Day-8: Microsoft Intune Foundations – MDM, MAM & Device Enrollment
🎯 Objective of Day-8
By the end of Day-8, you should be able to:
- Explain Intune confidently to technical & non-technical teams
- Understand how devices are enrolled and managed
- Identify common enrollment failures
- Prepare tenant correctly for policy implementation
1️⃣ What is Microsoft Intune?
Microsoft Intune is a cloud-based endpoint management solution that allows organizations to:
- Manage devices
- Enforce security policies
- Control applications
- Protect organizational data
📌 Intune works with Entra ID, not independently.
2️⃣ Intune High-Level Architecture
User
↓
Device
↓
Entra ID (Identity)
↓
Microsoft Intune (Management)
↓
Conditional Access (Enforcement)
✔ Entra ID = Who you are
✔ Intune = Is your device trusted?
✔ Conditional Access = Should access be allowed?
3️⃣ MDM vs MAM (Critical Concept)
🔹 MDM – Mobile Device Management
Controls:
- Entire device
- OS settings
- Password policies
- Encryption
- Compliance state
Used for:
- Corporate laptops
- Company-owned mobiles
🔹 MAM – Mobile Application Management
Controls:
- Only applications
- Corporate data inside apps
Examples:
- Restrict copy-paste from Outlook
- Prevent saving files locally
Used for:
- BYOD devices
📌 Interview line:
MDM manages devices, MAM manages data.
4️⃣ Platforms Supported by Intune
- Windows 10 / 11
- macOS
- iOS / iPadOS
- Android
- Linux (limited support)
5️⃣ Verify Intune Access (Admin Check)
Steps:
- Go to https://intune.microsoft.com
- Check if Devices and Tenant administration are visible
- If not visible → license or role issue
6️⃣ Check MDM Authority
Steps:
- Intune Admin Center
- Tenant Administration
- MDM Authority
✔ Must be Microsoft Intune
📌 Wrong authority = enrollment failures.
7️⃣ Intune Licensing (Reality Check)
Intune works on user-based licensing, not device-based.
Common licenses:
- M365 Business Premium
- EMS E3/E5
- M365 E3/E5
📌 No license = no enrollment.
8️⃣ Device Enrollment Methods
🔹 Windows Devices
- Azure AD Join
- Automatic MDM Enrollment
- Hybrid Azure AD Join
🔹 Mobile Devices
- Company Portal App
- User authentication
- Device registered in Intune
9️⃣ Configure Automatic Enrollment
Steps:
- Entra Admin Center
- Devices → Mobility (MDM and MAM)
- Microsoft Intune
- Enable MDM auto-enrollment
- Select users/groups
🔟 Enrollment Restrictions
Admins can restrict:
- Device type
- OS version
- Ownership
Steps:
- Intune → Devices
- Enrollment restrictions
- Configure platform rules
1️⃣1️⃣ Common Enrollment Failure Reasons
- No Intune license
- MDM enrollment disabled
- Device already registered
- Unsupported OS
- Device limit reached
📌 80% failures = licensing or scope misconfiguration.
1️⃣2️⃣ Security Impact of Intune
Without Intune:
- Any device can access data
- No compliance enforcement
With Intune:
- Device posture checked
- Conditional access enforced
- Data protected
✅ End of Day-8 Outcome
You can now:
✔ Explain Intune clearly
✔ Design enrollment strategies
✔ Troubleshoot enrollment failures
✔ Prepare tenant for policies
🔜 Day-9 Preview
Day-9: Device Compliance & Configuration Policies
- Password & encryption rules
- Compliance vs Configuration
- How Intune marks devices “Compliant”
- Real admin troubleshooting scenarios