Devices | Microsoft Zero Trust

📄️DEV-116 - Configure Privileged Roles for Intune Admins (PIM, CA, etc)

Implementation Effort: Medium – Requires planning and configuration of Conditional Access policies specifically targeting admin roles.

📄️DEV-118 - RBAC

Implementation Effort: Medium – Requires role design, assignment planning, and ongoing maintenance of custom roles.

📄️DEV-119 - Multi-Admin Approval

Implementation Effort: Medium – Requires enabling access policies, designating approver groups, and updating automation scripts or exclusions for Graph API enforcement.

📄️DEV-120 - Scope Groups

Implementation Effort: Medium – Requires planning of group structure aligned to organizational boundaries and ongoing group membership management.

📄️DEV-121 - Scope Tags & Scoped Permissions

Implementation Effort: Medium – Requires defining a tagging taxonomy, applying tags to all relevant objects, and validating role assignments with the Permissions Assessment Report.

📄️DEV-122 - Require SAW for Admin Actions

Implementation Effort: High – Requires procuring and provisioning dedicated Secure Admin Workstations, defining Conditional Access policies, and changing admin workflows.

📄️DEV-149 - Stage Rollouts with Deployment Plans

Implementation Effort: Medium – Requires defining deployment ring structures, rollout cadence timings, and integrating with Multi-Admin Approval.

📄️DEV-150 - Security Copilot Agents in Intune (Agentic Identity)

Implementation Effort: Medium – Requires Security Copilot setup, provisioning Microsoft Entra agentic identities, and delegating scoped Entra and Defender XDR permissions.

📄️DEV-151 - Detect & Block Shadow AI / Local AI Agents

Implementation Effort: Low – Uses built-in Intune Properties Catalog collection, the Local AI Agent Security Baseline, Compliance Policies, and Defender for Endpoint AI Agent Runtime Protection.

📄️DEV-152 - Controlled Configuration for Defender Antivirus

Implementation Effort: Low – Single policy setting in Intune Endpoint Security Antivirus policies for Windows.

📄️DEV-153 - Windows Backup and Restore for Organizations

Implementation Effort: Low – Configured via a tenant-wide enrollment toggle and a Windows Settings Catalog policy (WindowsBackupAndRestore CSP).

📄️001: Filters

Implementation Effort: Low – IT and Security Operations teams need to create new filters as a smarter grouping and targeting method.

📄️002: Device groups

Implementation Effort: Low – IT and Security Operations teams need to create new devices groups.

📄️003: User groups

Implementation Effort: Low – IT and Security Operations teams need to create new user groups.

📄️004: Scope Tags

Implementation Effort: Medium – IT and Security Operations teams need scope tags and assign them to users and devices.

📄️005: Scope Groups

Implementation Effort: Medium – IT and Security Operations teams may need to create new users and devices groups to be used for RBAC controls.

📄️006: Organizational Messages

Overview

📄️015: Automation / Orchestration

Overview

📄️017: Review enrolled vs unenrolled for BYOD/Corporate

Overview

📄️018: Review security, compliance, resource access requirements (Certs/Wi-Fi/VPN)

Overview

📄️019: Review App config vs App protection policies

Overview

📄️025: Data protection framework using App protection

Overview

📄️026: MAM Compliance and Conditional Access

Overview

📄️032: Review enrolled vs unenrolled for BYOD/Corporate

Overview

📄️033: Review security, compliance, resource access requirements (Certs/Wi-Fi/VPN)

Overview

📄️034: Review App config vs App protection policies

Overview

📄️037: Conditional launch settings

Overview

📄️039: Screen capture and Google Assistant

Overview

📄️043: Require Play Integrity Verdict (formerly SafetyNet)

Implementation Effort: Low – Built-in conditional launch setting in Intune App Protection Policies for Android.

📄️044: SafetyNet/ Hardware Back Key

Overview

📄️045: Data protection framework using App protection

Overview

📄️046: MAM Compliance and Conditional Access

Overview

📄️052: Require Threat Scan on apps

Overview

📄️053: Review enrolled vs unenrolled for BYOD/Corporate

Overview

📄️054: Review security, compliance, resource access requirements (Certs/Wi-Fi/VPN)

Overview

📄️055: Review provisioning strategy

Overview

📄️060: Conditional Access policy

Overview

📄️061: Enrollment Restrictions

Overview

📄️074: Entra Shared Device Mode

Overview

📄️078: Tunnel based VPN access for enrolled devices

Overview

📄️081: Review enrolled vs unenrolled for BYOD/Corporate

Overview

📄️082: Review security, compliance, resource access requirements (Certs/Wi-Fi/VPN)

Overview

📄️083: Review app provisioning strategy

Overview

📄️084: Android Device Administrator Retirement

Overview

📄️088: Conditional Access policy

Overview

📄️089: Enrollment Restrictions

Overview

📄️103: Managed Home Screen (MHS) for Android Enterprise

Implementation Effort: Medium – Requires configuring Managed Home Screen app configuration policies, device configuration profiles, and optional Microsoft Entra Shared Device Mode.

