Comprehensive Guide: Microsoft Intune MDM Setup for SMBs in 2026

Step 1: Understand Intune Fundamentals and Licensing

Before diving into configuration, it's crucial to grasp what Intune offers and how it aligns with your SMB's needs. Intune is a cloud-based service focused on endpoint management, securing and managing your organization's devices and apps. It's built around three pillars: user identities (Microsoft Entra ID), devices, and applications.

Intune supports two primary management modes: Mobile Device Management (MDM) and Mobile Application Management (MAM). For SMBs looking to manage corporate-owned devices comprehensively, **MDM is the recommended primary mode**. MDM allows you to enroll entire devices, configure settings, enforce security policies, deploy and protect apps, and even wipe devices if lost or stolen. MAM, while useful for BYOD scenarios, manages only the work apps and data within them, leaving personal content untouched. For corporate devices, you can combine MDM with MAM policies for especially sensitive data within apps.

Key Intune Capabilities for SMBs:

• Device Enrollment: Bring Windows, Android, iOS/iPadOS, and macOS devices under management.
• Configuration: Apply settings consistently across devices (Wi-Fi profiles, VPN, email accounts, device features).
• Security: Enforce PIN/password policies, encryption (BitLocker), Defender antivirus settings, and update management.
• App Deployment & Protection: Distribute required apps and protect corporate data within apps (e.g., preventing copy/paste to personal apps).
• Conditional Access Integration: Combine device compliance with user and app signals from Microsoft Entra ID to grant or block access to corporate resources based on real-time security posture.

Step 2: Initial Intune Tenant Setup and Custom Domain Configuration

Your first practical step is to ensure your Intune tenant is active and to configure your custom domain name. If you've already signed up for Microsoft 365 Business Premium, your Intune tenant is likely already provisioned, and you'll sign in with your existing administrator account.

Portal alternative: Navigate to the Microsoft Intune admin center. If it's your first time, you might be guided through an initial setup wizard. Ensure you are signed in with a Global Administrator account.

Configure Your Custom Domain Name:

While an .onmicrosoft.com domain is provided, configuring your custom domain (e.g., skycoresolutions.com) is crucial for a professional appearance and user familiarity. If you're already using Microsoft 365, your domain is probably already verified.

To connect your custom domain, you'll typically add DNS records. This process is often done through the Microsoft 365 admin center or the Microsoft Entra admin center.

# Connect to Microsoft Entra ID PowerShell
Connect-MsolService

# Get existing domains
Get-MsolDomain

# If your domain is not listed, add it (replace 'yourdomain.com')
New-MsolDomain -Name "yourdomain.com"

# Verify the domain by adding DNS records with your DNS provider (e.g., TXT record)
# Microsoft will provide specific TXT record details after 'New-MsolDomain'
# Once DNS is propagated, verify the domain
Confirm-MsolDomain -DomainName "yourdomain.com"

• Connect-MsolService: Establishes a connection to Microsoft Online Services, allowing you to manage Entra ID resources.
• Get-MsolDomain: Lists all domains associated with your tenant.
• New-MsolDomain -Name "yourdomain.com": Initiates the process to add your custom domain. You'll be prompted to create a TXT or MX record with your DNS host to prove ownership.
• Confirm-MsolDomain -DomainName "yourdomain.com": After you've added the required DNS record and it has propagated, run this command to verify ownership and activate the domain.

Portal alternative: Go to the Microsoft 365 admin center > Settings > Domains > Add domain. Follow the wizard to enter your domain name and add the required TXT or MX record at your DNS host. The portal provides the exact record details you need.

Verify Intune Admin Center Access:

After configuring your domain, ensure you can access the Intune admin center smoothly.

Portal confirmation: Navigate to https://intune.microsoft.com/. You should see the dashboard without any errors, confirming your access to the service.

Step 3: Add Users and Create Groups in Microsoft Entra ID

Intune relies on Microsoft Entra ID for user identities and group-based policy assignment. Users need accounts to sign in to managed devices, and groups are essential for efficiently assigning licenses, apps, and configuration policies at scale.

Add Users to Microsoft Entra ID:

You can add users individually or in bulk. For SMBs, individual addition or a small bulk import is common.

# Connect to Microsoft Entra ID PowerShell
Connect-MsolService

# Add a new user (replace details)
New-MsolUser -UserPrincipalName "jdoe@yourdomain.com" -DisplayName "John Doe" -FirstName "John" -LastName "Doe" -Password "YourStrongPassword!" -UsageLocation "US" -ForceChangePassword $true

# Assign an Intune license (e.g., Microsoft 365 Business Premium SKU: SKYCORE_BUSINESS_PREMIUM)
# To find your SKU, use: Get-MsolAccountSku
$user = Get-MsolUser -UserPrincipalName "jdoe@yourdomain.com"
$licenseSku = (Get-MsolAccountSku | Where-Object {$_.SkuPartNumber -eq "SMB_BUSINESS_PREMIUM"}).AccountSkuId # Adjust SkuPartNumber based on your subscription
Set-MsolUserLicense -UserPrincipalName "jdoe@yourdomain.com" -AddLicenses $licenseSku

• New-MsolUser: Creates a new user in Microsoft Entra ID. Ensure -UsageLocation is set as it's required for license assignment.
• Set-MsolUserLicense: Assigns a license to the newly created user. You must replace SMB_BUSINESS_PREMIUM with the actual SkuPartNumber for your Intune-inclusive license (e.g., `Microsoft365_Business_Premium`). Use `Get-MsolAccountSku` to find the correct SKU.

