RemoteMicrosoft Intune guide
Intune, explained for a business that already pays for it.
If you have Microsoft 365 Business Premium, E3 or E5, you already own Intune. It sets up new laptops on their own, keeps every device patched and encrypted, protects work email on personal phones, and stops unhealthy devices reaching your data. Here is what each plan includes after Microsoft's July 2026 changes, what the add-ons cost in Australia, and how we roll it out.
Licensing from Microsoft Learn. Prices from Microsoft's Australian page, checked 30 October 2026.
- In Business Premium, E3 and E5
- July 2026 Suite changes covered
- Add-on prices in AUD
Reviewed by Blake Bath, General Manager, on 30 October 2026.
What Intune does
Five jobs Intune takes off your hands.
Intune is Microsoft's cloud device management. Switched on properly, these are the jobs it does every day.
Sets up new laptops by itself
With Windows Autopilot, your supplier registers the laptop to your tenant before it ships. The new starter opens the box, connects to Wi-Fi and signs in, and Intune applies the settings and apps.
- No imaging
- Ship straight to the person
- Same build every time
Keeps devices healthy
Compliance policies define a healthy device: current OS, disk encryption, a working antivirus, a passcode. Conditional Access then blocks devices that fall short from reaching Microsoft 365.
- Encryption enforced
- Updates on a schedule
- Unhealthy devices blocked
Protects work data on personal phones
App protection policies put a PIN on Outlook, Teams and OneDrive, stop copying work data into personal apps, and let you wipe only the work data. The phone is never enrolled.
- Staff keep their privacy
- Work data stays in work apps
- Selective wipe when someone leaves
Replaces Group Policy
Configuration profiles and Microsoft's security baselines set Windows, Edge and Microsoft 365 Apps from the cloud, with no domain controller needed.
- Security baselines first
- Settings catalog for the rest
- Works for remote staff
Takes away local admin
Endpoint Privilege Management lets staff run as standard users while approved tasks, like installing a known app, run elevated. Every elevation is logged.
- Included in E5 and E7
- A$4.50 a user add-on otherwise
- Audit trail of every elevation
Intune plan check
How should each of your devices be managed?
Enter your plan and device numbers. The result shows how to enrol each group, what your plan already includes, and any add-on cost. Copy it for your IT provider.
Tell us your plan and devices. The result says how each group should be enrolled and whether you need anything extra.
Your Intune plan
A$90.00a month in Intune add-ons, ex GST
How to bring each group in.
- 18 Windows PCs: Windows Autopilot, registered by your supplier, so new laptops set themselves up at first sign-in.
- 2 Macs: Apple Business Manager automated enrolment, so they are supervised from first boot.
- 15 personal phones: app protection policies only. Work data in Outlook, Teams and OneDrive is protected, the phone itself is not enrolled.
- Local admin rights: remove them. Endpoint Privilege Management lets approved tasks run elevated. It is an add-on at A$4.50 a user a month on your plan.
- Remote Help is not in Business Premium. It is A$5.20 a user a month if you want it; many MSPs use their own remote tool instead.
Licensing after July 2026
What each plan includes now.
From Microsoft Learn. Microsoft moved most Intune Suite features into the enterprise plans from July 2026, rolling out to eligible tenants automatically.
| Plan | Intune | Added in July 2026 |
|---|---|---|
| Business Standard | Not included | Nothing |
| Business Premium | Intune Plan 1, with Entra ID P1 | Nothing; Suite features are add-ons |
| Microsoft 365 E3 | Intune Plan 1 | Plan 2, Remote Help, Advanced Analytics |
| Microsoft 365 E5 and E7 | Everything in E3 | Plus Endpoint Privilege Management, Enterprise App Management, Cloud PKI |
Business Premium is capped at 300 users. Enforcing compliance through Conditional Access needs Entra ID P1, which Business Premium and E3 include.
What the add-ons cost
Intune add-on prices in Australia.
