Microsoft Intune Admin Portal: The Complete Guide (2026)

The Microsoft Intune admin portal is your command center for managing every device, app, policy, and user in your organization — all from a single browser tab. Whether you’re deploying your first compliance policy or troubleshooting a fleet of 10,000 endpoints, everything runs through this one console.

In this guide we’ll walk through exactly what the Intune admin portal is, how to access it, what each section does, and how experienced admins use it day-to-day — including the parts Microsoft’s own documentation glosses over.

What Is the Microsoft Intune Admin Portal?

The Microsoft Intune admin portal — officially called the Microsoft Intune admin center — is the web-based console where IT administrators configure and manage Microsoft Intune. It lives at intune.microsoft.com and replaced the older endpoint.microsoft.com address (which still redirects correctly).

Think of it as the dashboard for your entire endpoint management strategy. From here you can:

• Enroll and manage Windows, macOS, iOS, and Android devices
• Deploy, update, and remove applications across your fleet
• Create and push configuration profiles and security policies
• Monitor device compliance and enforce Conditional Access
• Manage software updates, including third-party app patching
• Configure role-based access for your IT team

The portal is entirely cloud-based and tied into Microsoft Entra ID (formerly Azure AD). You don’t need a VPN, an on-premises server, or any local agents to use it — everything is managed through the browser from anywhere.

Intune vs. the Intune Admin Portal — What’s the Difference?

Intune is the underlying cloud service. The admin portal is the web interface you use to drive that service. Intune does the actual work — enforcing policies, deploying apps, checking compliance — while the portal is where you tell it what to do. This distinction matters when troubleshooting: if a policy isn’t applying, the problem could be in the portal configuration or in Intune’s sync process — they’re separate layers.

A Brief History of the Name Changes

Microsoft has renamed this console twice, which causes ongoing confusion:

• Pre-2020: The Intune blade inside the Azure portal (portal.azure.com)
• 2020–2022: Microsoft Endpoint Manager admin center (endpoint.microsoft.com)
• 2022–present: Microsoft Intune admin center (intune.microsoft.com)

All three addresses either redirect or still work. If you see “Microsoft Endpoint Manager” in older documentation, it means the same thing.

How to Access the Intune Admin Portal

URL

Go directly to: https://intune.microsoft.com

You can also reach it via the Microsoft 365 admin center → Admin centers → Intune, or through portal.azure.com if you prefer working inside Azure.

What You Need to Log In

To access the portal you need:

• A Microsoft Entra ID (Azure AD) account
• An Intune license (included in Microsoft 365 Business Premium, E3, E5, or as a standalone EMS license)
• An Entra role that grants Intune access (see the RBAC section below)

If you can reach the URL but the Intune menu is missing or greyed out, the most common cause is a missing license assignment — check the user’s license in Microsoft 365 admin center.

Browser Requirements

The portal works in any Chromium-based browser (Chrome, Edge, Brave) and Firefox. Microsoft Edge is the safest choice for full feature support. Safari works but has occasional rendering issues with some reports and charts.

Navigating the Portal: Section by Section

When you log in, you land on the Home dashboard. The left navigation panel is your primary way to move through the console. Here’s what each major section does:

Home

A customizable dashboard showing quick stats: enrolled devices, non-compliant devices, app deployment status, and any active alerts. You can pin additional tiles from other sections here.

Dashboard

A more detailed overview with device compliance charts, app installation reports, and service health status. Good for a morning check — it’ll surface anything that needs attention before you start work.

Favorites

Any blade you star gets pinned here. Experienced admins typically star: All Devices, All Apps, Compliance Policies, and Configuration Profiles — the four places they spend most time.

Devices

Where you manage every enrolled endpoint. Covered in detail in the next section.

Apps

Deploy, configure, and monitor applications across all platforms. Windows, macOS, iOS, Android — all managed from the same place.

Endpoint Security

Security-focused policies: antivirus, disk encryption, firewall, endpoint detection & response, and attack surface reduction. These sit separately from general configuration profiles because they’re typically owned by the security team rather than IT ops.

Reports

The most underused section of the portal. Intune generates detailed reports on device compliance, app installation status, update deployment, and policy assignment. Many admins export these to Power BI for dashboards — you can link the Intune data connector directly from this section.

Users & Groups

These pull through from Entra ID. You don’t manage users in Intune directly — you manage them in Entra ID and then target Intune policies at Entra groups. If you’re assigning a policy and can’t find the right group, check whether it exists in Entra ID first.

Tenant Administration

Where you configure tenant-wide settings: connector configurations (Apple Business Manager, Google Workspace, etc.), audit logs, diagnostic settings, and the Terms of Use agreements that pop up on enrollment.

