By Andrew Armstrong 
Microsoft Intune is now the primary endpoint management platform for Windows environments — Microsoft has made it clear that Intune is the future and Configuration Manager (SCCM) is in maintenance mode, moving to an annual release cadence from version 2609 (September 2026). This is the complete TechyGeeksHome reference for Intune: licensing, enrollment and Autopilot, co-management and migration from SCCM, compliance policies and Conditional Access, and application deployment.
Quick Facts
- Intune is Microsoft’s cloud-native unified endpoint management (UEM) platform, managing Windows, iOS/iPadOS, Android and macOS from one console.
- Licensing starts with Intune Plan 1 (included in Microsoft 365 E3/E5/Business Premium); Plan 2 and the Intune Suite add advanced security and automation.
- During 2026, Microsoft is folding former Intune Suite features (Remote Help, Advanced Analytics, Intune Plan 2) into core Microsoft 365 E3/EMS E3 licensing.
- Co-management lets Intune and SCCM manage the same device simultaneously — a permanent hybrid state is a legitimate end goal, not just a migration step.
- Conditional Access only works if you pair compliance policies with an actual Conditional Access rule — Intune alone doesn’t block anything.
What Is Microsoft Intune?
Microsoft Intune is a cloud-based unified endpoint management (UEM) solution that lets you manage Windows, iOS/iPadOS, Android and macOS devices from a single console, without on-premises infrastructure. It integrates with Microsoft Entra ID (formerly Azure AD) for identity and with Microsoft Defender for security signal, and it can run alongside Configuration Manager in co-management for organizations migrating off on-premises tooling.
In the Zero Trust security model most enterprises run in 2026, Intune is the enforcement layer for device compliance — every access decision Microsoft Entra Conditional Access makes depends on the device health signal Intune reports. That makes Intune less of an optional add-on and more of the plumbing modern identity security sits on top of.
Intune Licensing: Plan 1, Plan 2 and the Intune Suite
Intune licensing is built around three tiers, plus a device-based option for shared or single-use hardware:
| Intune Plan 1 | Intune Plan 2 | Intune Suite | |
| What it is | Core UEM service | Add-on: advanced management | Premium add-on bundling Plan 2 + security tools |
| Included in | Microsoft 365 E3/E5/F1/F3, Business Premium | Being folded into core M365 E3/EMS E3 during 2026 | Purchased separately, or partially absorbed into E3 in 2026 |
| Key features | Cross-platform MDM/MAM, endpoint security, endpoint analytics, ConfigMgr integration | Tunnel for MAM, Teams Room device management, Zebra firmware updates | Remote Help, Endpoint Privilege Management, Cloud PKI, Advanced Analytics |
| Best for | Every organization managing devices | Orgs needing tighter MAM/specialized device support | Orgs wanting help-desk and privilege-management tooling without a la carte add-ons |
The biggest licensing change for 2026: Microsoft is folding several Intune Suite features — Remote Help, Advanced Analytics and Intune Plan 2 itself — into core Microsoft 365 E3 and its Enterprise Mobility + Security (EMS) E3 component. If you’re already on M365 E3, check your tenant before buying Plan 2 or Suite separately; you may already have it.
Enrollment: Windows Autopilot vs. Autopilot Device Preparation
Deciding between the two? We’ve broken down the full comparison — profile delivery, join type, pre-provisioning, and where Device Preparation still falls short — in our dedicated Windows Autopilot vs. Autopilot Device Preparation guide.
There are now two distinct Autopilot experiences, and picking the wrong one causes more support tickets than almost anything else in a new Intune rollout.
| Classic Windows Autopilot (v1) | Autopilot Device Preparation (v2) | |
| Profile delivery | Downloaded pre-login, based on a registered hardware hash | Delivered after the user signs in with Entra ID during OOBE |
| Join type | Entra joined or hybrid joined | Entra joined only |
| Hardware hash required | Yes — must be uploaded/registered in advance | No |
| Scenarios supported | User-driven, pre-provisioned, self-deploying, existing device, reset | User-driven only (physical devices) |
| App deployment | Mixing Win32 and LOB apps can cause failures | Win32 and LOB apps can deploy together, up to 25 apps per policy |
| Progress reporting | Enrollment Status Page (ESP), detailed | Simplified percentage-based progress, near real-time |
| Use it when | You need hybrid join, pre-provisioning, kiosk/self-deploy, or still support Windows 10 | You want the fastest new Windows 11 Entra-joined rollout with simple assignment |
Co-Management and Migrating From SCCM
If you’re already running Configuration Manager, you don’t have to choose between SCCM and Intune on day one. Co-management lets both consoles manage the same device at once, with individual workloads (compliance, device configuration, Windows Update, apps, etc.) switched over to Intune one at a time.
