Event Viewer on the client device: Applications and Services Logs → Microsoft → Windows → DeviceManagement-Enterprise-Diagnostics-Provider → Admin. Events with ID 813 confirm receipt and application of MDM policies.
Troubleshooting common errors
Device does not appear in Intune after Entra ID join
- Verify that the user has an active Intune license (
Get-MgUser+ checkAssignedLicenses). - Verify that automatic MDM enrollment is enabled: Entra ID → Mobility (MDM and MAM) → Microsoft Intune → MDM user scope.
Policies are not being applied
- Confirm that the Entra ID group contains the targeted device or user.
- Check for conflicts: two conflicting policies on the same setting generate an
Errorstate visible in Devices → Configuration policies → assignment status.
Application remains in pending or failed state
- Check WinGet logs on the device:
C:\ProgramData\Microsoft\IntuneManagementExtension\Logs\IntuneManagementExtension.log. - A firewall blocking
winget.azureedge.netorstoreedge.operative.comprevents download.
Error 0x80180014 during enrollment
- This code indicates the user has reached the device enrollment limit (5 by default). Increase the limit in Intune → Enrollment restrictions → Device limit restriction.
Key takeaways
- Entra ID join is the mandatory entry point: without it, Intune does not manage the device.
- The Intune license must be assigned to the user before enrollment for the device to appear in the console.
- Configuration policies (Device Restrictions) functionally replace GPOs; compliance policies drive conditional access.
- The new Microsoft Store in Intune eliminates manual MSI package management for common applications.
- Forced synchronization (
Invoke-MgSyncDeviceManagementManagedDevice) reduces policy application delay from several hours to minutes. - For the MD-102 certification (Endpoint Administrator Associate), this Windows 11 enrollment and configuration workflow is a central exam topic.
