Enrolled Is Not Configured

Your iPhones, iPads, and Android devices show up in the Intune console. That is where it stops. Wi-Fi gets set up by hand, one device at a time. Mail profiles are a helpdesk ticket. Nobody can say which devices enforce a passcode, which run an operating system three versions behind, or which are jailbroken.

This is not a failure of your IT team. Enrollment is the step every project ships, because it is the step with a clear finish line. Configuration has no finish line — it is a matrix of platforms, ownership models, and settings where every choice touches someone's daily work. So it gets postponed, and the fleet stays half-managed.

The cost is concrete. Without a compliance signal per device, Conditional Access has nothing to evaluate, and the device layer that Mobile App Protection is designed to sit on top of simply is not there. Your Intune Plan 1 license is already paid for through Microsoft 365 Business Premium or E3. You are using the enrollment half and leaving the configuration half on the shelf.