The intune admin portal is the browser console where IT teams run Microsoft Intune, at intune.microsoft.com. From that one tab you enroll laptops and phones, push settings, deploy apps and check device compliance. There is no on-premises server to maintain.
This guide covers how to sign in, which roles get access, and what each pane of the navigation rail does. It also walks through first-time setup, the licences you need, the platform connectors behind enrollment, and the four Microsoft consoles people confuse with it.
🛡️ Free: M365 Audit Checklist
19-page PDF with 50 hands-on checks covering Entra ID, Exchange Online, SharePoint, Teams, Intune, license waste, and audit logging. PowerShell commands included. Built from 60+ real tenant audits at Wintive.
🧭 What is the Intune admin portal
The Intune admin portal is the cloud console for Microsoft Intune, found at intune.microsoft.com. IT admins use it to manage devices, apps, compliance and endpoint security for a whole organization. It replaced the Intune blade of the Azure portal and the Microsoft Endpoint Manager admin center. Anyone with the right Microsoft Entra role can sign in and run every endpoint task from one screen.
Intune is Microsoft’s cloud service for unified endpoint management (UEM): it manages company devices and the apps on them. The Intune admin portal is the dashboard you drive that service from.
Two jobs sit at its core. Mobile device management (MDM) controls the whole device, while mobile application management (MAM) protects company data inside specific apps. Both live in the same menu, so a device policy and an app policy for any platform are set in one place.
The portal also pulls in nearby services: Microsoft Defender security tasks, Entra ID groups and Windows Autopilot. A normal day rarely needs another screen. Older shops are covered too. Co-management lets Intune and on-premises Configuration Manager run the same Windows PC together, which makes the move to the cloud gradual rather than a single cut-over.
🔗 How to access the Intune admin portal
There are three common ways into the console, and all of them land on the same page. The diagram below shows each route.
The direct route is fastest: go to intune.microsoft.com and sign in with your work account. From the Microsoft 365 admin center, select Show all, then Intune, and the same console opens. Both routes prompt for multi-factor authentication when the tenant requires it, and every admin account should.
🔁 Old URLs that still work
Microsoft has renamed this console twice. In 2023 the Microsoft Endpoint Manager admin center became the Microsoft Intune admin center, and its old address, endpoint.microsoft.com, still redirects you in. The original Intune blade in the Azure portal is retired. Any modern browser works, a phone included. Microsoft’s account sign-up guide has the official sign-in steps.
Intune login: signing in to the Microsoft Intune admin center
The Microsoft Intune admin center lives at intune.microsoft.com, and that is the login page to bookmark. Sign in with your work account. The tenant prompts for multi-factor authentication when it requires it, and every admin account should. A successful sign-in still needs a Microsoft Entra role that grants access. For daily work, the Intune Administrator role is the usual choice over Global Administrator. Anyone looking for the Microsoft Endpoint Manager admin center login ends up in the same place. That console was renamed in 2023, and endpoint.microsoft.com still redirects to the new one. The old Intune blade in the Azure portal is retired, so skip portal.azure.com. Any modern browser works, including one on a phone.
🏗️ First steps in the Intune admin portal
A fresh tenant needs three things before you manage anything. Check that the MDM authority is Intune; new tenants have it set automatically. Add the connectors for the platforms you support. Create the Entra groups your policies will target. Skip these and enrollment fails quietly on day one.
Enroll one pilot device per platform before any wide rollout, attach a simple compliance policy, and watch it apply. A broken connector then shows up on one device instead of five hundred.
Set your defaults while the tenant is empty. An enrollment restriction blocks the platforms you do not support. The device limit restriction caps how many devices one user can enroll: 5 by default, up to 15. A device-naming template gives machines tidy names from the start. All three take minutes now and hours later.
🔑 Who can sign in: roles and access
Not every account can open the portal; it takes a Microsoft Entra role that grants access. A Global Administrator can do everything, which is too much power for daily work, and Microsoft recommends keeping fewer than 5 Global Administrators per tenant. For most admins the right choice is the Intune Administrator role.
Below the tenant-wide roles sit Intune’s own RBAC roles, which limit what an admin can see and change. Pair a role with scope tags to fence an admin into one site or device group, and a branch technician sees only their branch. Microsoft’s role-based access control docs describe the full model.
