Managing Systems with Microsoft Intune: From Device Management to Operational Visibility

Microsoft Intune is a core management platform for organisations using Microsoft 365. It provides IT teams with a cloud-based way to manage Windows PCs, mobile devices and other endpoints without relying on traditional on-premises infrastructure.

For many organisations, however, simply having Intune is only the beginning.

As the number of devices, applications, policies and users grows, the challenge changes from “Can we manage this device?” to “Can we see what needs attention, understand why, and take the appropriate action?”

That is where combining Microsoft Intune with CIQ® Cloud can provide a different approach to endpoint management.

Rather than replacing Intune, CIQ Cloud builds on its capabilities, using Microsoft 365 and Intune data to provide broader Operational Visibility and a more accessible management experience.

What can Microsoft Intune manage?

Microsoft Intune is Microsoft's cloud-based endpoint management platform and forms an important part of the Microsoft 365 management ecosystem.

Depending upon licensing, configuration and device type, organisations can use Intune for capabilities including device enrolment, configuration management, security policies, application deployment, compliance management and Windows update management.

For Windows environments in particular, Intune can become the central management platform for much of the device lifecycle.

A typical organisation might use it to enrol Windows 11 computers, deploy Microsoft 365 applications, configure security settings, enforce BitLocker encryption, deploy software, distribute PowerShell scripts and control Windows Update policies. Now E3 license include Remote Help capabilities without the need for 3rd party solutions.

Android, iOS/iPadOS and macOS devices can also be incorporated into the management environment.

This makes Intune extremely powerful. But powerful management platforms inevitably generate another challenge: visibility.

Management is not the same as visibility

Consider an organisation managing several thousand endpoints.

Intune may contain all the information required to determine whether those devices are compliant, patched and correctly configured. The administrator can investigate individual devices, policies, applications and deployment results through the Microsoft management portals.

But operational teams rarely start their working day asking:

"Which Intune blade should I look at today?"

They are more likely to ask:

"What needs my attention?"

That distinction is important.

Operational Visibility is about turning the underlying management data into information that helps IT teams understand the current state of their environment, identify exceptions and decide where action is required.

CIQ Cloud is designed to provide this additional layer.

CIQ Cloud + Microsoft Intune

CIQ Cloud can use Microsoft Intune as one of its operational data sources.

Instead of attempting to recreate Microsoft's endpoint management platform, CIQ Cloud can surface and analyse the information that Intune already holds and make it available alongside information from the wider Microsoft 365 environment.

This allows endpoint information to become part of a much broader operational picture.

For example, a technician investigating a user may need to understand their Microsoft 365 account, assigned licences, devices, applications, security posture and other services.

Without a consolidated view, this information can require navigating between multiple Microsoft portals and management interfaces.

CIQ Cloud aims to bring that information together.

From visibility to management

Visibility is only part of the process. There are situations where an administrator identifies an issue and then needs to take action through Intune.

CIQ Cloud supports a two-level Microsoft permissions model designed to separate visibility from management.

Level 1 – Operational Visibility

At the first level, CIQ Cloud operates using read-only permissions. This allows authorised users to inspect and analyse information without providing the platform with permissions to make changes to the Microsoft environment.

This is particularly useful where an organisation wants broad visibility while maintaining strict controls over who can perform administrative actions.

Level 2 – Management

Where additional Microsoft permissions have been approved, CIQ Cloud can expose management capabilities backed by Intune.

This provides the foundation for actions such as device configuration changes, application management and script-based administration.

Importantly, enabling Level 2 does not mean that every technician automatically receives every management capability.

CIQ Cloud can additionally control which features individual technicians are permitted to use.

This creates separation between the permissions granted by the Microsoft tenant and the operational permissions assigned to the person using CIQ Cloud.

Software deployment through Intune

Application deployment is a good example of how this model can work.

Microsoft Intune provides the underlying application deployment mechanism. Windows applications can be packaged and distributed to managed devices, with Intune handling assignment and delivery.

CIQ Cloud can provide an operational layer over this process.

Instead of treating application deployment as an isolated Microsoft administration task, it can be considered in the context of the device, user and wider IT environment.

An administrator could identify devices requiring a particular application and then initiate an approved management workflow using Intune as the deployment engine.

Microsoft remains responsible for delivering and managing the application on the endpoint. CIQ Cloud provides the visibility and workflow surrounding that process.