📄️104: Entra Shared Device Mode

Overview

📄️107: Samsung Knox E-FOTA & Corporate Android eSIM Lifecycle

Implementation Effort: Medium – Requires linking Samsung Knox E-FOTA in the Intune admin center and Android 15+ for full corporate eSIM inventory and remote actions.

📄️108: Specialty, AR/VR & Spatial Computing Devices (Android XR, visionOS & tvOS)

Implementation Effort: Medium – Requires Apple Business Manager (ABM) for userless visionOS/tvOS Automated Device Enrollment or Managed Google Play for Android XR corporate enrollment.

📄️109: Mobile Threat Defense (MTD Role Permissions & Auto-Launch)

Implementation Effort: Medium – Requires enabling the MTD connector in Intune, deploying the MTD app (Microsoft Defender for Endpoint or partner), and enabling MTD role toggles.

📄️110: Tunnel based VPN access for enrolled devices

Overview

📄️114: Review provisioning strategy

Overview

📄️116: Deploy Hybrid Entra Join

Overview

📄️118: Stop AD DJ for new workstations

Overview

📄️119: Autopilot User Enrollment

Overview

📄️120: Autopilot Pre-provisioning

Overview

📄️121: Migrate GPO to MDM policies

Overview

📄️124: Apps Delivery / App Compatibility

Overview

📄️126: Compliance Policies (Client-Driven Evaluation & AI Agent Checks)

Implementation Effort: Medium – Requires defining platform compliance baselines, conditional access integration, and remediation notifications.

📄️131: MDM based policies for certs

Overview

📄️132: MDM based policies for Wi-Fi

Overview

📄️133: MDM based policies for VPN

Overview

📄️136: Enrollment Restrictions

Overview

📄️138: Disk Encryption (Bitlocker)

Overview

📄️139: Security Baselines

Implementation Effort: Medium – Requires reviewing baseline default settings against organizational requirements and testing across deployment rings.

📄️152: Organizational messages

Overview

📄️154: Unattended Remote Assistance

Overview

📄️155: Review logs using Azure Monitor in Microsoft Intune

Implementation Effort:

📄️157: Deploy MDM based policies for EDR/AV

Overview

📄️158: MDM based policies for security baselines

Overview

📄️159: MDM based policies for BitLocker

Overview

📄️160: MDM based policies for firewall

Overview

📄️161: Attack surface reduction

Overview

📄️162: Account & Administrator Protection

Implementation Effort: Low – Configured through Intune Endpoint Security Account Protection profiles and Settings Catalog.

📄️163: Microsoft Cloud PKI

Implementation Effort: Low – Cloud-hosted root and issuing CAs require no on-premises servers, NDES, or Intune Certificate Connectors.

📄️165: Custom Compliance Policies

Overview

📄️166: Endpoint Privilege Management (EPM)

Implementation Effort: Medium – Requires defining elevation rules, configuring support-approval workflows, and transitioning users from local admin to standard user accounts.

📄️167: Remote Help (Attended & Unattended)

Implementation Effort: Low – Cloud-based remote assistance deployed via Intune with built-in Microsoft Entra ID authentication and Intune RBAC controls.

📄️168: Policies for Office Apps

Overview

📄️171: Review current management needs

Overview

📄️172: Evaluate macOS management with Intune + JAMF

Overview

📄️174: Device config policies through settings catalog

Overview

📄️175: Deploy macOS SSO extension

Overview

📄️178: Deploy MDM based policies for EDR/AV

Overview

📄️179: Certificates / Wi-Fi / VPN

Overview

📄️183: Local account management

Overview

📄️184: Managed macOS Updates (Declarative Device Management)

Implementation Effort: Low – Configured directly in the Intune Settings Catalog using Apple Declarative Device Management (DDM).

📄️186: Autopilot Device Preparation & Device Association

Implementation Effort: Medium – Requires configuring device preparation policies, enrollment time grouping, and optional device association for corporate-owned hardware.

📄️187: Enterprise App Management (EAM)

Implementation Effort: Low – Prepackaged catalog apps include pre-filled install commands, detection rules, and automatic update policies.

📄️189: Setup Notification and monitoring of Service Health Dashboard

Overview

📄️MAM Overview

Implementation Effort: Medium – IT and Security Operations teams need to define app protection policies, configure supported apps, and maintain ongoing policy updates and user support.

📄️Review Unenrolled BYOD MAM in the Context of Intune App Protection Policies

Implementation Effort: Medium – IT and Security Operations teams must configure app protection policies, define app configuration profiles, and maintain ongoing support for BYOD users.

📄️Review Corporate Enrolled Devices in the Context of Intune App Protection Policies

Implementation Effort: Low – IT and Security Operations teams only need to apply targeted app protection policies to already-enrolled corporate devices, with minimal configuration overhead.

📄️Review Data Protection Framework

Implementation Effort: Medium – IT and Security Operations teams must assess organizational risk levels, map users to protection tiers, and configure appropriate App Protection Policies (APP) in Intune.