🧾 List who holds admin access
You can audit access from PowerShell. This snippet connects to Microsoft Graph and lists every Intune RBAC role. Run it before each access review.
# Connect to Microsoft Graph and list Intune RBAC roles
Connect-MgGraph -Scopes "DeviceManagementRBAC.Read.All"
Get-MgDeviceManagementRoleDefinition |
Select-Object DisplayName, IsBuiltIn |
Sort-Object DisplayNameThe built-in roles are below. Give each admin the narrowest role that still covers their job.
| Built-in Intune role | What this admin can do |
|---|---|
| Intune Role Administrator | Manage custom roles and assignments |
| Policy and Profile Manager | Create compliance and configuration policies |
| Application Manager | Add, assign, and monitor apps |
| Endpoint Security Manager | Run antivirus, encryption, and EDR tasks |
| Help Desk Operator | Assist users and trigger remote actions |
| Read Only Operator | View everything, change nothing |
🧱 The Intune admin portal navigation rail
The left rail is the spine of the Intune admin portal, and each pane opens a full workspace. The map below shows all ten panes, with the Devices pane expanded.
Most work happens in the top four panes: Home, Devices, Apps and Endpoint security. The lower panes handle people, settings and support. Here is what each one controls.
| Pane | What you manage there |
|---|---|
| Home and Dashboard | Tenant status, alerts, and quick links |
| Devices | Enrollment, compliance, and configuration |
| Apps | App deployment and app protection policies |
| Endpoint security | Antivirus, encryption, firewall, and EDR |
| Reports | Compliance, configuration, and analytics data |
| Users and Groups | People and the groups you target policies at |
| Tenant administration | Connectors, roles, audit logs, branding |
| Troubleshooting + support | Per-user diagnostics and support tickets |
🖥️ Devices in the Intune admin portal
Admins spend most of their time in the Devices pane. It lists every enrolled device in one view, with a page per platform for Windows, iOS, macOS and Android. Enrollment starts here, and so do remote actions like wipe, restart and sync.
Three tools keep a large fleet manageable. Filters target a policy by rule, such as OS version or device model. Device categories sort machines into groups at enrollment. Bulk device actions restart or sync a whole selection of devices in one action.
🛡️ Compliance and configuration
Two policy types do the heavy lifting. Compliance policies set the rules a device must meet, such as encryption or a minimum OS version. Configuration profiles push the settings themselves, like Wi-Fi or a VPN. A device that fails compliance can lose access through Conditional Access. A Windows device checks in every 3 minutes for its first 15 minutes, every 15 minutes for the next 2 hours, then about every 8 hours. This snippet lists your managed devices and their compliance state.
# List enrolled devices and their compliance state
Connect-MgGraph -Scopes "DeviceManagementManagedDevices.Read.All"
Get-MgDeviceManagementManagedDevice |
Select-Object DeviceName, OperatingSystem, ComplianceState |
Sort-Object ComplianceState📲 How devices get enrolled
Each device enrolls through a method that fits how it is owned, and the portal has one for every case. You set them up once under Devices, then Enrollment.
Windows Autopilot ships a new PC straight to a user, configured out of the box, and a hybrid Azure AD join uses the Intune Connector for Active Directory behind the scenes. Bring your own device (BYOD) lets staff enroll a personal phone through the Company Portal. Apple automated device enrollment locks corporate iPhones to your tenant. Android Enterprise covers work profiles and fully managed phones. Every method lands the device in the same All devices list.
🪪 Personal versus corporate
Ownership changes what you can do. On a corporate device you manage everything; on a personal one you touch only work data, never photos or messages. A wipe on a BYOD phone removes the company files alone, which protects privacy and keeps staff trust.
📦 Apps: deploy and protect
The Apps pane handles software for every platform. You add an app once and assign it to a group, and the assignment intent decides what happens: Required forces the install, Available lists it in the Company Portal, Uninstall removes it.
Four app types cover most needs: store apps from the Microsoft, Apple and Google stores, line-of-business apps such as an in-house installer, Win32 apps that wrap a classic Windows installer for finer control, and web links pinned as apps. All of them assign the same way.
