Microsoft Intune management for your laptops and phones

Microsoft Intune is Microsoft’s cloud-based mobile device management (MDM) and app management service. It lets you configure, secure and update Windows, macOS, iOS and Android devices from one place, without servers in your office. The tool is powerful but doesn’t configure itself: policies have to be designed, tested and maintained as Microsoft updates the platform. Unlike a one-time Intune consultant, Nexxo keeps managing it after setup, watches compliance and handles new devices, departures and lost devices for you.

Usually not. Intune is included in Microsoft 365 Business Premium, along with Microsoft Entra ID P1 for Conditional Access and Microsoft Defender for Business for endpoint protection. Many SMBs already pay for what they need but have never set it up. Intune is also available on its own or as an add-on for other plans. During our assessment, we check what your licences include and whether a separate tool would bring anything extra.

Yes. For personal phones, we usually don’t enroll the whole device. App protection policies apply only to work apps such as Outlook, Teams and OneDrive: they can require a PIN, block copying work data into personal apps and remove company data when someone leaves. Your company can’t see personal photos, messages or apps, and the employee’s own content is not wiped. It is a fair balance between protecting company data and respecting employee privacy.

The main factors are the number of users and devices, the mix of Windows, Mac, iPhone and Android devices, whether personal phones are in scope, the Microsoft licences you already have and how many business apps need to be packaged and deployed. Setting up Intune for the first time, or moving from another tool, is scoped as a one-time project. After a short assessment, we give you a clear quote, with no surprises.

Yes. Whether your devices are managed by another MDM, by on-premises Group Policy or not managed at all, we plan the move in stages. We recreate the settings that matter in Intune, test them with a pilot group and then enroll the rest of your devices. Some devices may need to be re-enrolled or reset along the way, and we schedule that work to avoid disrupting your team.

Lost and stolen devices are a common source of confidentiality incidents. Intune helps limit the damage: devices are encrypted, company data can be wiped remotely and compliance reports show each device’s status. Those records help you assess whether an incident presents a risk of serious injury and document it in your incident register. Intune supports your obligations but doesn’t replace your own policies or legal advice, and you still need a person in charge of personal information protection.

Tell us right away. For a company device, we can wipe it completely or retire it, which removes company data, apps and settings. For a personal phone, we remove only the work data in apps like Outlook, Teams and OneDrive. Combined with disabling the person’s account, this quickly closes access to company information. Each action is recorded, which helps if the loss has to be documented as a confidentiality incident.

Our team enrolls new devices, prepares laptops for new hires, removes devices for departing employees and helps users who are blocked because a device fell out of compliance. We watch update status, encryption and compliance reports proactively, and adjust policies as your needs change or Microsoft updates Intune. Support is available 24/7 from a dedicated team, so a blocked employee or a lost phone gets attention whenever it happens.