Per user per month, ex GST, annual billing, from Microsoft's Australian Intune pricing page on 30 October 2026. For Business Premium tenants, these are the only way to get the Suite features.
| Add-on | Price | What it does |
|---|---|---|
| Endpoint Privilege Management | A$4.50 | Standard users by default, approved tasks elevated and logged |
| Remote Help | A$5.20 | Helpdesk remote sessions with role-based access |
| Advanced Analytics | A$7.50 | Device health, anomaly detection, device queries |
| Enterprise App Management | A$3.00 | A catalogue of ready-packaged Windows apps |
| Microsoft Cloud PKI | A$3.00 | Certificates for Wi-Fi and VPN without your own PKI server |
| Intune Plan 2 | A$6.00 | Specialty and shared devices, Tunnel for MAM, firmware updates |
How we run it
What we do differently, and what we learnt the hard way.
We push Intune policies to client tenants through Inforcer, from a tested standard, so every client gets the same baseline and changes go out in one place. Changes are tested on Real Bytes' own tenant first.
On our own tenant, company Windows PCs are fully managed and staff phones and Macs are personal. That is the model we recommend: MDM for what the business owns, app protection for what staff own.
The trap we found on our own tenant: when a third-party EDR manages the firewall and antivirus, Intune's built-in firewall compliance check fails on every device. A device that is always non-compliant teaches everyone to ignore compliance. We rework those checks so they test for the tool actually protecting the machine.
Enrolment
The right enrolment for each kind of device.
- Windows: Autopilot
Your supplier registers new PCs to your tenant. Existing PCs can be registered too, then reset to come back in managed.
- Apple: Apple Business Manager
Company iPhones, iPads and Macs enrol automatically and are supervised from first boot. Needed for full control of iOS.
- Android: Android Enterprise
Fully managed for company phones, dedicated mode for kiosks, work profile where a company phone is also used personally.
- Personal phones: app protection
No enrolment. Policies protect the work apps only, and Conditional Access requires them before email works.
Compliance
Our starting compliance policy.
Compliance decides whether a device can reach Microsoft 365. Start strict on encryption and updates, and be careful with checks your other tools affect.
- Minimum operating system versionSet to a supported build, raised as Microsoft releases updates.
- Disk encryptionBitLocker on Windows, FileVault on Mac.
- Antivirus and EDR healthyChecked against the tool you actually run.
- Secure Boot on WindowsPart of device health attestation.
- Passcode on phonesAnd no jailbroken or rooted devices.
When Intune is the wrong first step
Two cases where we start somewhere else.
- You are on Business StandardThere is no Intune to switch on. Move to Business Premium first; the licensing guide explains the maths.
- Devices are joined to an old on-premises domainWe plan the move off the domain, or co-management, before turning on compliance enforcement, so nobody is locked out.
Mistakes we see
Six ways Intune rollouts go wrong.
- Enforcing compliance on day oneRun Conditional Access in report-only first and fix the devices that would fail.
- Enrolling personal phonesStaff resist, and you hold data you do not want. Use app protection instead.
- Compliance checks that always failThird-party EDR and firewalls trip built-in checks. Rework them, or compliance means nothing.
- Leaving local admin onMost malware needs it. Remove it and handle the exceptions properly.
- Building from scratchStart from Microsoft's security baselines, then change what you must.
- No emergency access account excludedKeep a break-glass account outside device-based Conditional Access.
How we roll it out
Intune in six steps.
- Step 1Audit
Licences, devices, how they are joined today, and who has local admin.
- Step 2Baseline
Our tested standard applied through Inforcer, starting from Microsoft's security baselines.
- Step 3Pilot
A small group enrolled first, with compliance in report-only.
- Step 4Enrol
Autopilot and Apple Business Manager for company devices, app protection for personal phones.
- Step 5Enforce
Conditional Access switched from report-only to on, once devices pass.
- Step 6Watch
Compliance and update reports reviewed as part of looking after the tenant.
Related guides
Intune is one layer. These are the others.
Device management works with identity, Conditional Access and detection.
- Microsoft 365 licensingWhich plans include Intune.
