Entra ID, Autopilot, compliance policies and Conditional Access — cross-platform endpoint management from the Microsoft 365 stack.
| Area | Object | What it is | Notes |
|---|---|---|---|
| Identity | Entra ID | Microsoft's cloud identity service (formerly Azure AD). Every user, group, and device identity lives here. | Intune is effectively a feature of Entra. Get the identity model right first — everything else scopes off it. |
| Identity | Entra join vs Hybrid join | Cloud-only device identity, versus one joined to both on-prem AD and Entra. | Prefer cloud-only. Hybrid join adds sync timing, line-of-sight-to-DC, and troubleshooting complexity that causes a large share of real-world Intune pain. |
| Scoping | Dynamic group | An Entra group whose membership is a rule query rather than a manual list. | The Intune equivalent of a Smart Group. Scope everything to these — membership evaluation can lag several minutes, which surprises people. |
| Scoping | Assignment (Include/Exclude) | Which groups a policy targets, and which are carved out. | Exclude wins over Include. Also: user-targeted and device-targeted assignments behave differently — see the Gotchas tab. |
| Scoping | Scope tags | Restrict which admins can see and manage which objects. | Essential for delegated administration across regions or business units. |
| Config | Configuration profile | Settings delivered to devices — Wi-Fi, VPN, certificates, restrictions, endpoint protection. | Built on CSPs under the hood. The Settings Catalog is now the preferred authoring surface for Windows. |
| Config | Settings Catalog | A searchable list of every available setting, replacing the older templated profile types. | Start here for new Windows and macOS profiles rather than the legacy templates. |
| Config | CSP / OMA-URI | Configuration Service Provider — the underlying Windows settings API, addressable by URI in a Custom profile. | The escape hatch when a setting has no GUI. Syntax is unforgiving; a typo fails silently. |
| Config | Security baseline | A Microsoft-authored bundle of recommended hardening settings. | Useful starting point, but review before applying — baselines conflict with custom profiles surprisingly often. |
| Compliance | Compliance policy | Rules a device must satisfy: encryption on, minimum OS, password set, not jailbroken, Defender healthy. | On its own it only reports. Pair with Conditional Access to actually enforce anything. |
| Compliance | Conditional Access | An Entra policy gating access on device compliance, user risk, location, and app. | Where compliance gains teeth. Also where you can lock yourself out — always configure a break-glass account. |
| Compliance | App Protection Policy (MAM) | Data protection applied to the app, not the device — no enrollment required. | The right answer for BYOD: protect company data in Outlook/Teams without managing someone's personal phone. |
| Apps | Win32 app (.intunewin) | A packaged Windows app wrapped with the Content Prep Tool, with install/uninstall commands and detection rules. | Detection rules are the part that breaks. See the App Deployment tab. |
| Apps | Required vs Available | Required installs silently; Available appears in Company Portal for the user to choose. | Required assigned to a user group installs on every device they sign into — often not what's intended. |
Get devices registered — ideally by the vendor
Ask your OEM or reseller to register devices to your tenant at purchase. Collecting hashes manually works but doesn't scale, and defeats the point of zero-touch.
Create the deployment profile
Devices → Enrollment → Deployment Profiles. User-Driven is the normal mode. Set "Convert all targeted devices to Autopilot" to yes so devices registering later pick it up automatically.
Configure the Enrollment Status Page — carefully
The ESP blocks the desktop until required apps and policies land, which prevents users getting a half-configured machine. But block on too many apps and provisioning times out. Keep the blocking list to genuine essentials and let the rest install afterwards.
Decide about local admin rights up front
The deployment profile sets whether the enrolling user becomes Administrator or Standard. Standard is correct; grant elevation deliberately via Endpoint Privilege Management or a support workflow. Changing this after rollout is painful.
Test with a real reset, not a fresh VM
A VM won't surface OEM driver issues or hash-registration problems. Wipe an actual target-model laptop and run the real flow before rolling out.
Autopilot troubleshooting
| Symptom | Usual cause | Fix |
|---|---|---|
| Device shows normal OOBE, not Autopilot | Hash not registered, or profile not assigned when the device first checked in. | Confirm the device appears under Devices → Autopilot devices with a profile assigned, then reset again. |
| ESP hangs then times out | Too many blocking apps, or one app failing to install. | Reduce the blocking app list. Check Shift+F10 → event logs for the failing install. |
| "Something went wrong" at enrollment | Enrollment restrictions blocking the platform, or MDM user scope not set. | Entra → Mobility (MDM) → confirm MDM user scope covers the user. Check Devices → Enrollment restrictions. |
| Device joins but gets no policies | Dynamic group membership hasn't evaluated yet. | Wait — evaluation can take several minutes. Verify the device actually matches the group rule. |
| Licensing error at sign-in | User lacks an Intune licence. | Assign one, ideally via group-based licensing so it can't be forgotten. |
- It is entirely possible to lock every administrator out of the tenant with one bad CA policy. This happens regularly.
