When was your Intune environment last reviewed?

Device management is easily perceived as a large project that takes time from both the IT department and end users. Devices need to be deployed, settings aligned, and applications installed. In the worst case, an employee has to wait for their work equipment or figure out on their own why something isn't working. 

With modern Intune device management, this can be made considerably smoother. But one thing is easily forgotten: device management is not finished when the deployment project ends. 

What are the practical benefits of modern device management? 

Microsoft Intune allows a company's computers, mobile devices, applications, and security settings to be managed centrally over the internet. In practice, this means that the device does not need to be on the company's internal network for settings to be applied or for its security to be managed. 

What does this mean in day-to-day work? 

In traditional device management, deploying a new computer may have required IT procedures, a network connection to the corporate environment, or even bringing the machine on-site for installations with the help of local support. The distribution of settings and software could also be dependent on the corporate intranet or third-party products that require updates. 

In a modern environment, a new computer can be delivered directly to the user. When the user logs in with their credentials, the settings, applications, and security policies configured for the machine are deployed automatically. IT does not need to be present performing every step. The role of IT can be thought of as shifting more toward support rather than manual execution. 

At its best, deployment works just as well at the office as at home or sitting on a pier at the cottage. The same applies to ongoing maintenance. Settings and applications can be updated remotely, and compliance with security requirements can be monitored centrally. The user doesn't have to worry about everything themselves, and IT doesn't have to make every change manually. 

With Intune, applications can also be offered to users via the Company Portal app. This allows users to install the applications they need without local administrator rights, provided that application distribution and permissions are properly configured for this purpose.

The goal is simple: IT time should not be wasted on unnecessary manual work, and users should be able to get their work done as smoothly as possible. 

Deployment is only the beginning 

In many companies, Intune is deployed as part of developing the Microsoft 365 environment. Devices are enrolled in the service, the required settings are configured, and application distribution is up and running. The project is completed and everything looks good. 

At this point, however, it is easy to assume that the job is done. 

In reality, the Intune environment evolves just like the rest of the IT environment. Microsoft introduces new features to the service, Windows develops, security requirements change, and the company's own needs evolve. Operating models related to devices and applications may also change over the years. 

What worked well two years ago is not necessarily the smartest way to do things today. A good example is that when Windows 11 was on its way, many companies wanted to restrict its rollout, and in some cases, this was managed manually. Today, when Windows 11 is the only supported operating system, such manual maintenance is often no longer necessary; instead, deploying new Windows 11 versions can also be automated, either with or without piloting. 

Therefore, what matters is not merely that Intune has been deployed. It is equally important to ensure that the environment remains functional, secure, and fit for purpose even after deployment. 

What should you look for in an older Intune environment? 

When reviewing an environment again after a few years' hiatus, you can encounter a surprising number of small things that could be done better. Not all of them are actual errors. Some have simply lingered from a time when needs or technical capabilities were different.

1. Microsoft introduces new features – are we utilizing them? 

Intune is constantly evolving. New features can simplify management or provide better ways to implement previously used solutions. 

For example, the environment may have legacy configurations implemented with scripts or custom workarounds, even though the same thing could now be handled directly with Intune's built-in features. 

It is also worth checking whether the active settings are still supported and compatible with the Windows versions in use. 

With regular reviews, unnecessary complexity can be eliminated, and new features can be adopted when they provide real value. 

2. Are security settings still up to date? 

Endpoints are an essential part of enterprise security. They are used to process company data, access cloud services, and sign in to various systems. 

That is why it is not enough for security settings to have been configured once upon a time. Their implementation and currency must also be monitored. 

A review might reveal, for instance, deficiencies in disk encryption, outdated security policies, overly permissive settings, or devices that do not meet company requirements. 

At the same time, it is worth checking whether device compliance data is also utilized in Conditional Access. This allows access to corporate data to be restricted in situations where a device does not meet the defined requirements. 

A single deficiency does not necessarily mean a major security issue, but multiple minor shortcomings can add up to a significant overall risk.