- Conditional Access libraryRequiring compliant devices.
- Passkeys and the SMS retirementSign-in on managed devices.
- Microsoft 365 security baselineThe tenant settings around Intune.
- Managed Microsoft 365Intune run for you.
- Detection and responseThe EDR behind the compliance signal.
Get help your way
Six ways to reach us. Pick whichever suits you.
Helpdesk hours are Monday to Friday, 8am to 5pm AEST. On Advantage and above, emergencies get a response within 1 hour and outages within 2, with 24/7 best-effort escalation.
- Call 07 3114 2808
An engineer answers Monday to Friday, 8am to 5pm AEST. After hours, weekends and public holidays, Chip, our AI agent, answers on the same number or on 07 3180 0965, logs it and escalates urgent incidents to the on-call engineer.
Call now - Email the helpdesk
Send it to helpdesk@realbytes.com.au and a ticket is logged straight away, with a reference number you can quote.
Email us - Client portal
Log and follow your tickets, see what we are working on and who has it.
Open the portal - Remote support
When an engineer asks to see your screen, start a secure session here. You start it, so nobody sees your screen until you do.
Start a session - Chat in Microsoft Teams
Clients can message Chip, our AI assistant, in Teams to log a request without leaving their desk.
How clients reach us - Service status
Check whether Microsoft 365 or another cloud service is down before you lose an hour troubleshooting.
See live status
Questions
What people ask about Intune.
Is Intune included in Microsoft 365 Business Premium?
Yes. Business Premium includes Intune Plan 1 and Entra ID P1, which you need to enforce compliance with Conditional Access. Business Standard does not include Intune.
What changed for Intune in July 2026?
Microsoft moved Intune Suite features into the enterprise plans. Microsoft 365 E3 now includes Intune Plan 2, Remote Help and Advanced Analytics. E5 and E7 add Endpoint Privilege Management, Enterprise App Management and Cloud PKI. Business Premium did not change.
How much are the Intune add-ons in Australia?
Per user per month, ex GST, annual: Endpoint Privilege Management A$4.50, Remote Help A$5.20, Advanced Analytics A$7.50, Enterprise App Management A$3.00, Cloud PKI A$3.00 and Intune Plan 2 A$6.00. Microsoft's Australian prices, checked 30 October 2026.
What is the difference between MDM and MAM?
MDM enrols the whole device, which suits company laptops and phones. MAM, through app protection policies, protects only the work data inside apps like Outlook and Teams on a phone that stays personal and unenrolled. Most businesses use both.
Do I need to enrol staff's personal phones?
No. App protection policies protect work data on personal phones without enrolling them. Staff keep their privacy, and you can wipe the work data alone if they leave.
Can we still use our own antivirus with Intune?
Yes, but plan your compliance checks around it. If a third-party EDR manages the firewall or replaces Defender, Intune's built-in checks for those settings can fail on every device. Rework the checks so compliance reflects the tool you actually run.
Next step
Paying for Intune and not using it?
Tell us your plan and devices. An engineer will tell you what you already have, what to switch on first and how long it will take.
Keep reading
- Microsoft 365 licensing Which plan to buy.
- Conditional Access library The policies that use compliance.
- Managed Microsoft 365 Intune run for you.
- ASD ISM guide New controls for admin tools and hardening.
Reviewed by Blake Bath, General Manager, on 30 October 2026. Licensing from Microsoft Learn. Prices from Microsoft's Australian Intune pricing page, ex GST, checked 30 October 2026. Real Bytes practice from Blake Bath. Microsoft, Intune, Windows Autopilot and Entra are trademarks of Microsoft Corporation; Apple Business Manager is a trademark of Apple Inc. Microsoft Learn, Microsoft Intune licensing; Microsoft Learn, Intune planning guide: costs and licensing; Microsoft Learn, What's new in Intune (service release 2606); Microsoft Learn, Intune Suite add-on capabilities; Microsoft Learn, Endpoint Privilege Management; Microsoft Learn, Business Premium security FAQ; Microsoft, Intune pricing (Australia)