As I continue developing my skills in IT Support and Microsoft cloud technologies, I have been exploring Microsoft Intune and its integration with Microsoft Entra ID.
Intune is more than just a tool for managing computers. It provides organizations with a centralized way to manage devices, applications, security policies, compliance, and user access.
This article documents my learning journey and some of the fundamental concepts I have been working through.
Understanding the Microsoft Environment
A typical Microsoft cloud environment involves several components working together, including:
Microsoft 365
Microsoft Entra ID
Microsoft Intune
Windows devices
Microsoft 365 licensing
Security and compliance policies
The first step is understanding how users, groups, licenses, identities, and devices interact with each other.
Microsoft Entra ID
Microsoft Entra ID, formerly known as Azure Active Directory (Azure AD), is Microsoft's cloud-based identity and access management platform.
It is used to manage:
Users
Groups
Devices
Applications
Authentication
Access permissions
Identity security
Creating a User
One of the fundamental tasks is creating and managing user accounts.
A typical user-management workflow includes:
Create the user account.
Configure the user's basic information.
Assign the appropriate license.
Add the user to required groups.
Configure authentication methods.
Apply appropriate security policies.
This provides the foundation for managing users across Microsoft 365 and Intune.
Multi-Factor Authentication (MFA)
Multi-Factor Authentication provides an additional layer of security beyond a username and password.
Instead of relying only on a password, users can be required to provide another form of verification.
Examples include:
Microsoft Authenticator
Security keys
SMS, where supported
Other authentication methods configured by the organization
MFA is an important component of identity security because compromised passwords alone should not automatically provide access to organizational resources.
Self-Service Password Reset (SSPR)
Self-Service Password Reset allows users to reset or change their passwords without requiring the IT Service Desk to manually reset them.
This can:
Reduce Service Desk tickets
Improve user productivity
Reduce password-reset workload
Provide users with greater control over their accounts
SSPR needs to be configured appropriately, including authentication methods and the users or groups to which the policy applies.
Groups
Groups are extremely important when managing Microsoft cloud environments.
Instead of configuring every user individually, administrators can use groups to apply common configurations.
Groups can be used for:
License assignment
Application deployment
Intune policies
Compliance policies
Access control
Security configurations
For example, an organization could create a group called:
IT-Department
Users in this group could automatically receive specific applications, licenses, or device-management policies.
This makes administration more scalable and easier to maintain.
Microsoft 365 Licensing
Licensing determines which Microsoft services and capabilities users can access.
When working with Microsoft 365, it is important to understand:
Available license types
Services included with each license
Security capabilities
Intune availability
Entra ID capabilities
User-based versus group-based licensing
Licenses can also be assigned to users through groups, which can make administration much easier in larger organizations.
For example:
User → Group → License
Instead of manually assigning a license to every user, administrators can configure group-based licensing where appropriate.
Custom Domains
Another important part of Microsoft 365 administration is configuring a custom organizational domain.
For example, an organization might initially have a Microsoft-provided tenant domain such as:
company.onmicrosoft.com
The organization may instead want users to sign in using:
The custom domain can be purchased and managed through a domain registrar such as GoDaddy and then added to the Microsoft environment.
The general process involves:
Register or manage the domain with the domain registrar.
Add the custom domain to Microsoft Entra ID/Microsoft 365.
Verify ownership of the domain.
Configure the required DNS records.
Update users with the appropriate domain.
Verify that authentication and Microsoft 365 services are working correctly.
This is an important practical concept because organizations typically want their Microsoft 365 identities to use their corporate domain.
Microsoft Entra Join and Hybrid Identity
Device identity is another important part of Microsoft's ecosystem.
Microsoft Entra Join
Microsoft Entra Join allows supported devices, particularly Windows devices, to be joined directly to the organization's cloud identity environment.
This can allow organizations to manage devices using cloud-based services such as Microsoft Intune.
Microsoft Entra Connect
Microsoft Entra Connect can be used to synchronize identities between an on-premises Active Directory environment and Microsoft Entra ID.
This is particularly useful for organizations that maintain traditional on-premises Active Directory while also using Microsoft cloud services.
A simplified environment can look like:
On-Premises Active Directory → Microsoft Entra Connect → Microsoft Entra ID → Microsoft Intune
Understanding this relationship is important when supporting organizations transitioning from traditional infrastructure to cloud-based identity and device management.
Microsoft Intune
Microsoft Intune is Microsoft's cloud-based endpoint management platform.
It can be used to manage:
Windows devices
macOS devices
iOS/iPadOS devices
Android devices
Applications
Security policies
Configuration policies
Compliance policies
From an IT Support perspective, Intune can help administrators standardize how organizational devices are configured and secured.
Intune Enrollment
Device enrollment is the process of registering a device with the organization's management environment so that Intune can apply management and security configurations.
There are several enrollment approaches depending on the platform and organizational requirements.
Company Portal
The Microsoft Intune Company Portal application allows users to enroll supported devices and access organizational applications and resources.
It can be used across multiple supported platforms, including:
Windows
macOS
iOS/iPadOS
Android
The exact enrollment experience depends on the operating system and organizational configuration.
Windows Automatic Enrollment
Windows devices can also be configured for automatic enrollment into Intune.
This allows organizations to automatically enroll devices when they meet the configured enrollment requirements.
Automatic enrollment is particularly useful in environments where administrators want device management to happen with minimal manual intervention.
Windows Autopilot
Windows Autopilot is designed to simplify the provisioning and deployment of Windows devices.
Instead of manually preparing every computer, organizations can configure devices so that they automatically receive the organization's required configuration during the setup process.
A simplified workflow looks like:
New Device → Windows Setup → User Sign-in → Autopilot Configuration → Intune Enrollment → Policies & Applications
This can significantly improve the efficiency of large-scale device deployments.
For example, an organization purchasing hundreds of laptops could configure them for Autopilot rather than manually installing and configuring every machine.
Intune and IT Support
From an IT Support perspective, learning Intune provides exposure to modern endpoint-management practices.
Some common areas an IT Support professional may encounter include:
Device enrollment
Device compliance
Application deployment
Windows configuration
Security policies
Device troubleshooting
User access
Microsoft 365 administration
Entra ID identity management
Conditional Access
Endpoint security
This connects traditional Service Desk responsibilities with modern cloud-based endpoint management.
My Learning Journey
My current focus is to understand how the different Microsoft technologies connect rather than learning each product in isolation.
The overall relationship can be viewed as:
User → Entra ID → Group → License → Intune → Device → Policy → Application
For example:
A new employee joins an organization.
An administrator creates the user's Entra ID account.
The user is added to the appropriate groups.
Required Microsoft 365 licenses are assigned.
MFA and other identity-security controls are configured.
The user's device is enrolled into Intune.
Required applications are deployed.
Configuration and security policies are applied.
Compliance is monitored.
Understanding this end-to-end process is helping me build a stronger foundation in Microsoft cloud administration and endpoint management.
Conclusion
Microsoft Intune and Microsoft Entra ID are important technologies for modern IT environments.
For an IT Support professional, understanding these technologies goes beyond simply knowing where to click in the portal. The real value comes from understanding how identity, licensing, devices, applications, policies, and security work together.
I am continuing to build my hands-on knowledge in:
Microsoft Entra ID
Microsoft Intune
Microsoft 365
Identity and Access Management
Device Enrollment
Windows Autopilot
Endpoint Management
MFA and SSPR
Group and License Management
This is an area I am particularly interested in developing further as I progress from traditional IT support toward modern endpoint and cloud administration.
