How To… | InTune
What is Intune?
Microsoft Intune is a cloud-based tool which enables the University to manage user access to organisational resources and simplify app and device management across the organisation.
Do I need to register my device?
Registering your device is entirely optional but will depend on your preferences.
You will only need to register your device if you want to access University services or systems from it. If you don’t want to access University systems or services from your device, you don’t need to do anything.
This service collects device and application information to determine compliance and access rights. If you choose to install Full Device Protection, this will allow the University access to remotely wipe or reset your device in extreme circumstances – e.g. should your device be lost or stolen – to protect University data. If you do not require this level of protection you should use the “Option 1 – In-App Protection” below for your relevant device.
Please note that your device will need to be compliant in order to register. If you are unable to fully set up In-App Protection on your device, it may be that your device is not compliant. This may be due to having an outdated firmware or operating system (OS) version installed on your device. In this scenario, you will need to check to see if your device can be updated to a supported OS version. Click here for a full list of currently supported OS Versions.
Click the button below to see a full list of what the University will be able to see/do on your device depending on your chosen level of protection.
Using Intune
To access University resources from your device(s), you will need to register with Intune. Depending on the University resources you wish to access from your device, you will need to set up different levels of permissions. These are outlined for each platform in the instructions below. Please select the option(s) below which most apply to you to get started.
Apple iOS Devices
If you require access to core Microsoft applications on your device – such as the Teams, Outlook and OneDrive apps – then follow Option 1 – In-App Protection below.
Option 1 – In-App Protection
- On iOS devices, you will first need the Microsoft Authenticator application installed. If you don’t already have it installed, please follow our full instructions on installing and setting up the Microsoft Authenticator App for MFA – then come back to this page.
- Once you have the Microsoft Authenticator application installed, you will be required to set a six-digit PIN the next time you access a Microsoft application. This PIN is not linked to your device’s PIN, and depending on your settings, this may also connect with your existing Face or Touch ID.
- Microsoft applications (including Teams and Outlook) may also ask you to “Register” via the Microsoft Authenticator App and require a restart before you can use them.
Once you have completed the steps above, your device has In-App Protection set up and is compliant. With In-App Protection set up, the University cannot see any personal information on the device, and we have no access to wipe the device. Only the University data that is stored within the protected app can be removed via the protection policy.
Wait! Do you need Full Device Protection?
I don’t require access to wider applications
If you don’t require access to wider applications such as University systems from your device(s), you do not need to do anything else, and are now fully compliant – your setup is now complete!
I require access to wider applications
If you do want access to wider applications outside of core Microsoft products (Outlook, Teams, OneDrive, OneNote etc.) – such as University systems – via your personal device(s), you will need to set up Full Device Protection. This requires the Intune Company Portal App to be installed and device-registered using your University credentials. Please proceed to Option 2 below to set up Full Device Protection.
Option 2 – Full Device Protection
If you want access to wider applications outside core Microsoft products, such as University systems, from your personal device, you will need Full Device Protection. This requires the Intune Company Portal App to be installed and device-registered using your University credentials.
Important:
Registering your device in this way will also allow the University to have limited management of the device and to perform certain actions, including:
- Remotely resetting or wiping a lost or stolen device
- Providing remote assistance
Installing Full Device Protection will allow the University to remotely wipe or reset your device. This would only be done in the most extreme circumstances, such as if your device was lost or stolen; this would only be done at the user’s request with a governance process in place to ensure the appropriate application of policy.
If you do not require access to wider applications such as University systems from your device(s), you do not need this level of protection and should use “Option 1 – In-App Protection” (above).
- Access the App Store and download the Intune Company Portal app. Make sure this is the Microsoft application.
- Once it has been installed on your device, open the Intune Company Portal app, and you will be asked to register the device.
- Authenticate using your University login information and accept the application requirements.
Once the Intune Company Portal app has been installed and configured, your device will appear under the Devices tab. This will show if the device is compliant with University policy. Please note that it could take up to an hour before the device is shown as compliant. Your setup is now complete!
Android Devices
If you require access to core Microsoft applications on your device – such as the Teams, Outlook and OneDrive apps – then follow Option 1 – In-App Protection below.
Option 1 – In-App Protection
On Android devices, you will need the Company Portal App installed, but you do not need to sign into the portal, so your device will not be registered within Intune.
- Once Intune is activated by Digital Services, you will be automatically notified to install the necessary application as part of the application protection process. Once notified, access the Google Play store and download the Intune Company Portal App. Make sure this is the Microsoft application by checking it is from “Microsoft Corporation”.
- These applications are required to provide the interface between the operating system of the device and the application protection policy.
The Microsoft applications can be used if the device is compliant. There are further restrictions on saving data outside of the application and additional requirements for PIN access. Microsoft applications may also ask you to “Register” and require a restart before you can use them.
Please Note: If you would rather create a split between your personal and work applications, you can set Full Device Protection on a separate profile on your device. This will provide additional features such as the ability to pause work apps which will disable notifications from the work apps installed. This will effectively work in the same way as having two phones, as you won’t be able to copy and paste from your work profile to your personal profile.
Wait! Do you need Full Device Protection?
I don’t require access to wider applications
If you don’t require access to wider applications such as University systems from your device(s), you do not need to do anything else, and are now fully compliant – your setup is now complete!
I require access to wider applications
If you do want access to wider applications outside of core Microsoft products (Outlook, Teams, OneDrive, OneNote etc.) – such as University systems – via your personal device(s), you will need to set up Full Device Protection. This requires the Company Portal App to be installed and device-registered using your University credentials. Please proceed to Option 2 below to set up Full Device Protection.
Option 2 – Full Device Protection
If you want access to wider applications outside core Microsoft products, such as University systems, from your personal device, you will need Full Device Protection. This requires the Intune Company Portal App to be installed and device-registered using your University credentials.
Important:
Registering your device in this way will also allow the University to have limited management of the device and to perform certain actions, including:
- Remotely wiping University data from a lost or stolen device
- Providing remote assistance
Installing Full Device Protection will allow the University to remotely wipe University data from your device. This would only be done in the most extreme circumstances, such as if your device was lost or stolen; this would only be done at the user’s request with a governance process in place to ensure the appropriate application of policy.
If you do not require access to wider applications such as University systems from your device(s), you do not need this level of protection and should use “Option 1 – In-App Protection” (above).
- Access the Google Play store and download the Intune Company Portal App. Make sure this is the Microsoft application by checking it is from “Microsoft Corporation”.
- Once installed on your device, open the Intune Company Portal app, and you will be asked to register the device. You will need to authenticate using your university login information and accept the application requirements.
Android-Only
If you want to create a split between your personal and work applications, you can set Full Device Protection on a separate profile on your device. This will provide additional features, such as the ability to pause work apps, which will disable notifications from the work apps installed. This will effectively work in the same way as having two phones, as you won’t be able to copy and paste from your work profile to your personal profile.
Once the Intune Company Portal app has been installed and configured, your device will appear under the Devices tab. This will show if the device is compliant with University policy. Please note that it could take up to an hour before the device is shown as compliant. Your setup is now complete!