Portal alternative: Go to the Microsoft 365 admin center > Users > Active users > Add a user. Fill in the details, assign roles, and select the appropriate product license.

Create Security Groups:

Create groups for different departments (e.g., Sales, Marketing, IT) or device types (e.g., Windows Laptops, iOS Devices). These groups will be used to target policies and apps.

# Connect to Microsoft Entra ID PowerShell
Connect-MsolService

# Create a new security group for IT Staff
New-MsolGroup -DisplayName "Intune_IT_Staff" -Description "IT Staff for Intune Policy Assignment" -GroupType Security

# Add users to the group
Add-MsolGroupMember -GroupObjectId (Get-MsolGroup -DisplayName "Intune_IT_Staff").ObjectId -GroupMemberObjectId (Get-MsolUser -UserPrincipalName "jdoe@yourdomain.com").ObjectId

# Repeat for other groups like 'Intune_All_Employees' or 'Intune_Windows_Devices'

• New-MsolGroup: Creates a new security group. We recommend prefixing group names (e.g., Intune_) for clarity.
• Add-MsolGroupMember: Adds a user to the specified group using their Object IDs.

Portal alternative: Go to the Microsoft 365 admin center > Teams & groups > Active teams & groups > Add a group. Choose 'Security' as the group type.

Step 4: Prepare Device Enrollment and Set Restrictions

Device enrollment is the process by which devices are registered with Microsoft Entra ID and subsequently managed by Intune. For SMBs, user-driven enrollment is the most common starting point for both corporate and personal devices.

Configure Enrollment Restrictions:

Enrollment restrictions allow you to define which device platforms (Windows, iOS, Android, macOS) can enroll and to set limits based on device ownership (corporate or personal) and OS versions.

Portal Steps:

1. Navigate to the Microsoft Intune admin center.
2. Go to Devices > Enroll devices > Enrollment restrictions.
3. You'll see default restrictions for Device Type and Device Limit. Click on a restriction (e.g., All Users for Device Type).
4. Click Properties > Edit next to 'Platform settings'.
5. For each platform you want to restrict, set 'Platform' to Block or configure minimum/maximum OS versions. For example, to block Android and macOS enrollment for corporate devices, set their respective platforms to Block. Ensure Windows (MDM) and iOS/iPadOS are allowed.
6. For 'Personally owned devices', you might choose to Block for corporate-owned device policies or set it to Allow if supporting BYOD with MAM policies. For full MDM on corporate devices, often you block personally owned to enforce corporate device acquisition policies.
7. Click Review + save.

Enable Windows Automatic Enrollment (for Hybrid/Cloud-joined Windows devices):

For Windows devices, you can configure automatic MDM enrollment. When a user joins a device to Microsoft Entra ID (either during OOBE or by joining an existing device), it automatically enrolls in Intune.

Portal Steps:

1. Navigate to the Microsoft Intune admin center.
2. Go to Devices > Enroll devices > Windows enrollment > Automatic Enrollment.
3. Under 'MDM user scope', set to All (recommended for SMBs for simplicity) or Some (if you want to target specific security groups).
4. Under 'MAM user scope', set to None (if focusing purely on MDM for corp devices) or All/Some for BYOD scenarios.
5. Click Save.

Step 5: Configure Device Compliance Policies

Device compliance policies define the rules and settings that devices must adhere to in order to be considered compliant by your organization. This is a critical component of a Zero Trust strategy, especially when combined with Conditional Access.

Portal Steps:

1. Navigate to the Microsoft Intune admin center.
2. Go to Endpoint security > Device compliance > Policies > Create Policy.
3. Select the 'Platform' (e.g., Windows 10 and later) and click Create.
4. On the Basics tab, provide a Name (e.g., Windows_Corp_Compliance_Policy) and Description, then click Next.
5. On the Compliance settings tab, configure the following (SMB recommendations):
• Device Health:
  • Require BitLocker: Require
  • Require Secure Boot: Require
  • Require Code Integrity: Require
• Device Properties:
  • Minimum OS version: Set a reasonable minimum (e.g., 10.0.19045.0 for Windows 10/11 22H2)
• System Security:
  • Require a password to unlock mobile devices: Require
  • Minimum password length: 6
  • Password type: Alphanumeric
  • Require a password expiration: Not configured (often handled by Windows Hello for Business or other policies)
  • Encryption of data storage on device: Require
6. Click Next.
7. On the Actions for noncompliance tab, define actions like marking the device noncompliant immediately (recommended for initial setup) and potentially sending email to the user. Click Next.
8. On the Assignments tab, assign the policy to your relevant security group (e.g., Intune_All_Employees or Intune_IT_Staff for testing). Click Next.
9. On the Review + create tab, review your settings and click Create.