For the full workload-by-workload breakdown, sequencing guidance and validation checklist, see our dedicated SCCM to Intune Co-Management Guide.
Typical Co-Management Rollout Order
- Enable co-management in the ConfigMgr console and set the pilot collection.
- Move the compliance policies workload to Intune first — lowest risk, immediate Conditional Access value.
- Move Windows Update policies, then device configuration.
- Migrate applications last — repackage SCCM applications as .intunewin files rather than trying to reuse SCCM packages directly.
- Decide your end state: full cloud, or permanent co-management. Both are valid; regulated or complex environments often stay co-managed indefinitely.
The most common bottleneck isn’t policy migration — it’s applications. Most SCCM shops have large libraries of packages built specifically for SCCM’s packaging model, and converting each one into IntuneWin format with correct detection rules takes real time if done manually.
Compliance Policies and Conditional Access
Compliance policies and Conditional Access are two separate features that only work together. A compliance policy defines the health requirements a device must meet — passcode, up-to-date OS, no jailbreak/root, encryption, and so on — and Intune writes a compliant/non-compliant signal against the device. Conditional Access, which lives in Entra ID, is what actually reads that signal and blocks access. See the full compliance policies and Conditional Access deep dive for baseline recommendations and common mistakes.
The gap almost every tenant has: compliance policies are configured, the Intune dashboard correctly shows non-compliant devices, but no Conditional Access policy actually enforces the requirement — so those “non-compliant” devices keep accessing Exchange and Teams anyway. A compliance policy without a matching Conditional Access rule is reporting a problem, not solving one. Always pair the two.
Deploying Applications: Win32 Apps
Win32 app deployment is the most flexible method for complex Windows applications — it’s the closest equivalent to an SCCM application deployment.
Deploying a Win32 App, Step by Step
- Package the installer as an
.intunewinfile using the Microsoft Win32 Content Prep Tool. - Upload it in the Intune admin center under Apps > Windows > Add > Windows app (Win32).
- Set accurate install/uninstall commands (usually silent switches — see our MSI silent install guides for common examples).
- Configure a real detection rule — a registry key or MSI product code — not just “file exists,” to stop the app reinstalling on every check-in.
- Assign to a device or user group and monitor the rollout in Apps > Monitor.
Frequently Asked Questions
Do I need to fully migrate off SCCM to use Intune?
No. Co-management lets Intune and Configuration Manager manage the same devices simultaneously, with individual workloads moved over one at a time. Staying co-managed indefinitely is a legitimate, supported end state — not a failed migration.
Should I use classic Autopilot or Autopilot Device Preparation?
Use Device Preparation for straightforward, fast Windows 11 Entra-joined rollouts. Use classic Autopilot (v1) if you need hybrid Entra join, pre-provisioning, self-deploying/kiosk scenarios, or still need to support Windows 10 devices.
Why are my non-compliant devices still accessing email and Teams?
A compliance policy alone does not block anything – it only reports a compliance signal. You need a matching Conditional Access policy in Entra ID that actually reads that signal and blocks non-compliant devices. This is the most common Intune deployment gap.
What’s the difference between Intune Plan 1 and Plan 2?
Plan 1 is the core UEM service included with Microsoft 365 E3/E5/Business Premium – cross-platform device management, MAM and endpoint security. Plan 2 adds advanced features like Tunnel for MAM and specialized device management. During 2026, Microsoft is folding much of Plan 2 into core M365 E3/EMS E3 licensing.
Can I deploy the same apps with Win32 and LOB packaging in one Autopilot run?
With classic Autopilot, mixing Win32 and line-of-business (LOB) app types in the same deployment can cause failures. Autopilot Device Preparation supports mixing both app types in a single policy, with up to 25 apps configured.
This guide will keep expanding with dedicated deep dives on SCCM-to-Intune migration, Autopilot deployment walkthroughs, and Win32 app packaging — check back or explore the related guides below.
Gear We Recommend
Testing configs is easier with a dedicated admin machine set up right. Here’s the kit we use.
Browse our Windows Admin Toolkit picks on AmazonAs an Amazon Associate, TechyGeeksHome earns from qualifying purchases.
Discover more from TechyGeeksHome
Subscribe to get the latest posts sent to your email.