- Create two cloud-only Global Administrator accounts, excluded from all CA policies, with long random passwords stored offline.
- Always use Report-only mode first. It logs what would have happened without blocking anyone.
- Use the What If tool to simulate a policy against a specific user and app before enabling it.
- Never scope a CA policy to "All users" without an exclusion group containing your break-glass accounts.
- Encryption required — BitLocker on Windows, FileVault on macOS, with recovery keys escrowed to Intune.
- Minimum OS version — set a floor and raise it on a schedule. Use "actions for noncompliance" to warn users by email before marking non-compliant.
- Password/PIN required with a sensible complexity and lock timeout.
- Defender / antivirus healthy and signatures current, on Windows.
- Not jailbroken/rooted on mobile.
- Set a grace period on actions for noncompliance. Marking devices non-compliant instantly, with CA attached, locks out real users on day one.
- App Protection Policies protect company data inside Outlook, Teams, and Edge without enrolling the device at all.
- You can require a PIN on the work app, block copy-paste to personal apps, and selectively wipe company data — while never touching personal photos or apps.
- This is both better for privacy and dramatically better for adoption. Users resist enrolling personal hardware, with good reason.
- Pair with a CA policy requiring an approved client app, so unmanaged mail clients can't connect.
Wrap the installer
Use the Microsoft Win32 Content Prep Tool to produce a .intunewin file from your source folder.
Write silent install and uninstall commands
Both are required. Test them manually from an elevated prompt on a clean machine first — an installer that prompts will hang forever under Intune.
Choose a detection rule that reflects the version
MSI product code is the most reliable for MSIs. For EXEs, use a file-version check or a registry value — not merely file existence, or an outdated install will report as current and never update.
Set requirements and return codes
Requirement rules (OS version, architecture, free disk space) stop the app attempting on machines that can't take it. Map exit code 3010 to "soft reboot" rather than failure — plenty of installers return it on success.
Debug from the client log
The Intune Management Extension log is where Win32 app problems are actually visible.
App types by platform
Windows
Win32 covers almost everything. The newer Store integration and Enterprise App Catalog reduce manual packaging for common titles.
macOS
Intune supports signed PKG/DMG plus VPP apps from Apple Business Manager. Noticeably less capable than Jamf here — see the Gotchas tab.
Android
All app delivery goes through Managed Google Play, including in-house private apps.
iOS / iPadOS
Device-based VPP assignment needs no Apple ID on the device — the cleanest model for shared or corporate hardware.
Gotchas
- A Required app assigned to a user group installs on every device that user signs into — including shared machines.
- Device-targeted assignments apply regardless of who signs in, and are what you usually want for baseline software.
- Some things only work one way: certain configuration profiles are device-scoped only, and app protection policies are inherently user-scoped.
- During Autopilot, device groups may not have evaluated yet — which is why ESP-blocking apps are often better user-targeted.
- Apple ships a major macOS release every autumn; Intune's support for new settings typically arrives after, not on day one.
- Scripting support exists but is far shallower than Jamf's — no equivalent of extension attributes feeding dynamic group membership.
- Custom profiles via uploaded
.mobileconfigare the workaround for anything the GUI lacks. - If Macs are a large share of your fleet, seriously evaluate running Jamf or Mosyle alongside Intune rather than forcing everything through one console.
- Dynamic group membership evaluation: minutes, sometimes longer on large tenants.
- Policy sync: roughly every 8 hours on Windows by default, with shorter intervals after enrollment.
- Force a check-in from the device: Settings → Accounts → Access work or school → Info → Sync. On the Company Portal app, use the Sync button.
- When testing, verify in this order: group membership → policy assignment → device sync → client log. Skipping steps wastes time.
- The Apple MDM push certificate expires annually — renew with the same Apple ID or every Apple device must re-enrol.
- The Apple VPP token and ADE token also expire yearly.
- The Managed Google Play connection can silently disconnect and needs re-binding.
- Intune shows these in Tenant administration → Connectors and tokens. Check it on a schedule; nothing warns loudly enough.
Tips
Every Conditional Access policy should run in report-only for a week first. The sign-in logs show exactly who would have been blocked — usually including someone you didn't expect.
The console is slow for repetitive changes. Graph API (and the Microsoft.Graph PowerShell SDK) handles bulk edits, reporting, and automation properly.
IntuneManagementExtension.log for Win32 apps and scripts; MDMDiagnosticsTool.exe -area Autopilot -cab out.cab for enrollment issues. The portal rarely tells you why something failed.
Legacy profile templates are frozen; new settings land in the Settings Catalog. Author new profiles there so you're not migrating later.
Assign Intune licences via an Entra group rather than per user. New starters get licensed automatically, and "user has no licence" enrollment failures largely disappear.
EPM (an Intune Suite add-on) lets standard users elevate specific approved applications without holding permanent local admin rights.