If you work in NHS IT (or you're moving into it from a clinical background), you've probably felt the pressure: patient devices everywhere, security compliance non-negotiable, and the clock ticking. Microsoft Intune is the answer, but setting it up wrong costs time, introduces security gaps, and frustrates clinical teams already stretched thin.
This guide walks you through real Intune setup for NHS trusts, with the specific compliance and device scenarios you'll actually face in UK healthcare.
Before you configure a single setting, understand why this matters. The NHS handles the most sensitive data in the UK: patient records, prescriptions, diagnostic imaging, and treatment history. Every iPad on a ward, every laptop in a consultation room, every smartphone checking clinical systems must be secured, tracked, and compliant.
Intune does four things NHS trusts absolutely need:
1. Mobile Device Management (MDM) - control and monitor iPhones, Android phones, and tablets accessing NHS systems
2. Mobile Application Management (MAM) - secure apps like Microsoft Teams, Outlook, and clinical software without touching the device itself
3. Compliance enforcement - lock devices automatically if they're outdated, unencrypted, or running unapproved apps
4. Conditional access - allow access to patient data only from devices you trust, on networks you control
Without it, you're relying on hope and passwords. With it, you can sleep.
You can't build without foundations. First, confirm your NHS trust has the right licences.
Microsoft 365 for healthcare organisations typically includes:
Many NHS trusts use Government Community Cloud (GCC) or hybrid arrangements with on-premises Active Directory. Check with your licensing team before you start; running Intune on the wrong licence tier costs time and money later.
You'll also need:
This is where most implementations stumble. Intune sits inside Azure AD. Every device you manage must have a digital identity there.
In an NHS trust, you'll typically have:
For corporate devices, enrol them directly:
1. Go to Devices in Intune (Azure Portal)
2. Select "Join with Azure AD" or "Enrol as corporate device"
3. Push group policy or use Autopilot to enrol Windows devices automatically
4. For iOS/Android, use Company Portal app and scan an enrolment QR code
For BYOD, offer Intune Company Portal. Users download it, sign in with their NHS credentials, and their personal device registers. Intune doesn't own their phone, but it does enforce apps on it and require encryption.
Pro tip for NHS IT teams: Set up separate enrolment groups for wards, departments, and roles. You'll want different policies for a registrar's device versus a physio's tablet.
This is where your security teeth come in. Compliance policies define what a "healthy" device looks like. Devices that drift get flagged, then blocked from sensitive apps.
Create compliance policies for each device type:
Windows 10/11 (NHS desktops and laptops):
iOS (iPads on wards, staff personal iPhones):
Android:
If a device drifts (old OS, missing patch, weak password), Intune flags it non-compliant. Link that to conditional access (next step), and the device can't access patient data.
Conditional Access is your bouncer. It says: "I trust this user, but only if their device is compliant, they're on an NHS network or VPN, and they've authenticated recently."
Create policies like this:
Patient Data Access:
Email and Teams:
Admin Access to Patient Systems:
These aren't random. They map to NHS Data Security and Protection Toolkit (DSPT) requirements.
Even if a device is compromised, Intune can protect individual apps. This is Mobile Application Management (MAM).
Set up an app protection policy for Outlook, Teams, and any clinical app:
On a BYOD device, this means Intune sandboxes the work apps. The device itself stays under the user's control, but your patient data stays locked inside managed apps.
Once Intune is live, you'll get alerts constantly. Device non-compliance, failed enrolment, suspicious sign-in, failed backup attempts. Your Intune dashboard becomes your nerve centre.
Set up dashboards for:
Give clinical teams a clear path to fix compliance. Most issues are minor: update OS, enable encryption, update password. If you make it easy (self-service portal, clear instructions), compliance stays high.
For NHS staff unfamiliar with device management, this is new. Budget time for education and troubleshooting.
If you're moving from a healthcare background into IT, Intune is your golden ticket. NHS trusts desperately need people who understand both clinical workflow and device security. You learn Intune in a proper course (like our Microsoft 365 Administrator Programme), but you'll apply it immediately in a real NHS environment. That expertise is rare, needed, and pays. The UK Microsoft 365 Administrator role averages £38,000 to £52,000 depending on region and experience, and NHS employers often hire internally first.
If you're ready to move into this space, start with our free Microsoft 365 career pathway tool to map exactly which certifications and skills get you there fastest.
A complete Intune rollout for a large NHS trust (5,000+ devices) typically takes three to six months. Initial setup (tenant configuration, policies, pilot enrolment) takes four to eight weeks. The remaining time is gradual enrolment of devices, troubleshooting, and user training across departments. Speed depends heavily on your existing Active Directory hygiene and how much you automate enrolment.
Yes, and most NHS trusts do initially. You can run Intune in hybrid mode with on-premises Group Policy, or gradually migrate to cloud-only management over six to twelve months. Hybrid mode lets you enforce both cloud-based conditional access (strong for security) and legacy Group Policy (for stability during transition). Plan the migration early, though; maintaining both long-term costs more than it saves.
If you set up conditional access properly, a non-compliant device loses access to patient data within minutes. In practice, the clinician would be locked out of clinical apps or systems until they update their device (install OS patch, enable encryption, update password). Many NHS trusts set a 24-hour grace period for minor updates to avoid disrupting patient care, then enforce the block. Plan your compliance deadlines with clinical teams so they don't conflict with high-pressure periods.
Intune itself doesn't integrate directly with Spine, but it does integrate with Azure AD and modern APIs. If your NHS systems support SAML or OAuth authentication through Azure AD, Intune's conditional access policies protect them. Older legacy systems may need a proxy or bridge, and older systems might not support mobile access at all. Check integration requirements with your applications team and NHS Digital guidance before you deploy.
Microsoft Intune is included in Enterprise Mobility + Security (EMS) E3 (roughly £8.50 per user per month) or E5 (roughly £16 per user per month), or bundled into Microsoft 365 Business Standard (£11 per user per month) or Microsoft 365 Enterprise (E3/E5). For a 2,000-person NHS trust, that's typically £20,000 to £40,000 per year. Many NHS trusts negotiate framework agreements with Microsoft, so actual costs may be lower. Check your procurement team.
SmoothOps 365 runs live instructor-led training every Saturday and Sunday. 3 months. 50 contact hours. Keep your job while you train.