📄 Article
Intune & Device Management: Complete Administration Guide
Microsoft Intune is the cloud-based endpoint management platform for Windows, macOS, iOS, and Android devices. Interviews consistently test policy types, enrollment methods, MDM vs MAM, and enrollment troubleshooting — this guide covers each with the exact answers interviewers expect.
📱 Types of Policies in Intune
| Policy Type | Purpose | Example |
|---|---|---|
| Configuration profiles | Push settings TO the device | Wi-Fi profile, BitLocker settings, restrictions |
| Compliance policies | Evaluate whether the device MEETS requirements | Require PIN, encryption, minimum OS version |
| App protection policies (MAM) | Protect corporate data inside apps | Block copy/paste from Outlook to personal apps |
| App configuration policies | Pre-configure settings inside managed apps | Set allowed accounts in Outlook mobile |
| Endpoint security policies | Focused security controls | Antivirus, firewall, disk encryption, security baselines |
| Conditional access | Gate access based on compliance (via Entra ID) | Only compliant devices can open Exchange Online |
⚖️ Configuration Policies vs Compliance Policies
💡 The Key Distinction
Configuration profiles enforce settings — they change the device. Compliance policies evaluate state — they don’t change anything, they mark the device compliant or non-compliant. The power comes from combining compliance with Conditional Access: non-compliant devices are blocked from corporate resources until they remediate.
🆚 MDM vs MAM
| Aspect | MDM (Mobile Device Management) | MAM (Mobile Application Management) |
|---|---|---|
| Scope | Manages the entire device | Manages only corporate apps and data |
| Enrollment | Device must be enrolled in Intune | No enrollment required (MAM-WE) |
| Best for | Corporate-owned devices | BYOD / personal devices |
| Wipe | Full or selective device wipe | Selective wipe of corporate data only |
🚀 Enrollment Methods
✅ Common Enrollment Options
- Windows Autopilot: Zero-touch provisioning for new corporate Windows devices — user unboxes, signs in, device configures itself
- Automated Device Enrollment (ADE, formerly DEP): Apple’s equivalent for corporate iOS/macOS devices purchased through Apple Business Manager
- BYOD / User enrollment: Users enroll personal devices via Company Portal, or use MAM-only protection without enrollment
- Group Policy / Co-management: Auto-enroll hybrid-joined Windows devices, or co-manage alongside Configuration Manager
- Android Enterprise: Work profile (BYOD), fully managed, or dedicated (kiosk) modes
Enrollment Prerequisites
⚠️ Prerequisites Checklist
- Intune license assigned to the user (e.g. M365 E3/E5, EMS E3/E5)
- MDM authority set to Intune in the tenant
- MDM user scope configured (Entra ID → Mobility → Microsoft Intune) to include the user
- Apple MDM push certificate uploaded (for iOS/macOS)
- Managed Google Play linked (for Android Enterprise)
- Device platform not blocked by enrollment restrictions
🛠️ Troubleshooting Enrollment Failures
1
Verify License and MDM Scope
Most failures come from a missing Intune license or the user not being included in the MDM user scope. Check enrollment restrictions (device limit, blocked platforms) next.
2
Check GPO Conflicts on Windows
A classic issue: enrollment fails for domain users but works for local admins. This usually means a Group Policy sets the MDM enrollment registry keys or an existing management authority conflicts. Review the “Enable automatic MDM enrollment using default Azure AD credentials” GPO.
3
Collect Diagnostics and Logs
Use built-in diagnostics before guessing.
💡 Key Log Locations
- Windows: Event Viewer → Applications and Services → Microsoft → Windows → DeviceManagement-Enterprise-Diagnostics-Provider → Admin
- Windows MDM diagnostics: Settings → Accounts → Access work or school → Export management log (creates
MDMDiagReport.html) - Intune portal: Devices → select device → Collect diagnostics (remote log collection, no user action needed)
- iOS/Android: Company Portal app → Settings → Send logs
Command Prompt — Windows MDM Diagnostics
REM Generate a full MDM diagnostic report mdmdiagnosticstool.exe -area DeviceEnrollment;DeviceProvisioning;Autopilot -zip C:\Temp\MDMDiag.zip REM Check device enrollment / join status dsregcmd /status
🔐 Conditional Access with Device Compliance
💡 How They Work Together
Intune reports each device’s compliance state to Entra ID. A Conditional Access policy can then require a compliant device to access apps like Exchange Online or SharePoint. Non-compliant devices are blocked or forced to remediate — this is the core of a Zero Trust device posture.
💡 Best Practices & Recommendations
- Use Autopilot + Enrollment Status Page for corporate Windows devices so devices arrive fully configured
- Apply MAM app protection policies to BYOD instead of forcing full enrollment
- Always pair compliance policies with Conditional Access — compliance without enforcement is just reporting
- Set a grace period on compliance policies to avoid locking out users instantly
- Pilot every policy with a test group before broad assignment
- Use security baselines as a starting point, then document every deviation
🎓 Common Interview Questions
Q: What types of policies are there in Intune?
Configuration profiles (push settings), compliance policies (evaluate device health), app protection policies (MAM), app configuration policies, endpoint security policies (antivirus, firewall, encryption, baselines), and enrollment restrictions — plus Conditional Access via Entra ID which consumes the compliance signal.
Q: What is the difference between configuration policies and compliance policies?
Configuration profiles change the device — they enforce settings like Wi-Fi, restrictions, or BitLocker. Compliance policies don’t change anything; they check whether the device meets requirements (PIN, encryption, OS version) and mark it compliant or non-compliant. That state then feeds Conditional Access to allow or block resource access.
Q: What is the difference between MDM and MAM?
MDM manages the whole device and requires enrollment — ideal for corporate-owned hardware, with full wipe capability. MAM manages only the corporate apps and data (e.g. Outlook, Teams) without enrolling the device — ideal for BYOD, with selective wipe that removes corporate data while leaving personal content untouched.
Q: How does device enrollment work in Intune and what are the prerequisites?
The user or provisioning process registers the device with Entra ID and enrolls it into Intune management, after which policies and apps are delivered. Prerequisites: an Intune license for the user, MDM authority set to Intune, the user included in the MDM user scope, an Apple MDM push certificate for Apple devices, Managed Google Play for Android Enterprise, and no blocking enrollment restrictions.
Q: How do you troubleshoot a device enrollment failure?
Verify license and MDM user scope first, then enrollment restrictions (platform/device limits). On Windows, check for GPO conflicts and run
dsregcmd /status plus the DeviceManagement-Enterprise event log; export the MDM diagnostic report or use “Collect diagnostics” from the Intune portal. On mobile, collect Company Portal logs. Error codes like 0x80180014 (platform blocked) or 0x80180003 (not licensed) point directly to the cause.📚 References & Further Reading
- 🔗 Intune enrollment deployment guide — Microsoft Learn
- 🔗 Device compliance policies in Intune — Microsoft Learn
- 🔗 Windows Autopilot overview — Microsoft Learn