Most of the security incidents we see start the same way: a sign-in from somewhere it shouldn’t be coming from, on a device nobody set up properly, running whatever apps someone happened to install along the way. The tools to close all three of those gaps already exist inside Microsoft 365 — Conditional Access, Windows Autopilot, and Intune app provisioning. The catch is that a lot of businesses are paying for licenses that include these features and never turning them on.
Blocking Sign-Ins From Places You Don’t Do Business
If your business operates entirely within the U.S. and someone tries to sign into your Microsoft 365 tenant from overseas, that’s not a coincidence — it’s almost always a stolen credential being tested out. Conditional Access lets you build a policy that blocks sign-ins from anywhere your business doesn’t actually operate, without touching how your real employees sign in day to day.
The setup uses what Microsoft calls named locations — essentially a label attached to a country or a range of IP addresses. You build one location for the countries where your business operates, then create a policy that blocks everything outside of it. The safest way to build this is a default-deny model: block all locations except the ones you’ve explicitly allowed, and always exclude a break-glass admin account so you can never accidentally lock yourself out.
Test Before You Enforce
Every Conditional Access policy can run in report-only mode before it actually blocks anything. This shows you exactly who would have been affected — flagging legitimate employees traveling for work, for example — before you flip the switch to actively enforce it. Skipping this step is the single most common way a well-intentioned policy turns into a Friday afternoon support call.
Setting Up New Devices Without the IT Headache
New employee laptops used to mean someone on your team (or ours) manually imaging a machine, installing every app by hand, and configuring settings one at a time before it was ready to ship. Windows Autopilot removes almost all of that. A new device ships straight to the employee, they connect it to the internet and sign in with their work account, and Intune takes it from there — installing required apps, applying security settings, and enrolling the device automatically.
There are a few different Autopilot deployment modes depending on how much control you want during setup:
- User-driven mode: The most common setup for standard employee laptops — the device is assigned to a specific user and configures itself around their sign-in.
- Self-deploying mode: Built for shared devices, kiosks, or conference room equipment where no one specific person needs to sign in during setup.
- Pre-provisioning: Lets a technician run the heavy lifting — apps, policies, security templates — before the device ever reaches the end user, so their first experience is fast.
Apps Get Provisioned Automatically, Not Installed By Hand
The app side of this is where a lot of the manual work used to live. Once apps are assigned in Intune as required installs — rather than optional ones — they show up on the device automatically during setup, before the employee ever reaches their desktop. That covers everything from Microsoft 365 apps to line-of-business software to your endpoint security agent. Microsoft recently expanded this further, allowing up to 25 apps to be configured for installation during the newer Autopilot device preparation process, with those Intune-deployed apps now trusted earlier in setup so installation goes more smoothly.
Which Microsoft 365 License Actually Includes This?
This is where things get confusing, because not every Microsoft 365 plan includes what you need. Here’s the breakdown:
- Microsoft 365 Business Premium: Includes both Microsoft Entra ID P1 (needed for Conditional Access) and Microsoft Intune Plan 1 (needed for Autopilot and app provisioning). This is the plan built for exactly this kind of setup.
- Microsoft 365 E3 / E5 / E7: Also includes Entra ID P1 (E5 includes P2) and Intune, along with a broader set of enterprise features.
- Microsoft 365 Business Standard / Basic: Does not include Conditional Access or Intune. These plans cover the core apps and email but leave device management and location-based access control out entirely.
If your business is on Business Standard and wants this level of control, the most common path is upgrading to Business Premium rather than buying Entra ID P1 and Intune as standalone add-ons — the bundled pricing works out better in almost every case we’ve run the numbers on.
What’s New in Intune Worth Knowing About
A few recent additions are worth flagging if it’s been a while since you looked at what Intune can do:
- Intune Copilot: An AI assistant built into the admin center that lets IT staff query devices, compliance status, and policies using plain language, and get help troubleshooting or building queries without deep Intune expertise.
- Clearer per-device sync visibility: The admin center now shows live progress when a sync action is triggered, so admins can confirm a change actually landed instead of waiting and hoping.
- Managed installer trust extended to Autopilot device preparation: Apps deployed through Intune are now trusted earlier in the setup process, which cuts down on friction and failed installs during provisioning.
Frequently Asked Questions
Will blocking sign-ins by country affect employees who travel?
It can, which is exactly why testing in report-only mode first matters. You can also build exceptions for specific employees or security groups who travel regularly, rather than opening access for an entire country.
Do we need Autopilot if we’re a small business with only a handful of new hires a year?
Even at a small scale, Autopilot saves real time — a device shipped straight to an employee’s home or office, set up correctly without anyone driving out to configure it by hand.
What happens if an app fails to install during Autopilot setup?
Intune reports the specific failure reason, and devices can be reset and re-enrolled once the underlying issue — usually a licensing gap or a network hiccup — is resolved.
Can we use Conditional Access without Autopilot, or do we need both?
They’re independent features that happen to share the same licensing prerequisite (Entra ID P1). Plenty of businesses use one without the other, though used together they cover both entry points: how someone signs in and how their device got set up in the first place.
How do we know which license our business currently has?
Your Microsoft 365 admin center shows exactly which licenses are assigned to which users, but if you’re not sure what’s included in your current plan versus what you’d need, that’s exactly the kind of question we’re happy to walk through with you.
Not sure whether your current Microsoft 365 plan already includes Conditional Access and Autopilot, or if it’s time to talk about Business Premium? We’re happy to take a look at your tenant and map out exactly what you have and what you’re missing.
Leave a Reply