Device Management

The Devices section is where most day-to-day admin work happens. The key sub-sections:

All Devices

A flat list of every enrolled device. You can filter by platform, compliance state, enrollment type, or any device property. Clicking a device opens its full profile — hardware inventory, installed apps, applied policies, compliance status, and a direct channel to send remote actions.

Remote Actions

From any device’s profile you can trigger remote actions without touching the device:

• Sync — forces an immediate policy check-in (the most-used action — saves waiting for the default 8-hour sync cycle)
• Restart — remote reboot
• Wipe — factory reset (irreversible — use carefully)
• Retire — removes company data but leaves personal data intact (BYOD scenarios)
• Collect diagnostics — pulls logs from the device without needing the user to do anything
• Run remediation — triggers a specific remediation script

Configuration Profiles

Profiles push settings to devices — Wi-Fi, VPN, certificates, email, kiosk mode, update rings, and hundreds of other settings via the Settings Catalog. The Settings Catalog replaced most of the old template-based approach and is now the recommended way to configure almost everything.

Policy Sets

Group multiple apps, policies, and profiles into a single bundle that can be assigned to a group in one step. Useful for onboarding new device types or standardizing configurations across sites.

Windows Autopilot

Autopilot lets you ship devices directly to end users and have them self-enroll and self-configure out of the box. Devices need to be registered in Autopilot before they arrive — either by the hardware vendor (OEM) or by importing a hardware hash CSV file in the portal.

App Management

The Apps section manages the full lifecycle of applications across your device fleet.

App Types You Can Deploy

• Microsoft Store apps — direct from the Store, no packaging required
• Win32 apps — traditional desktop apps packaged as .intunewin files using the IntuneWinAppUtil tool
• Line of business (LOB) apps — MSI or APPX installers uploaded directly
• Web apps — pinned shortcuts to web URLs, deployed as apps on the device
• Microsoft 365 Apps — the full Office suite, configurable by channel and component
• Enterprise App Catalog apps — Microsoft-maintained package library (available with premium add-on)

Assignment Types

Every app in Intune has three assignment options:

• Required — installs automatically on target devices
• Available — appears in Company Portal for users to install optionally
• Uninstall — removes the app from target devices

App Protection Policies

Separate from deployment — these wrap managed apps in a security layer that controls copy/paste, screenshots, and data transfer. Critical for BYOD scenarios where you don’t control the device but need to protect company data in specific apps like Outlook or Teams.

Third-Party App Updates — The Gap Intune Doesn’t Fill Natively

This is one of the most significant limitations of the Intune admin portal as a standalone tool: Intune does not automatically update third-party Win32 applications after deployment.

Once you deploy Chrome, 7-Zip, Zoom, or any other third-party app via Win32, Intune won’t update it unless you manually re-package the new version, upload it, and reassign it. For environments with dozens of applications across hundreds of devices, this creates a constant patching backlog — and a real security exposure.

This is exactly the problem Always Up To Date was built to solve: fully automated packaging and deployment of third-party app updates directly into your Intune tenant, without any manual repackaging work on your side. The Windows Autopatch section below covers Microsoft’s own answer to part of this problem.

Compliance & Conditional Access

Compliance Policies

Compliance policies define what “compliant” means for each device platform. Common requirements:

• Minimum OS version
• BitLocker encryption enabled
• Antivirus up to date and active
• Device not jailbroken/rooted
• PIN or password required
• Microsoft Defender threat level below a threshold

Devices that fail compliance are marked non-compliant. By itself, that’s just a flag — the device can still access resources. The real enforcement comes when you tie compliance status to Conditional Access.

Conditional Access

Conditional Access policies live in Entra ID but are visible and linkable from the Intune portal. They let you say: “Only allow access to Exchange Online if the device is Intune-enrolled AND compliant.” This is the combination that actually enforces security — non-compliant devices lose access to company resources automatically, without IT having to manually block anything.

The recommended setup for most organizations:

1. Create Intune compliance policies per platform
2. Set a grace period (7–14 days) before enforcement kicks in for newly non-compliant devices
3. Create a Conditional Access policy requiring compliant devices for all cloud apps
4. Exclude break-glass accounts and service accounts from the CA policy

Common Compliance Troubleshooting

If a device shows as non-compliant but you think it should be compliant:

• Check the device’s compliance status details in All Devices — it’ll show which specific rule is failing
• Force a sync (Remote Actions → Sync) and wait 5 minutes before checking again
• Check whether the compliance policy is actually assigned to a group containing the device
• Review the Intune Management Extension logs on the device at C:\ProgramData\Microsoft\IntuneManagementExtension\Logs

Software Updates & Patching

Windows Update for Business (WUfB)

Intune controls Windows Update behavior through Update Rings — policies that define how and when Windows updates are installed. Key settings per ring:

• Deferral period — how many days after Microsoft releases an update before it rolls out to this group (e.g., 7 days for IT, 21 days for general staff)
• Active hours — when the device is in use and shouldn’t restart
• Deadline — maximum number of days before the update is forced even if the user keeps deferring

Best practice is a ring structure: Pilot group (0-day deferral, 5–10 devices) → Early adopters (7-day deferral) → General (21-day deferral) → Critical systems (28-day deferral).

