Series: 30 Days of Microsoft 365 Admin

---

🎯 Day-6 Objective

Today’s goal is to:

• Enable device management
• Bring devices under Microsoft control
• Prepare for device-based Conditional Access

---

1️⃣ Verify Microsoft Intune is Enabled

🔧 Steps

1. Open Microsoft Intune Admin Center
2. Go to Tenant administration
3. Click Tenant status

✅ Confirm

• Intune status = Active
• MDM authority = Microsoft Intune

📌 If MDM authority is not set → devices cannot be managed

---

2️⃣ Check MDM Auto-Enrollment Settings

🔧 Steps

1. Intune Admin Center
2. Devices → Enroll devices
3. Click Automatic enrollment

⚙ Configure

• MDM user scope: All users (or Test group)
• Save changes

🧠 This allows devices to auto-enroll when users sign in.

---

3️⃣ Configure Device Enrollment Restrictions

🔧 Steps

1. Intune Admin Center
2. Devices → Enroll devices
3. Click Enrollment restrictions
4. Open Default restriction

🔍 Verify

• Platform: Windows = Allowed
• Personal devices = Allowed (for lab)

📌 In production, personal devices are usually restricted.

---

4️⃣ Register a Windows Device (Hands-On)

🔧 On Windows Machine

1. Open Settings
2. Go to Accounts
3. Click Access work or school
4. Click Connect
5. Sign in with M365 test user

✅ Result

• Device is registered in Entra ID
• User can access M365 apps

---

5️⃣ Verify Device in Entra ID

🔧 Steps

1. Entra Admin Center
2. Devices → All devices
3. Locate the registered device

🔍 Check

• Join type: Azure AD registered
• Owner: User name
• Status: Active

---

6️⃣ Verify Device in Intune

🔧 Steps

1. Intune Admin Center
2. Devices → All devices
3. Select the device

📊 You Can See

• Device name
• OS version
• Compliance status (Not evaluated yet)

📌 Device is now manageable.

---

7️⃣ Understand Device Compliance Status

🔧 Where to Check

Intune → Devices → All devices → Device → Compliance

Default Status

• Non-compliant (no policy assigned)

🧠 This is important:

Conditional Access checks compliance, not just registration.

---

8️⃣ Connect Devices with Conditional Access (Preview)

🔐 Scenario

• User signs in
• MFA passes
• Device = Non-compliant
• Access = Blocked (once policy applied)

📌 Actual enforcement comes in Day-7.

---

✅ End of Day-6 Outcome

After Day-6, you can:
✔ Enable Intune correctly
✔ Register devices
✔ Verify device status
✔ Understand compliance dependency
✔ Explain device-based access in interviews

---

📅 DAY-7 PREVIEW (NEXT DAY PLAN)

Day-7: Intune Compliance & Configuration Policies

We will:
🔹 Create compliance policies
🔹 Enforce BitLocker & OS version
🔹 Mark devices compliant / non-compliant
🔹 Block access for non-compliant devices
🔹 Validate using Conditional Access