📄️Backup to Android Backup Services

Implementation Effort: Low – IT administrators only need to configure a single setting within the Android App Protection Policy in Microsoft Intune.

📄️Backup to iCloud

Implementation Effort: Low – IT administrators only need to configure a single setting within the iOS/iPadOS App Protection Policy in Microsoft Intune.

📄️Send Org Data to Other Apps

Implementation Effort: Low – IT administrators only need to configure a single setting within the App Protection Policy in Microsoft Intune.

📄️Transfer Telecommunication Data

Implementation Effort: Low – IT administrators only need to configure a single setting within the App Protection Policies in Microsoft Intune for Android and iOS/iPadOS.

📄️Tunnel for MAM

Implementation Effort: Medium – IT and Security Operations teams must deploy the Microsoft Tunnel Gateway, configure VPN profiles, and ensure apps are integrated with the Intune App SDK and Microsoft Authentication Library (MSAL).

📄️Allow User to Save Copies to Selected Services

Implementation Effort: Low – IT administrators only need to configure this setting within the App Protection Policies for Android and iOS/iPadOS in Microsoft Intune.

📄️Cut, Copy, Paste in App Protection Policies

Implementation Effort: Low – IT administrators only need to configure this setting within the App Protection Policies in Microsoft Intune.

📄️Screen Capture

Implementation Effort: Low – IT administrators only need to configure a setting within the App Protection Policy or device restriction policy, depending on the platform.

📄️Approved Keyboards (Android Only)

Implementation Effort: Low – IT administrators only need to configure the approved keyboard list within the App Protection Policies for Android in Microsoft Intune.

📄️3rd Party Keyboards for iOS

Implementation Effort: Low

📄️Encryption in App Protection Policies

Implementation Effort: Low – IT administrators only need to enable encryption settings within the App Protection Policies in Microsoft Intune.

📄️App Data Sync with Native Apps or Add-ins

Implementation Effort: Low – IT administrators only need to configure a single setting within the App Protection Policies in Microsoft Intune for Android and iOS/iPadOS.

📄️Restrict Web Content Transfer with Other Apps

Implementation Effort: Low – IT administrators only need to configure a single setting within the App Protection Policies for iOS/iPadOS and Android in Microsoft Intune.

📄️Org Data Notifications

Implementation Effort: Low – IT administrators only need to configure this setting within the App Protection Policies in Microsoft Intune.

📄️PIN or Biometric

Implementation Effort: Low

📄️Time Out

Implementation Effort: Low

📄️PIN Reset

Implementation Effort: Low

📄️Work or School Account

Implementation Effort: Low

📄️Recheck Access Requirement

Implementation Effort: Low

📄️App Condition

Implementation Effort: Low

📄️Jailbroken/Rooted Devices

Implementation Effort: Low

📄️Require Threat Scan on Apps

Implementation Effort: Low

📄️Require SafetyNet

Implementation Effort: Low

📄️Mobile Threat Defense

Implementation Effort: Medium

📄️Knox Attestation

Implementation Effort: Low

📄️SafetyNet / Hardware Backed Key

Implementation Effort: Low

📄️Screen Capture and Google Assistant

Implementation Effort: Low

📄️App Protection and Conditional Access

Implementation Effort: Low

📄️RMD-MAM-33 - Apple Intelligence & Android AI Data Controls

Implementation Effort: Low – Configured through Intune App Protection Policies (MAM) and Settings Catalog (DDM for iOS/macOS and Android Enterprise).

📄️MDM 01: Intune MDM for iOS and Android: Corporate-Owned vs BYOD Deployment Strategies

Implementation Effort: Medium

📄️MDM_02: Device Compliance Policy in Intune for iOS and Android MDM

Implementation Effort: Medium

📄️MDM_03: Enrollment Restrictions for MDM for iOS and Android in Intune

Implementation Effort: Low

📄️MDM_04: Mobile Threat Defense for iOS and Android MDM in Intune

Implementation Effort: Medium

📄️Company Portal Customization

Implementation Effort: Low – This feature only requires targeted configuration actions in Microsoft Intune, such as uploading branding assets and setting preferences.

📄️Terms and Conditions

Implementation Effort: Low — Requires configuration policies and document upload, but does not require ongoing user management once deployed.

📄️Windows Hotpatch & Virtualization-Based Security (VBS)

Implementation Effort: Low – Hotpatching is enabled by default for eligible devices in Windows Autopatch starting May 2026; requires Windows 11 Enterprise E3/E5 and Virtualization-Based Security (VBS) enabled.

📄️Office Add-ins

Overview

📄️Intune Advanced Analytics & Multi-Device Query

Implementation Effort: Medium – Requires enabling Properties Catalog collection policies and training admins on KQL for Multi-Device Query.

📄️Passwordless and Windows Hello for Business (WHfB)

Implementation Effort: Medium — Requires IT to configure policies via Intune or Group Policy and coordinate across identity, device, and security teams.