Patch management and Windows Update

The same principle applies to patch management. Intune and Windows Update for Business provide Microsoft's cloud-based mechanisms for controlling Windows update policies.

Organisations can create different deployment strategies for different groups of systems.

For example, IT may maintain separate groups for Windows 11 production devices, test systems, specialist computers and other endpoint categories.

Rather than simply knowing that an update policy exists, the operational requirement is to understand what is actually happening across those devices.

• Which devices are compliant?

• Which devices have not updated?

• Where are deployments failing?

• Are particular groups falling behind?

• Which exceptions require investigation?

This is where the distinction between management infrastructure and Operational Visibility becomes valuable.

Using PowerShell for management and remediation

Intune can also distribute PowerShell scripts to managed Windows endpoints. This significantly expands what administrators can accomplish beyond predefined configuration policies.

Scripts can potentially be used for configuration, information gathering, remediation and other administrative tasks.

It is important, however, not to confuse this capability with a traditional real-time Remote Monitoring and Management (RMM) platform.

Intune is cloud based and policy driven. A script may be assigned to a device and subsequently executed when the endpoint communicates with the Intune service.

For many administrative tasks, this asynchronous model is perfectly adequate.

Where immediate interactive execution or real-time remote control is required, additional technologies may still be appropriate.

The important point is that Intune provides a powerful remote management mechanism that can be incorporated into broader CIQ Cloud workflows.

A multi-tenant opportunity for MSPs

The combination becomes particularly interesting for Managed Service Providers.

An MSP may be responsible for dozens or hundreds of Microsoft 365 customer tenants.

Each customer may have its own users, devices, licences, Intune policies, security configuration and operational issues.

The underlying Microsoft management platforms are extremely capable, but technicians still need to determine:

Which customers need attention today?

A multi-tenant operational layer can change the way that question is answered.

Instead of technicians repeatedly navigating individual environments looking for problems, CIQ Cloud can consolidate information across customers and help identify the exceptions that require attention.

When action is required, the appropriate Intune capability can then be used to manage the endpoint.

Different Microsoft licences, different capabilities

Not every Microsoft 365 customer will have exactly the same Intune capabilities.

Microsoft 365 Business Premium, provides a strong endpoint management and security foundation for many small and medium-sized organisations, including Microsoft Intune Plan 1.

Microsoft 365 E3 and E5 environments can support larger enterprise deployments, while additional Intune capabilities may be available through other Microsoft licensing options and add-ons.

This means that management capabilities should not simply assume that every tenant is identical.

Operational Visibility can help identify not only the state of the devices but also the management and licensing capabilities available within each customer environment.

For MSPs, that can be particularly valuable when managing customers with different Microsoft subscriptions.

From device management to an operational lifecycle

Managing endpoints should not be considered an isolated administrative function.

It forms part of a continuous operational lifecycle:

Discover → Monitor → Understand → Govern → Optimise

Discover the users, devices, applications and services operating within the environment.

Monitor their status, configuration, compliance and operational health.

Understand where problems, risks and exceptions exist.

Govern the environment through appropriate policies, permissions and management actions.

Optimise configurations, licensing, security and operational processes based on what has been discovered.

Intune can provide an important management and enforcement mechanism within this lifecycle. CIQ Cloud provides the broader Operational Visibility needed to understand where and when that management capability should be applied.

Intune does not need replacing

Organisations that have already invested in Microsoft Intune do not necessarily need another endpoint management platform.

They may simply need to get more operational value from the platform they already own.

For organisations already licensed for Intune, there is a compelling argument for using Microsoft's native management capabilities wherever they meet the requirement, while adding additional visibility, automation and specialist capabilities around them where required.

CIQ Cloud follows that approach.

Rather than replacing Microsoft Intune, it makes Intune part of a wider operational picture spanning devices, users, Microsoft 365, security, licensing and other connected services.

The result is a shift from simply having the tools to manage systems towards knowing what needs managing, why it matters and what action should be taken.

Frequently Asked Questions

Making Microsoft Intune part of the bigger picture

Microsoft Intune provides organisations with a powerful foundation for modern endpoint management.

But endpoint management becomes considerably more valuable when it is connected to the wider operational picture.

By combining Microsoft 365, Intune and other operational data sources, CIQ Cloud can help organisations move beyond individual administration consoles towards a consolidated view of what they have, what is happening, what requires attention and what they can do about it.

That is the difference between simply managing devices and achieving Operational Visibility.