Intune Device Audit: What It Checks, What You Get, and How It Differs From Intune Licences

The short version: An Intune device audit is a one-off, read-only review of every device that reaches company data: whether it is enrolled, compliant, encrypted, protected by Defender, patched within 14 days, and, for personal phones, whether work apps carry app protection. You get a graded report, a findings register and a phased fix plan. It is not a licence; it tells you whether the licences you already pay for are doing anything.

If you have searched for an Intune device audit, you are probably in one of two positions. Either you already run Intune and want someone independent to tell you whether the set-up is actually protecting your laptops and phones, or you are weighing up Intune licences and want to know what "managed" would mean before you spend anything. This article covers both. It explains what a device audit inspects, what the deliverable looks like, where it stops and the tenant-wide Microsoft 365 audit begins, and why an audit and a licence are different purchases that people often confuse.

Everything about the deliverable below is taken from the sample Intune device audit report Brocent publishes for a fictitious 14-person firm with 28 devices. Nothing in it describes a real client.

What does an Intune device audit check?

A device audit starts from a simple question: which devices can open company mail, files and chat, and what is true of each one? Intune only knows about the devices that are enrolled in it, so the first job is to reconcile the Intune inventory against sign-in data and the Exchange ActiveSync and mobile app logs. The audit then works through nine areas.

• Enrolment coverage. How many devices reach company data, how many are enrolled, and how the unenrolled ones got there. In the sample, 19 of 28 devices are enrolled; two corporate Macs bought from a retailer never went into Apple Business Manager, and seven personal phones were never covered at all.
• Compliance policies. Whether a compliance policy exists for each platform, what it actually tests, and whether a non-compliant device is ever marked non-compliant and blocked. A policy that checks only the OS version and a password, as the sample's macOS policy does, passes almost everything.
• Configuration profiles and security baselines. Whether the Windows security baseline is assigned, whether custom profiles conflict with it, and how the result compares with the CIS Intune benchmark for each platform.
• Encryption. BitLocker on Windows and FileVault on macOS, including whether recovery keys are escrowed to Intune. The sample found FileVault off on two of five managed Macs because the compliance policy never required it, and one laptop whose BitLocker key was never escrowed.
• Endpoint protection. Whether Defender is onboarded on every platform and whether it is fully protected. On Macs this means the system extension, full disk access and background service profiles, which are easy to miss.
• Update rings and patch compliance. Whether update rings or deadlines exist, and how many devices are more than 14 days behind on critical updates. The 14-day figure matters because Cyber Essentials v3.3 treats it as an automatic fail, as our Cyber Essentials with Microsoft 365 guide explains.
• App protection for personal devices. Whether iOS and Android app protection policies exist, whether Conditional Access requires them, and whether native mail apps are still allowed through Exchange ActiveSync, which bypasses app protection entirely.
• Admin roles and local administrators. Who holds Intune roles, whether local administrator rights exist on laptops, and whether Windows LAPS is configured.
• Inventory hygiene. Stale device records, enrolment restrictions that let personal Windows PCs enrol, and whether the Company Portal is usable for staff.

The read is configuration and metadata only. The audit does not read the contents of email or documents, and nothing is installed on devices.

How is the audit delivered?

The device audit runs on the same read-only model as the tenant audit. A Global Administrator consents once to a read-only Microsoft Graph application, which takes about 15 minutes. Settings that no API exposes are reviewed in the admin portal on a screen share with your IT lead, and each finding is labelled with how it was obtained: verified through Graph or PowerShell, confirmed with the client, or manual review. The consent can be withdrawn at any time by removing the application.

Brocent delivers the audit remotely from Hong Kong and Singapore, with a debrief by video call in your time zone. The Microsoft 365 security audit pricing page sets out the process and the 5 to 7 business day turnaround that applies to the tenant audit; the device audit is scoped alongside it.

What do you get at the end?

The sample report shows the shape of the deliverable. It is worth reading in full, but the sections are these.