Windows Autopatch

Windows Autopatch (available with Windows Enterprise E3+) automates the entire update ring management process. Microsoft manages the ring assignments and handles the gradual rollout logic. See our Windows Autopatch guide for a full breakdown.

Third-Party Application Patching

As mentioned in the Apps section, this is the area Intune leaves largely unaddressed. The three main approaches organizations use:

1. Manual repackaging — package every update as a new Win32 app. Time-consuming, error-prone, and doesn’t scale past about 20 applications.
2. Enterprise App Catalog — Microsoft’s premium add-on provides pre-packaged updates for a catalog of common apps. Limited catalog size and requires the Microsoft Intune Suite add-on license.
3. Third-party automated patching services — tools like Always Up To Date, built on Patch My PC, automate packaging and delivery of 2,000+ app updates directly into your Intune tenant. No manual work on your side, and the updates are tested before delivery.

Roles, Permissions & RBAC

Access to the Intune admin portal is controlled at two levels:

Entra ID Roles (Tenant-Wide)

• Global Administrator — full access to everything in the tenant. Use sparingly.
• Intune Administrator — full Intune access without broader tenant permissions. The right choice for senior IT admins who only need Intune.
• Global Reader — read-only access across the tenant including Intune. Useful for auditors.

Intune RBAC Roles (Scoped)

Within Intune, you can create custom roles with specific permissions and combine them with scope tags to limit what an admin can see and manage. For example:

• A helpdesk role that can view devices and trigger remote sync, but can’t create or delete policies
• A site-specific role that only sees devices tagged with a particular location

To set this up: Tenant Administration → Roles → Create → assign permissions → add scope tags. This is often skipped in smaller environments but becomes critical at scale — you don’t want a tier-1 helpdesk technician able to wipe devices or delete compliance policies.

Real-World Admin Tips

These are the things you learn from running Intune day-to-day that Microsoft’s documentation doesn’t surface clearly:

Force Sync Before Troubleshooting

The default Intune policy sync cycle is 8 hours. Before spending any time troubleshooting why a policy “isn’t working,” always trigger a manual sync from the device’s profile page (Remote Actions → Sync). Then wait 5 minutes. Half of all reported Intune issues resolve themselves after a forced sync.

Use Filters Instead of Separate Groups

Intune Filters let you target policies and apps at dynamic device subsets without creating new Entra groups. Filter by OS version, device model, enrollment type, or any device property. This reduces group sprawl significantly — instead of 15 different device groups, you might need 3 groups with filters applied at assignment.

Audit Logs Are Your Best Friend

Tenant Administration → Audit Logs records every change made in the portal — who changed what, when, and from which IP. When something breaks and you need to know what changed, this is where you start. Filter by date and resource type to narrow quickly.

Test Policies in a Pilot Group First

Never assign a new compliance policy or configuration profile directly to “All Devices.” Even a small misconfiguration in a BitLocker policy can lock users out of their machines at scale. Always test on a 5–10 device pilot group first, confirm it works, then expand the assignment.

The Settings Catalog Beats Templates

The Settings Catalog (Devices → Configuration → Create → Settings Catalog) gives you access to thousands of individual settings with a searchable interface. The older Administrative Templates and Device Restriction profiles are being deprecated in favor of the Catalog. If you’re creating new profiles, start with the Catalog.

Automating the Work Inside the Portal

The Intune admin portal is a UI on top of the Microsoft Graph API, which means almost everything you can do in the portal can also be automated via script or third-party tool.

PowerShell + Microsoft Graph

The Microsoft.Graph.Intune PowerShell module lets you read and write Intune configuration programmatically. Common automation use cases:

• Bulk-enroll devices from a CSV without using Autopilot
• Export all device compliance states to a report
• Create or update compliance policies across multiple tenants
• Trigger remote sync on all non-compliant devices automatically

Third-Party Application Patching Automation

The most time-consuming manual task in the Intune admin portal is managing Win32 app updates. Every new version of every third-party app requires you to re-package, re-upload, and reassign it. In an environment with 30–50 applications, this can consume 10–20+ hours of admin time per month.

Always Up To Date connects to your Intune tenant via secure Azure App Registration (using least-privilege Graph API permissions) and handles the entire packaging-and-delivery workflow automatically. When a new version of Chrome, Zoom, or 7-Zip releases, it’s packaged, tested, and pushed into your tenant without you doing anything. The savings in admin time typically pay for the service within the first week of each month.

Frequently Asked Questions

---