Devices | Microsoft Zero Trust

📄️ DEV-116 - Configure Privileged Roles for Intune Admins (PIM, CA, etc)

Implementation Effort: Medium – Requires planning and configuration of Conditional Access policies specifically targeting admin roles.

📄️ DEV-118 - RBAC

Implementation Effort: Medium – Requires role design, assignment planning, and ongoing maintenance of custom roles.

📄️ DEV-119 - Multi-Admin Approval

Implementation Effort: Medium – Requires enabling the feature and defining approval policies with designated approvers.

📄️ DEV-120 - Scope Groups

Implementation Effort: Medium – Requires planning of group structure aligned to organizational boundaries and ongoing group membership management.

📄️ DEV-121 - Scope Tags

Implementation Effort: Medium – Requires defining a tagging taxonomy, applying tags to all relevant objects, and maintaining consistency as new policies are created.

📄️ DEV-122 - Require SAW for Admin Actions

Implementation Effort: High – Requires procuring and provisioning dedicated Secure Admin Workstations, defining Conditional Access policies, and changing admin workflows.

📄️ 001: Filters

Implementation Effort: Low – IT and Security Operations teams need to create new filters as smarter grouping and targetting method.

📄️ 002: Device groups

Implementation Effort: Low – IT and Security Operations teams need to create new devices groups.

📄️ 003: User groups

Implementation Effort: Low – IT and Security Operations teams need to create new user groups.

📄️ 004: Scope Tags

Implementation Effort: Medium – IT and Security Operations teams need scope tags and assign them to users and devices.

📄️ 005: Scope Groups

Implementation Effort: Medium – IT and Security Operations teams may need to create new users and devices groups to be used for RBAC controls.

📄️ 006: Organizational Messages

Overview

📄️ 015: Automation / Orchestration

Overview

📄️ 017: Review enrolled vs unenrolled for BYOD/Corporate

Overview

📄️ 018: Review security, compliance, resource access requirements (Certs/Wi-Fi/VPN)

Overview

📄️ 019: Review App config vs App protection policies

Overview

📄️ 025: Data protection framework using App protection

Overview

📄️ 026: MAM Compliance and Conditional Access

Overview

📄️ 032: Review enrolled vs unenrolled for BYOD/Corporate

Overview

📄️ 033: Review security, compliance, resource access requirements (Certs/Wi-Fi/VPN)

Overview

📄️ 034: Review App config vs App protection policies

Overview

📄️ 037: Conditional launch settings

Overview

📄️ 039: Screen capture and Google Assistant

Overview

📄️ 044: SafetyNet/ Hardware Back Key

Overview

📄️ 045: Data protection framework using App protection

Overview

📄️ 046: MAM Compliance and Conditional Access

Overview

📄️ 052: Require Threat Scan on apps

Overview

📄️ 053: Review enrolled vs unenrolled for BYOD/Corporate

Overview

📄️ 054: Review security, compliance, resource access requirements (Certs/Wi-Fi/VPN)

Overview

📄️ 055: Review provisioning strategy

Overview

📄️ 057: Apple Managed Accounts

Overview

📄️ 060: Conditional Access policy

Overview

📄️ 061: Enrollment Restrictions

Overview

📄️ 074: Entra Shared Device Mode

Overview

📄️ 078: Tunnel based VPN access for enrolled devices

Overview

📄️ 081: Review enrolled vs unenrolled for BYOD/Corporate

Overview

📄️ 082: Review security, compliance, resource access requirements (Certs/Wi-Fi/VPN)

Overview

📄️ 083: Review app provisioning strategy

Overview

📄️ 084: Android Device Administrator Retirement

Overview

📄️ 088: Conditional Access policy

Overview

📄️ 089: Enrollment Restrictions

Overview

📄️ 104: Entra Shared Device Mode

Overview

📄️ 110: Tunnel based VPN access for enrolled devices

Overview

📄️ 114: Review provisioning strategy

Overview

📄️ 115: Co-management Strategy

Overview

📄️ 116: Deploy Hybrid Entra Join

Overview

📄️ 117: Deploy Entra Join Only

Video Walkthrough:

📄️ 118: Stop AD DJ for new workstations

Overview

📄️ 119: Autopilot User Enrollment

Overview

📄️ 120: Autopilot Pre-provisioning

Overview

📄️ 121: Migrate GPO to MDM policies

Overview

📄️ 124: Apps Delivery / App Compatibility

Overview

📄️ 131: MDM based policies for certs

Overview

📄️ 132: MDM based policies for Wi-Fi

Overview

📄️ 133: MDM based policies for VPN

Overview

📄️ 136: Enrollment Restrictions

Overview

📄️ 138: Disk Encryption (Bitlocker)

Overview

📄️ 151: Proactive Remediations

Overview

📄️ 152: Organizational messages

Overview

📄️ 154: Unattended Remote Assistance

Overview

📄️ 155: Review logs using Azure Monitor in Microsoft Intune

Implementation Effort:

📄️ 157: Deploy MDM based policies for EDR/AV

Overview

📄️ 158: MDM based policies for security baselines

Overview

📄️ 159: MDM based policies for BitLocker

Overview

📄️ 160: MDM based policies for firewall

Overview

📄️ 161: Attack surface reduction

Overview

📄️ 165: Custom Compliance Policies

Overview

📄️ 168: Policies for Office Apps

Overview

📄️ 171: Review current management needs

Overview

📄️ 172: Evaluate macOS management with Intune + JAMF

Overview

📄️ 174: Device config policies through settings catalog

Overview

📄️ 175: Deploy macOS SSO extension

Overview

📄️ 178: Deploy MDM based policies for EDR/AV

Overview

📄️ 179: Certificates / Wi-Fi / VPN

Overview

📄️ 183: Local account management

Overview

📄️ 184: Native update management

Overview

📄️ 186: Autopilot Device Preparation

Overview

📄️ 187: Enterprise App Management

Implementation Effort: Low

📄️ 189: Setup Notification and monitoring of Service Health Dashboard

Overview

📄️ MAM Overview

Implementation Effort: Medium – IT and Security Operations teams need to define app protection policies, configure supported apps, and maintain ongoing policy updates and user support.

