Getting Started with Microsoft Intune: Entra ID, Licensing, Domains, and Device Enrollment.

Eklal Budhathoki — Tue, 18 Aug 2026 05:15:36 +0000

As I continue developing my skills in IT Support and Microsoft cloud technologies, I have been exploring Microsoft Intune and its integration with Microsoft Entra ID.

Intune is more than just a tool for managing computers. It provides organizations with a centralized way to manage devices, applications, security policies, compliance, and user access.

This article documents my learning journey and some of the fundamental concepts I have been working through.

Understanding the Microsoft Environment

A typical Microsoft cloud environment involves several components working together, including:

Microsoft 365
Microsoft Entra ID
Microsoft Intune
Windows devices
Microsoft 365 licensing
Security and compliance policies

The first step is understanding how users, groups, licenses, identities, and devices interact with each other.

Microsoft Entra ID

Microsoft Entra ID, formerly known as Azure Active Directory (Azure AD), is Microsoft's cloud-based identity and access management platform.

It is used to manage:

Users
Groups
Devices
Applications
Authentication
Access permissions
Identity security

Creating a User

One of the fundamental tasks is creating and managing user accounts.

A typical user-management workflow includes:

Create the user account.
Configure the user's basic information.
Assign the appropriate license.
Add the user to required groups.
Configure authentication methods.
Apply appropriate security policies.

This provides the foundation for managing users across Microsoft 365 and Intune.

Multi-Factor Authentication (MFA)

Multi-Factor Authentication provides an additional layer of security beyond a username and password.

Instead of relying only on a password, users can be required to provide another form of verification.

Examples include:

Microsoft Authenticator
Security keys
SMS, where supported

Other authentication methods configured by the organization

MFA is an important component of identity security because compromised passwords alone should not automatically provide access to organizational resources.

Self-Service Password Reset (SSPR)

Self-Service Password Reset allows users to reset or change their passwords without requiring the IT Service Desk to manually reset them.

This can:

Reduce Service Desk tickets
Improve user productivity
Reduce password-reset workload
Provide users with greater control over their accounts

SSPR needs to be configured appropriately, including authentication methods and the users or groups to which the policy applies.

Groups

Groups are extremely important when managing Microsoft cloud environments.

Instead of configuring every user individually, administrators can use groups to apply common configurations.

Groups can be used for:

License assignment
Application deployment
Intune policies
Compliance policies
Access control
Security configurations

For example, an organization could create a group called:

IT-Department

Users in this group could automatically receive specific applications, licenses, or device-management policies.

This makes administration more scalable and easier to maintain.

Microsoft 365 Licensing

Licensing determines which Microsoft services and capabilities users can access.

When working with Microsoft 365, it is important to understand:

Available license types
Services included with each license
Security capabilities
Intune availability
Entra ID capabilities
User-based versus group-based licensing

Licenses can also be assigned to users through groups, which can make administration much easier in larger organizations.

For example:

User → Group → License

Instead of manually assigning a license to every user, administrators can configure group-based licensing where appropriate.

Custom Domains

Another important part of Microsoft 365 administration is configuring a custom organizational domain.

For example, an organization might initially have a Microsoft-provided tenant domain such as:

company.onmicrosoft.com

The organization may instead want users to sign in using:

user@company.com

The custom domain can be purchased and managed through a domain registrar such as GoDaddy and then added to the Microsoft environment.

The general process involves:

Register or manage the domain with the domain registrar.
Add the custom domain to Microsoft Entra ID/Microsoft 365.
Verify ownership of the domain.
Configure the required DNS records.
Update users with the appropriate domain.
Verify that authentication and Microsoft 365 services are working correctly.

This is an important practical concept because organizations typically want their Microsoft 365 identities to use their corporate domain.

Microsoft Entra Join and Hybrid Identity

Device identity is another important part of Microsoft's ecosystem.

Microsoft Entra Join

Microsoft Entra Join allows supported devices, particularly Windows devices, to be joined directly to the organization's cloud identity environment.

This can allow organizations to manage devices using cloud-based services such as Microsoft Intune.

Microsoft Entra Connect

Microsoft Entra Connect can be used to synchronize identities between an on-premises Active Directory environment and Microsoft Entra ID.