• A grade and a one-line verdict. The sample firm scores 54 out of 100, grade C minus: Windows is sound, Apple devices and personal phones carry the risk. The verdict names the first step, which is app protection for the seven personal phones.
• The device estate at a glance. Six figures: devices reaching company data, managed, compliant, encrypted, patched within 14 days, and personal phones with no protection. Compliance, encryption and patching are measured on enrolled devices only, and the report says so, because 68 per cent managed is a very different number from 79 per cent compliant.
• A recommended management model by ownership. Corporate Windows laptops and Macs fully managed; personal iPhones and Android phones with app protection only, not enrolled; home computers browser-only with no downloads. Each row names the controls and the Conditional Access grant that enforces it.
• CIS Benchmark results by platform. Assessed, pass, fail and manual counts for the CIS Intune Windows 11 benchmark, the macOS and iOS benchmarks, and an app protection baseline for personal phones. The sample's personal phones score zero of eighteen because no policy exists.
• A findings register. Fifteen findings in the sample, each with a domain, severity, effort in S, M or L, the phase that closes it, and a confidence label. The critical one is no app protection on personal phones; the four high findings are native mail through ActiveSync, two unenrolled Macs, incomplete Defender on Macs, and FileVault not required.
• A proposed app protection policy. The actual settings, app by app: PIN, data transfer limits, encryption, conditional launch, selective wipe, and the Conditional Access grant.
• A Cyber Essentials v3.3 device mapping. Secure configuration, user access control, malware protection, update management and BYOD scope, with a status of met, partial or not met for each. The report is designed to be used as evidence in that process; it does not grant or guarantee certification.
• A phased fix plan. Phase 0 stabilise, about a day; Phase 1 harden, about three and a half days; Phase 2 govern, about a day and a half. Each phase lists the findings it closes and a success measure, such as 100 per cent of mobile sign-ins through protected apps.

You also get the Excel workbook behind the report, with the same findings and device rows, so your own team or another provider can work from it.

How does a device audit differ from buying Intune licences?

This is the confusion that brings most people to the search box. Intune Plan 1, Plan 2 and the Intune Suite are capabilities. An audit is a judgement about whether those capabilities are configured and doing what you assumed. The two are easy to tell apart once you ask three questions.

Dashboard, audit or licence upgrade?

• The Intune compliance dashboard. Included with any Intune plan, instant, and honest about what it knows. Its limit is that it reports only on enrolled devices against the policies you wrote. If the policy never asked about encryption, the dashboard shows the device as compliant with encryption off. It cannot see the seven phones that were never enrolled.
• A baseline-driven device audit. One-off, read-only, measured against a published benchmark rather than your own policy, and covering unenrolled devices by reconciling sign-in data. It tells you where the gaps are, ranks them, and estimates the effort to close them. It changes nothing by itself.
• A licence upgrade. Adds capabilities such as remote help, endpoint privilege management or advanced analytics. It fixes nothing on its own and, if the baseline is wrong, extends the same gaps to more features. Most findings in the sample are closed with settings available in the licences the firm already held.

The practical order is dashboard first, because it is already included; audit when someone external asks for evidence or when you suspect the dashboard is flattering you; licence changes last, once the audit has shown which capability you actually lack. Plan comparisons and per-user prices are on the Microsoft Intune pricing page, and our Intune Plan 1 vs Plan 2 vs Suite guide walks through which plan contains which feature. This article does not repeat those tables.

How does a device audit relate to a Microsoft 365 security audit?

They look at different layers of the same tenant. The Microsoft 365 security audit reviews the tenant: Entra ID identities, Conditional Access, Exchange Online, SharePoint, Teams, Defender for Office 365 and Purview, against the CIS Microsoft 365 Benchmark. The device audit reviews the endpoints that sign in to that tenant. In the sample set, the two reports share a client and cross-reference each other: the tenant report summarises the device findings, and the device report holds the full detail.

Which one you need first depends on the trigger.

• A cyber insurance renewal or supplier questionnaire usually asks about MFA, admin accounts and email protection before it asks about devices. Start with the tenant audit.
• A Cyber Essentials application tests devices directly, including personal phones that open work mail. If identity is already in order, the device audit answers more of the questionnaire.
• A lost laptop, a leaver whose phone still has company mail, or a Mac bought outside procurement points straight at the device audit.
• "We have never reviewed any of it" means both, and the tenant audit is the better first step because identity controls decide what a stolen device can reach.

The what the tenant audit checks guide covers the identity side in depth.