3. Has device management kept pace with changes in the company? 

A company does not stay the same from year to year. Employee roles change, new applications are introduced, and working methods evolve. 

If device management is not updated alongside these changes, the result can be wasted effort or unnecessary restrictions. 

For example, a new application might be manually installed for every user because its deployment hasn't been configured in Intune. Or an employee may have to find a workaround because an existing security policy blocks a necessary function. 

In such situations, the problem is not necessarily Intune itself. It may be that the environment no longer aligns with the company's current operations. 

Well-designed device management makes work easier while maintaining strong security. 

4. Has the environment become unnecessarily complex? 

This is a good reason to examine an older Intune environment as a whole. 

Over the years, profiles, policies, exceptions, and various configurations accumulate in the environment. A clear owner or justification might no longer exist for all of them. 

For example, the same setting might be managed by several different policies. One configuration permits an action and another restricts it. As a result, some devices may behave differently than others, and troubleshooting takes time. 

When there are numerous configurations, maintaining them also becomes more difficult. The impact of changes is harder to evaluate, and the risk of errors increases. 

That is why you shouldn't only look at what to add to the environment. It is equally important to determine what can be removed. 

Intune Health Check – what should be reviewed in the environment? 

Reviewing an Intune environment does not have to be a massive project. The appropriate scope depends on the size and complexity of the environment, and how well current practices are understood. 

A good baseline is to review the environment at least once a year, as well as whenever significant changes occur in the company's needs or IT environment. 

The review should cover at least the following areas: 

Device and security policies 

• Are there overlapping configurations or mutually conflicting settings in use? 

• Are the policies still necessary and supported? 

• Do the devices meet the company's security requirements? 

Compliance and Conditional Access 

• Is compliance defined appropriately? 

• Is device compliance utilized in access control? 

• Do conditional access policies match current needs? 

Windows Autopilot 

• Are the operating models still appropriate? 

• Could Autopilot's current features simplify deployment? 

• Are only necessary applications and configurations included in pre-provisioning and deployment? 

• Would moving to newer Autopilot deployment methods be beneficial? 

Application distribution 

• Are distributed applications and their versions up to date? 

• Are unnecessary applications being deployed? 

• Could manual installation work be automated? 

Update management 

• Does the update policy meet the company's needs? 

• Are update installations and their success adequately tracked? 

• Is a dedicated pilot group needed before broader update deployment? 

Device inventory and legacy configurations 

• Are there stale or unnecessary device records in the environment? 

• Are automated cleanup rules configured correctly? 

• Are there configurations, applications, or exceptions in the environment that are no longer needed? 

Reporting and monitoring 

• Is an adequate overall view of the environment available? 

• Are gaps related to updates, security, and compliance visible? 

• Are there sufficient insights and operating models for troubleshooting? 

The most important outcome of a review is not the longest possible list of observations. What is more essential is identifying which items should be addressed first and which changes provide the greatest value relative to the amount of work required. 

A review does not mean rebuilding everything from scratch 

Auditing an Intune environment might sound like a massive undertaking, but you can often get started with a relatively small amount of effort. 

A Health Check lasting a few hours or a few days may be sufficient to identify the key areas for development. However, the exact workload depends on the scale and complexity of the environment. 

Nor does everything have to be fixed at once. First, the most critical security gaps can be resolved, followed by simplifying management, and finally improving automation or reporting. 

A good outcome can be as simple as removing obsolete configurations, automating application deployment, or clarifying update policies. These can save IT time and reduce user-facing issues without significant investments. 

Finally: when was Intune last checked? 

Intune offers excellent tools for managing corporate devices, automating deployments, and enhancing security. However, the benefits don't materialize simply by deploying the service. 

The environment also needs to be maintained and developed. Otherwise, outdated policies, unnecessary exceptions, and practices that no longer meet the company's needs will gradually start to accumulate. 

That is why it's worth pausing once in a while to check what state your environment is really in.

 When was your Intune environment last reviewed?