Confirmation of Policy Assignment:

After creating and assigning the policy, you can verify its status.

Portal verification: In the Intune admin center, go to Endpoint security > Device compliance > Policies. Select your policy and check the 'Assignments' tab to confirm the correct groups are targeted. After devices enroll, you can monitor their compliance status under Devices > All devices or directly in the policy's overview.

Step 6: Deploy Device Configuration Profiles

Device configuration profiles allow you to manage settings and features on your devices. This includes things like Wi-Fi network settings, email profiles, VPN connections, and security baselines. For SMBs, a few core profiles are usually essential.

Example: Configure Windows Update Rings:

Ensuring devices receive timely updates is crucial for security. Update rings allow you to control how and when updates are deployed.

Portal Steps:

1. Navigate to the Microsoft Intune admin center.
2. Go to Devices > Windows > Update rings > Create profile.
3. On the Basics tab, provide a Name (e.g., Windows_Corp_UpdateRing_Standard) and Description, then click Next.
4. On the Update ring settings tab, configure the following (SMB recommendations):
• Servicing channel: Semi-Annual Channel
• Microsoft product updates: Allow
• Windows drivers: Allow
• Quality update deferral period (days): 7 (to allow for initial stability checks)
• Feature update deferral period (days): 90 (to allow for broader adoption and bug fixes)
• Automatic update behavior: Auto install at maintenance time
• Restart checks: Allow
• Users to pause Windows updates: Not configured (or Block for stricter control)
• Users to scan for Windows updates: Allow
5. Click Next.
6. On the Assignments tab, assign to your target group (e.g., Intune_All_Employees). Click Next.
7. On the Review + create tab, review your settings and click Create.

Example: Deploy an Email Profile (Exchange ActiveSync):

Automatically configure email for your users on their enrolled devices.

Portal Steps:

1. Navigate to the Microsoft Intune admin center.
2. Go to Devices > Configuration profiles > Create profile.
3. Select Platform (e.g., Windows 10 and later), Profile type (Templates), and then choose Email. Click Create.
4. On the Basics tab, provide a Name (e.g., Corp_Windows_Email_Profile) and Description, then click Next.
5. On the Configuration settings tab:
• Account name: Corporate Email
• User name from Entra ID: User Principal Name
• Email address from Entra ID: Primary SMTP address
• Exchange ActiveSync host name: outlook.office365.com (for Exchange Online)
• Use SSL: Yes
• Authentication: Username and Password (or Certificate for advanced scenarios)
6. Click Next.
7. On the Assignments tab, assign to your target group (e.g., Intune_All_Employees). Click Next.
8. On the Review + create tab, review your settings and click Create.

Portal verification: In the Intune admin center, go to Devices > Configuration profiles. Select your created profile and check the 'Assignments' to confirm groups. After devices enroll, you can check device status under the profile's overview.

Step 7: Enroll End-User Devices

With the foundational policies in place, the final step is to get your end-users to enroll their devices. For SMBs, user-driven enrollment via the Company Portal app is the most common method.

Windows User-Driven Enrollment:

Users can enroll their personal or corporate Windows devices through their work or school account settings.

End-User Steps for Windows:

1. On their Windows 10/11 device, go to Settings > Accounts > Access work or school.
2. Click Connect.
3. Enter their Microsoft Entra ID work email address and follow the prompts. If auto-enrollment is configured (Step 4), the device will be automatically enrolled into Intune after joining Entra ID.
4. Alternatively, they can download the Company Portal app from the Microsoft Store, sign in, and follow the on-screen instructions.

iOS/iPadOS User-Driven Enrollment:

Users download the Company Portal app from the App Store.

End-User Steps for iOS/iPadOS:

1. Download the Microsoft Intune Company Portal app from the App Store.
2. Open the Company Portal app and sign in with their Microsoft Entra ID work credentials.
3. Follow the prompts to enroll the device. This typically involves allowing a management profile to be installed, which grants Intune control over the device.

Android User-Driven Enrollment:

Android enrollment typically involves the Company Portal app and designating the device as a 'work profile' (for BYOD) or 'fully managed' (for corporate devices).

End-User Steps for Android (Work Profile Recommended for BYOD):

1. Download the Microsoft Intune Company Portal app from the Google Play Store.
2. Open the Company Portal app and sign in with their Microsoft Entra ID work credentials.
3. Follow the prompts. For BYOD, choose to set up a 'work profile'. For corporate devices, consider setting up as 'fully managed' if your organization prefers greater control.

Monitor Enrollment and Compliance:

As devices enroll, monitor their status in the Intune admin center to ensure they are compliant and receiving policies.

Portal verification: In the Intune admin center, go to Devices > All devices. Here you will see a list of all enrolled devices, their compliance status, and details about their configuration.