That leaves devices managed in name only. They appear in the admin portal, yet nothing is actually enforced: no encryption requirement, no update deadline, and no consequence if a device falls out of line.

These are the five settings I check first whenever I look at a small business tenant. None require extra licences, and most take less than an hour to configure.

1. What happens to devices with no compliance policy?

By default, Microsoft Intune treats a device with no compliance policy assigned as compliant. Any device you forget to target therefore passes every Conditional Access check. Changing this tenant-wide setting to "Not compliant" means an unassigned device is blocked rather than quietly trusted, which closes one of the easiest gaps to miss.

You will find it in Microsoft Intune under Devices > Compliance > Compliance settings.

Before you change it, make sure each device group has at least one compliance policy assigned. Otherwise, users will lose access at the next check-in. A basic Windows policy requiring BitLocker, Secure Boot, a minimum operating system version and Microsoft Defender Antivirus is a sensible starting point.

The setting only has teeth if a Conditional Access policy requires a compliant device. Without that, non-compliance is just a label in a report.

2. Is BitLocker enforced, and where are the recovery keys?

Every company laptop should have its drive encrypted with BitLocker, enforced through a Microsoft Intune disk encryption policy rather than left to individual users. Just as important is where the recovery keys end up. Back them up to Microsoft Entra ID so an administrator can retrieve one quickly when a device locks.

An unencrypted laptop left on a train can quickly become a reportable data breach. An encrypted one is a replacement hardware cost.

Configure encryption under Endpoint security > Disk encryption. Choose silent encryption so users are not prompted, and require recovery keys to be stored in Microsoft Entra ID before encryption begins. Then spot-check a few devices to confirm the keys are actually there. It is far better to find a missing key now than when a director is locked out on a Monday morning.

3. Do your Windows updates have a deadline?

Update rings in Microsoft Intune control when Windows devices install quality and feature updates. Many tenants set a deferral period but no deadline, so users can postpone restarts almost indefinitely. Adding a deadline and a short grace period ensures security patches install within days, rather than whenever someone finally decides to reboot.

A simple structure works well for most small businesses:

• Pilot ring: a handful of confident users who receive updates with no deferral

• Broad ring: everyone else, with a deferral of a few days so any problems surface in the pilot group first

Set a deadline of two to three days and a grace period of one to two days. This matters for Cyber Essentials too, which expects critical and high-risk security updates to be installed within 14 days of release.

4. Who has local administrator rights?

Staff should work on standard user accounts, not local administrator accounts. Administrator rights make it much easier for malware to install itself, disable protections, and spread. Microsoft Intune can manage the built-in administrator account with Windows LAPS, giving every device a unique, rotating password that IT can retrieve when support is needed.

Two patterns keep coming up in small businesses. The first is that whoever set up a laptop made themselves an administrator and never changed it back. The second is a single shared local administrator password used on every machine, so one compromised device exposes them all.

Both can be fixed under Endpoint security > Account protection. Use a Windows LAPS policy for the built-in account, and a local user group membership policy to control exactly who sits in the Administrators group.

5. Are personal phones protected without being managed?

App protection policies let Microsoft Intune protect company data inside apps such as Outlook, Teams and OneDrive on personal phones, without enrolling the whole device. You can require a PIN, stop data being copied into personal apps, and remove only company data if the phone is lost or the employee leaves.

Staff are understandably reluctant to hand control of their own phones to their employer. App protection avoids that argument entirely because IT manages only the work apps, not the device.

Pair the policy with a Conditional Access rule that requires an app protection policy on iOS and Android. That way, unprotected mail apps cannot connect to company accounts at all.

Where to start

If you only have an afternoon, work through the first three in order: the compliance default and a basic compliance policy, then BitLocker with key backup, then update deadlines. These deliver the biggest improvement for the least disruption.

Local administrator rights and app protection change day-to-day work, so you need a short conversation with staff before they go live.

Whatever you change, test it on a pilot group first. A policy that blocks access is best discovered on the IT lead's laptop, not the finance director's.