What does an Intune device audit cost?

Brocent does not publish a separate Intune audit price. The device audit is scoped with the Microsoft 365 security audit, whose list prices are set by headcount: US$450 for 1 to 10 users, US$990 for 11 to 25, US$1,800 for 26 to 75, US$2,900 for 76 to 150, and a quote above 150. The device count, the mix of platforms and whether personal phones are in scope decide how much device work sits on top, so the device element is quoted after a short scoping conversation rather than listed. The audit pricing page has the bands, what each includes and how the quote is built. No hardening work is included; remediation is quoted per job once you have the findings register.

Two things are worth saying about value. First, most device findings cost nothing to fix except a few days of configuration, because the capability is already in the licence. Second, the audit's own effort estimates are what make it useful: the sample's entire fix plan is about six working days spread over four months, and a buyer can hold any provider, including us, to that.

What should you prepare before an audit?

• A list of who uses what. The audit reconciles devices from sign-in data, but a staff list with device ownership (company laptop, personal phone, home PC) halves the confirmation time.
• Apple Business Manager and Autopilot access. Not for the auditor to change anything, but to see which devices are registered and which are not.
• Your current policies, as they are. Do not tidy up before the audit. The point is to see the drift, not a snapshot taken the day after a clean-up.
• The trigger. Tell the auditor whether this is for an insurer, Cyber Essentials, a client questionnaire or your own peace of mind, because that decides which mapping the report leads with.

Frequently asked questions

What is an Intune device audit?

A one-off, read-only review of every Windows, macOS, iOS and Android device that reaches company data, whether company-owned or personal. It checks enrolment, compliance policies, configuration against the CIS Intune benchmarks, encryption, Defender, patch timing, app protection for personal phones, admin rights and inventory hygiene, and produces a graded report with a findings register and a phased fix plan.

Does an Intune device audit cover personal phones?

Yes, and in most small firms that is where the critical finding sits. Personal phones that open Outlook, Teams or OneDrive are in scope. The audit checks whether app protection policies exist, whether Conditional Access requires them, and whether native mail apps are still reaching mailboxes through Exchange ActiveSync. The recommended model keeps personal phones out of device enrolment and protects the work apps instead.

Do I need Intune Plan 2 or the Intune Suite before an audit?

No. The audit measures the configuration you have against a benchmark. Most findings in the sample are closed with settings available in Plan 1 and the licences bundled with Microsoft 365 Business Premium. If a finding genuinely needs a higher plan, the report says so, and you can then compare plans on the Intune pricing page.

What is the difference between an Intune compliance report and a device audit?

The compliance report in the Intune admin centre tells you whether enrolled devices meet the policies you wrote. The audit tells you whether those policies ask the right questions, what the unenrolled devices are doing, and how the whole estate measures against a published benchmark. A device can be compliant in the dashboard and still unencrypted if the policy never checked.

How long does an Intune device audit take?

The data collection is a read-only scan over a few days with a re-check before the report is issued; the sample's assessment window was three days. Reports in the audit family are issued within 5 to 7 business days after read-only consent. Your own time is the consent, a short scoping call and a screen share for the manual controls.

Is the Intune device audit report accepted for Cyber Essentials?

The report includes a mapping of device controls to Cyber Essentials v3.3 requirement areas and is designed to be used as evidence when you prepare for assessment. It does not grant, certify or guarantee certification; only the certification body does that.

Can you audit Macs and iPads as well as Windows?

Yes. The sample covers 13 Windows laptops, 7 Macs, a shared iPad and personal iPhones and Android phones, measured against the CIS Intune benchmarks for Windows 11, macOS and iOS, and Microsoft's Android Enterprise configuration framework, because no CIS Intune benchmark exists for Android.

What happens after the audit?

You receive the report, the workbook and a debrief. You can fix the findings yourself, give the workbook to your existing provider, or ask Brocent for a per-job quote for the fix plan. A verification re-audit after the fixes is an option, not a condition.

Next steps

Read the sample Intune device audit online first, then the Microsoft 365 security audit pricing page for the bands and the process. If you are still deciding on licences, the Intune pricing page has the plan comparison. To scope a device audit for your own estate, talk to a consultant with a rough device count and a note of what triggered the question.