📄️ Review Unenrolled BYOD MAM in the Context of Intune App Protection Policies

Implementation Effort: Medium – IT and Security Operations teams must configure app protection policies, define app configuration profiles, and maintain ongoing support for BYOD users.

📄️ Review Corporate Enrolled Devices in the Context of Intune App Protection Policies

Implementation Effort: Low – IT and Security Operations teams only need to apply targeted app protection policies to already-enrolled corporate devices, with minimal configuration overhead.

📄️ Review Data Protection Framework

Implementation Effort: Medium – IT and Security Operations teams must assess organizational risk levels, map users to protection tiers, and configure appropriate App Protection Policies (APP) in Intune.

📄️ Backup to Android Backup Services

Implementation Effort: Low – IT administrators only need to configure a single setting within the Android App Protection Policy in Microsoft Intune.

📄️ Backup to iCloud

Implementation Effort: Low – IT administrators only need to configure a single setting within the iOS/iPadOS App Protection Policy in Microsoft Intune.

📄️ Send Org Data to Other Apps

Implementation Effort: Low – IT administrators only need to configure a single setting within the App Protection Policy in Microsoft Intune.

📄️ Transfer Telecommunication Data

Implementation Effort: Low – IT administrators only need to configure a single setting within the App Protection Policies in Microsoft Intune for Android and iOS/iPadOS.

📄️ Tunnel for MAM

Implementation Effort: Medium – IT and Security Operations teams must deploy the Microsoft Tunnel Gateway, configure VPN profiles, and ensure apps are integrated with the Intune App SDK and Microsoft Authentication Library (MSAL).

📄️ Allow User to Save Copies to Selected Services

Implementation Effort: Low – IT administrators only need to configure this setting within the App Protection Policies for Android and iOS/iPadOS in Microsoft Intune.

📄️ Cut, Copy, Paste in App Protection Policies

Implementation Effort: Low – IT administrators only need to configure this setting within the App Protection Policies in Microsoft Intune.

📄️ Screen Capture

Implementation Effort: Low – IT administrators only need to configure a setting within the App Protection Policy or device restriction policy, depending on the platform.

📄️ Approved Keyboards (Android Only)

Implementation Effort: Low – IT administrators only need to configure the approved keyboard list within the App Protection Policies for Android in Microsoft Intune.

📄️ 3rd Party Keyboards for iOS

Implementation Effort: Low

📄️ Encryption in App Protection Policies

Implementation Effort: Low – IT administrators only need to enable encryption settings within the App Protection Policies in Microsoft Intune.

📄️ App Data Sync with Native Apps or Add-ins

Implementation Effort: Low – IT administrators only need to configure a single setting within the App Protection Policies in Microsoft Intune for Android and iOS/iPadOS.

📄️ Restrict Web Content Transfer with Other Apps

Implementation Effort: Low – IT administrators only need to configure a single setting within the App Protection Policies for iOS/iPadOS and Android in Microsoft Intune.

📄️ Org Data Notifications

Implementation Effort: Low – IT administrators only need to configure this setting within the App Protection Policies in Microsoft Intune.

📄️ PIN or Biometric

Implementation Effort: Low

📄️ Time Out

Implementation Effort: Low

📄️ PIN Reset

Implementation Effort: Low

📄️ Work or School Account

Implementation Effort: Low

📄️ Recheck Access Requirement

Implementation Effort: Low

📄️ App Condition

Implementation Effort: Low

📄️ Jailbroken/Rooted Devices

Implementation Effort: Low

📄️ Require Threat Scan on Apps

Implementation Effort: Low

📄️ Require SafetyNet

Implementation Effort: Low

📄️ Mobile Threat Defense

Implementation Effort: Medium

📄️ Knox Attestation

Implementation Effort: Low

📄️ SafetyNet / Hardware Backed Key

Implementation Effort: Low

📄️ Screen Capture and Google Assistant

Implementation Effort: Low

📄️ App Protection and Conditional Access

Implementation Effort: Low

📄️ MDM 01: Intune MDM for iOS and Android: Corporate-Owned vs BYOD Deployment Strategies

Implementation Effort: Medium

📄️ MDM_02: Device Compliance Policy in Intune for iOS and Android MDM

Implementation Effort: Medium

📄️ MDM_03: Enrollment Restrictions for MDM for iOS and Android in Intune

Implementation Effort: Low

📄️ MDM_04: Mobile Threat Defense for iOS and Android MDM in Intune

Implementation Effort: Medium

📄️ Company Portal Customization

Implementation Effort: Low – This feature only requires targeted configuration actions in Microsoft Intune, such as uploading branding assets and setting preferences.

📄️ Terms and Conditions

Implementation Effort: Low — Requires configuration policies and document upload, but does not require ongoing user management once deployed.

📄️ Windows Hotpatch & VBS

Implementation Effort: Medium — Requires IT to configure policies via Intune or Group Policy and coordinate across identity, device, and security teams.

📄️ Office Add-ins

Overview

📄️ Intune Advanced Analytics

Implementation Effort: Medium

📄️ Passwordless and Windows Hello for Business (WHfB)

Implementation Effort: Medium — Requires IT to configure policies via Intune or Group Policy and coordinate across identity, device, and security teams.