🔏 App protection policies
App protection policies (APP) guard company data inside an app, for example by blocking copy and paste from Outlook into a personal app. They work on phones that are not enrolled, which is how you protect data on personal devices without managing the whole phone.
You can layer both. A managed laptop can carry an app protection policy as well, which adds a second ring of data protection inside the device.
🛡️ Endpoint security workloads
The Endpoint security pane groups the defensive tools, one focused workload each. Antivirus tunes Microsoft Defender. Disk encryption manages BitLocker on Windows and FileVault on macOS. Firewall and endpoint detection and response push rules to every device.
Two more workloads harden devices. Attack surface reduction blocks risky behaviour, like a macro launching a script. Security baselines apply Microsoft’s recommended settings in one step, which gives a new tenant a strong floor to tune from.
Conditional Access ties it together: it checks a device’s compliance before granting access to email or files. A jailbroken or unencrypted device is turned away at sign-in, and device management becomes security rather than an inventory.
Wintive insight. In the tenants we manage, the portal is rarely the problem; access is. Admins sign in as Global Administrator and skip scope tags, so one mistake hits every device at once. We assign the Intune Administrator role, add a scope tag per site and keep Global Admin for break-glass accounts only. That one habit prevents most self-inflicted outages.
📊 Reports and monitoring
The Reports pane turns device data into answers: device compliance, configuration and app install reports. Endpoint analytics goes further and scores startup time, app reliability and the work-from-anywhere experience.
Three reports earn their keep daily. The device compliance report flags every failing device, Noncompliant devices shows why, and app install status lists failed deployments. Each one exports to CSV or reads through Microsoft Graph into Power BI or a ticketing tool, which gives an auditor numbers instead of screenshots.
Set a baseline early. Endpoint analytics compares your scores with your own history and with peer organizations, so you can tell whether a change helped or hurt. Slow boots and crashing apps show up there before users complain.
🧩 Licences for the Intune admin portal
Opening the portal is free, but every managed user needs an Intune licence. You buy Intune on its own or get it inside a bundle.
Most small firms already own it. Intune ships inside Microsoft 365 Business Premium (up to 300 users), Microsoft 365 E3 and E5, and the Enterprise Mobility + Security plans. Our guide to Microsoft 365 Business plans shows which tiers include it. Standalone buyers start with Intune Plan 1, and our Intune pricing guide lists what each tier costs.
A free Intune trial is available from the portal, and the Intune Suite has its own. Pilot an add-on like Remote Help on a few users, and license it once the value is clear.
The paid add-ons unlock advanced tools. Intune Plan 2 adds Microsoft Tunnel for mobile and management of specialty devices. The Intune Suite bundles Remote Help, Endpoint Privilege Management, Advanced Analytics and Cloud PKI. Most SMBs never need them; larger or regulated teams often do.
🎛️ Customize the admin center
The Settings gear at the top right sets your default startup pane, dark mode and language. It is also where you switch tenants if you manage more than one.
📌 Dashboards and tiles
The Dashboard is yours to shape. Select Edit to move tiles, or build a private dashboard from the Tile Gallery. Publish it and your team opens the same view each morning.
🔌 Tenant administration and connectors
Tenant administration holds the settings that make the whole portal run: connectors, roles, audit logs and enrollment rules. Most of it is set once.
Connectors let Intune talk to each platform. Apple devices need an Apple MDM push certificate, valid for 365 days and renewed with the same Apple ID. iOS app licences flow through an Apple VPP token, and Android relies on the Managed Google Play link. If the Apple certificate expires, Intune loses contact with every Apple device, so put the renewal date in a calendar.
🧹 Roles, audit logs, and clean-up
This pane also holds the housekeeping. Intune RBAC roles and scope tags are assigned here. The audit log records every change with the admin and the time. Device clean-up rules retire devices that have not checked in for 30 to 270 days, a value you choose, which keeps the device list honest.
🔀 Intune admin center vs other portals
People mix up four Microsoft consoles that look alike but do different jobs. The matrix below sorts them out.