This is particularly useful for organizations that maintain traditional on-premises Active Directory while also using Microsoft cloud services.

A simplified environment can look like:

On-Premises Active Directory → Microsoft Entra Connect → Microsoft Entra ID → Microsoft Intune

Understanding this relationship is important when supporting organizations transitioning from traditional infrastructure to cloud-based identity and device management.

Microsoft Intune

Microsoft Intune is Microsoft's cloud-based endpoint management platform.

It can be used to manage:

Windows devices
macOS devices
iOS/iPadOS devices
Android devices
Applications
Security policies
Configuration policies
Compliance policies

From an IT Support perspective, Intune can help administrators standardize how organizational devices are configured and secured.

Intune Enrollment

Device enrollment is the process of registering a device with the organization's management environment so that Intune can apply management and security configurations.

There are several enrollment approaches depending on the platform and organizational requirements.

Company Portal

The Microsoft Intune Company Portal application allows users to enroll supported devices and access organizational applications and resources.

It can be used across multiple supported platforms, including:

Windows
macOS
iOS/iPadOS
Android

The exact enrollment experience depends on the operating system and organizational configuration.

Windows Automatic Enrollment

Windows devices can also be configured for automatic enrollment into Intune.

This allows organizations to automatically enroll devices when they meet the configured enrollment requirements.

Automatic enrollment is particularly useful in environments where administrators want device management to happen with minimal manual intervention.

Windows Autopilot

Windows Autopilot is designed to simplify the provisioning and deployment of Windows devices.

Instead of manually preparing every computer, organizations can configure devices so that they automatically receive the organization's required configuration during the setup process.

A simplified workflow looks like:

New Device → Windows Setup → User Sign-in → Autopilot Configuration → Intune Enrollment → Policies & Applications

This can significantly improve the efficiency of large-scale device deployments.

For example, an organization purchasing hundreds of laptops could configure them for Autopilot rather than manually installing and configuring every machine.

Intune and IT Support

From an IT Support perspective, learning Intune provides exposure to modern endpoint-management practices.

Some common areas an IT Support professional may encounter include:

Device enrollment
Device compliance
Application deployment
Windows configuration
Security policies
Device troubleshooting
User access
Microsoft 365 administration
Entra ID identity management
Conditional Access
Endpoint security

This connects traditional Service Desk responsibilities with modern cloud-based endpoint management.

My Learning Journey

My current focus is to understand how the different Microsoft technologies connect rather than learning each product in isolation.

The overall relationship can be viewed as:

User → Entra ID → Group → License → Intune → Device → Policy → Application

For example:

A new employee joins an organization.
An administrator creates the user's Entra ID account.
The user is added to the appropriate groups.
Required Microsoft 365 licenses are assigned.
MFA and other identity-security controls are configured.
The user's device is enrolled into Intune.
Required applications are deployed.
Configuration and security policies are applied.
Compliance is monitored.

Understanding this end-to-end process is helping me build a stronger foundation in Microsoft cloud administration and endpoint management.

Conclusion

Microsoft Intune and Microsoft Entra ID are important technologies for modern IT environments.

For an IT Support professional, understanding these technologies goes beyond simply knowing where to click in the portal. The real value comes from understanding how identity, licensing, devices, applications, policies, and security work together.

I am continuing to build my hands-on knowledge in:

Microsoft Entra ID
Microsoft Intune
Microsoft 365
Identity and Access Management
Device Enrollment
Windows Autopilot
Endpoint Management
MFA and SSPR
Group and License Management

This is an area I am particularly interested in developing further as I progress from traditional IT support toward modern endpoint and cloud administration.

DEV Community: Eklal Budhathoki

Getting Started with Microsoft Intune: Entra ID, Licensing, Domains, and Device Enrollment.

Understanding the Microsoft Environment

Microsoft Entra ID

Multi-Factor Authentication (MFA)

Self-Service Password Reset (SSPR)

Groups

Microsoft 365 Licensing

Custom Domains

Microsoft Entra Join and Hybrid Identity

Microsoft Intune

Intune Enrollment

Windows Automatic Enrollment

Windows Autopilot

Intune and IT Support

My Learning Journey

Conclusion