Microsoft Intune is used for managing and securing the devices an organization's workforce uses — Windows PCs, Macs, iPhones, and Android phones — from one cloud console. IT admins use it to enroll devices, deploy applications and updates, enforce password and encryption policies, check compliance, and wipe corporate data from lost or departing devices. It works alongside Microsoft Entra ID so that only trusted users on healthy devices can access company resources.

To set up Microsoft Intune, sign in to the Intune admin center with an admin account, confirm your mobile device management (MDM) authority is set to Intune, configure enrollment settings for each platform you need, and then create configuration, compliance, and app protection policies before enrolling your first devices. Most beginners practice these steps in a trial tenant first, because a wrongly applied policy in a production tenant can lock users out.

The Microsoft Intune Company Portal is the app end users interact with to connect their devices to their organization. Available on Android, iOS/iPadOS, and Windows, plus a web version, it lets employees enroll a device, install company-approved apps, check compliance status, and remotely lock a lost phone. If a device is flagged as non-compliant, users can usually see exactly which policy failed inside the Company Portal app.

On a personal (BYOD) Android device, open the Company Portal app, select your device, and choose the remove or unenroll option — uninstalling the Company Portal app also ends management for most personally owned setups. If the option is greyed out or the phone is company-owned with enforced enrollment, only your IT admin can release it. Keep in mind that when you remove Microsoft Intune from Android, the device loses access to work email, Wi-Fi profiles, and company apps.

The Microsoft Intune admin center is the web-based console where IT admins manage devices, apps, policies, and reports for their tenant. You sign in with a work or school account that has an Intune administrator role, and the account needs an Intune license assigned. Everything from Autopilot profiles to compliance reports is managed from this single portal.

There is no exam literally named after Intune, but the Microsoft Intune certification path that hiring teams recognize is the Endpoint Administrator Associate track (MD-102 exam), which covers Intune, Autopilot, and endpoint security in depth. Beginners often start with a fundamentals exam such as AZ-900 or MS-900 to build cloud basics and then move to MD-102. Because Microsoft refreshes its certification catalog regularly, always confirm the currently active exams before booking.

Windows Autopilot in Intune is a zero-touch deployment service that configures brand-new Windows devices straight out of the box, replacing the old manual imaging process. Once a device is registered and assigned a deployment profile, the user simply unboxes it, connects to the internet, and signs in — Intune then joins the device to your environment, applies policies, and installs the right apps automatically.

The standard flow to set up Windows Autopilot is to collect the device's hardware hash, upload it to the Autopilot devices list in Intune, create a deployment profile that defines the out-of-box experience, and assign that profile to a device group in Microsoft Entra ID. When the device reaches the user and connects to the internet, it automatically enrolls in Intune and configures itself without manual IT involvement.

Windows Autopilot itself is not a separately purchased product — it is included with the licenses that contain Intune, such as Microsoft 365 Business Premium, E3, or E5, and it also requires Microsoft Entra ID P1. The only extra cost you may encounter is a one-time fee if your hardware vendor or partner handles device registration into the Autopilot service for you.

Interviewers for endpoint management roles commonly ask what Windows Autopilot is and how it differs from traditional SCCM imaging, how a device gets registered through the hardware hash, the difference between user-driven and self-deploying modes, what the Enrollment Status Page does, and how to troubleshoot a device stuck during deployment. Revising these Windows Autopilot interview questions with hands-on practice in a demo tenant makes the biggest difference in interviews.

You collect the Windows Autopilot hardware hash by running the Get-WindowsAutopilotInfo PowerShell script on the device, which generates a CSV file you upload to Intune, or by capturing it during the out-of-box experience on newer Windows 11 builds. Device vendors can also pre-register machines at purchase, in which case you never need to handle the hash yourself.

Microsoft Entra ID, formerly known as Azure Active Directory, is used for cloud identity and access management — handling user sign-ins, single sign-on to applications, multi-factor authentication, conditional access, and device identity. It matters especially for endpoint administrators because Intune depends on it: devices enroll through Entra ID, and compliance results from Intune feed back into conditional access decisions.

Yes, Microsoft Entra ID free is included with every Microsoft 365 subscription and covers core features like user accounts, groups, and single sign-on to apps. Advanced capabilities such as conditional access, dynamic groups, and identity protection require the P1 or P2 tiers, and Microsoft offers free trials of the premium editions so you can test them before committing.

Comparing Microsoft Entra ID P1 vs P2 comes down to security automation. P1 adds hybrid identity, conditional access, multi-factor authentication, and dynamic groups on top of the free tier, while P2 includes everything in P1 plus Identity Protection for risk-based sign-in policies, Privileged Identity Management for just-in-time admin access, and recurring access reviews.

A Microsoft Entra ID app registration is how you connect a custom application or script to Microsoft's identity platform. It defines who can sign in, what API permissions the app receives (for example, access to Microsoft Graph), and issues the client IDs and secrets needed for automation — such as PowerShell scripts that manage Intune or report on your tenant.