The key split is admin versus user. IT admins work in the Intune admin center, while end users open the Company Portal to enroll their own device and install apps; our Company Portal guide covers that side. Identity work lives in the Entra admin center, billing and licences in the Microsoft 365 admin center.
The Azure portal still shows up in old tutorials, but its Intune blade is retired. A guide that sends you to portal.azure.com for Intune is out of date.
🧰 Intune admin portal best practices
A few habits keep the portal safe and tidy. They cost nothing and prevent the messes we clean up most often.
- Use named admin accounts. Never share one login.
- Require MFA on every admin. No exceptions.
- Assign Intune Administrator, not Global Admin. Save Global for break-glass.
- Add scope tags. Fence each admin to their site or group.
- Review audit logs monthly. Know who changed what.
The audit log is your memory: every policy change, with the admin and the timestamp. This snippet pulls the latest entries from Microsoft Graph, which is the quickest way to trace an incident.
# Pull the latest Intune audit-log events
Connect-MgGraph -Scopes "DeviceManagementApps.Read.All"
Get-MgDeviceManagementAuditEvent -Top 20 |
Select-Object DisplayName, Activity, ActivityDateTime |
Sort-Object ActivityDateTime -Descending🩺 Troubleshooting the Intune admin portal
When a single user is stuck, start in Troubleshooting + support. The Troubleshoot blade shows that user’s devices, policies and app assignments on one page, so you can see why a policy did not apply.
The blade also shows enrollment failures with a reason code. Instead of a vague “it will not enroll”, you get the exact step that broke, and fixing that step lets the device join.
Two more tools live here. Service health tells you whether an outage is on Microsoft’s side. Help and support opens a ticket with Microsoft, which needs a support role such as Service Support Administrator, so grant it before you need it.
✅ Intune admin portal quick-reference
Here is how a well-run portal looks in the field.
- Bookmark intune.microsoft.com and drop the old URLs.
- Sign in with a named account that has the Intune Administrator role.
- Create scope tags before you onboard a second admin.
- License every managed user, usually through Business Premium or E3.
- Add the Apple and Google connectors before you enroll those devices.
- Set security baselines first, then tune from that floor.
- Turn on MFA for admins, and review the audit log monthly.
- Use the Troubleshoot blade before escalating any ticket.
At Wintive we set up and run the Intune admin portal for SMBs as part of our Microsoft 365 managed services: we harden access, build the policies and document them. To get started, contact us for a free consultation.
🆕 How the Intune admin portal changes
The Intune admin portal changes all the time. Microsoft ships Intune updates every month, new settings appear and panes move. A screenshot from last year may not match what you see today.
Two habits keep you current. Read the What’s new page in the portal before you plan a big change. Watch the Message center in the Microsoft 365 admin center for advance notice of retirements.
📚 More for IT admins
These Wintive guides go deeper on the topics the portal raises next.
🔍 Want a complete audit of your Microsoft 365 tenant?
The M365 Instant Audit scans your environment in under 10 minutes: license waste, security posture, MFA coverage, compliance gaps, and rightsizing. A full PDF report with prioritized fixes arrives instantly.
❓ Frequently Asked Questions
It is the cloud console for Microsoft Intune, at intune.microsoft.com. IT admins use it to manage devices, apps, compliance, and endpoint security for an organization from one screen.
Go to intune.microsoft.com and sign in with your work account. You can also open it from the Microsoft 365 admin center under Show all, then Intune. The old endpoint.microsoft.com address still redirects in.
You need a Microsoft Entra role with access. Global Administrator works but is too broad. The Intune Administrator role is the right tenant-wide choice, and Intune RBAC roles narrow it further.
Opening the portal is free. Managing a user needs an Intune licence on that user. Intune is included in Microsoft 365 Business Premium, E3, E5, and the Enterprise Mobility + Security plans.
You do not add devices by hand. Users enroll their own device through the Company Portal, or you use Windows Autopilot. The device then appears under Devices, All devices in the admin center.
No. The admin center is for IT admins to manage the whole fleet. End users instead open the Company Portal app to enroll their device and install approved work apps.
🧭 Your next step
Want the portal set up right? Book a short call: we audit your tenant, harden admin access, then build and document the policies. To start, contact Wintive.