Devices | Microsoft Zero Trust

📄️DEV-116 - Configure Privileged Roles for Intune Admins (PIM, CA, etc)

Implementation Effort: High – Requires privileged role review, Microsoft Entra Privileged Identity Management configuration, Conditional Access changes, and admin workflow updates.

📄️DEV-118 - RBAC

Implementation Effort: Medium – Requires role design, assignment planning, and ongoing maintenance of custom roles.

📄️DEV-119 - Multi-Admin Approval

Implementation Effort: Medium – Requires enabling access policies, designating approver groups, and updating automation scripts or exclusions for Graph API enforcement.

📄️DEV-120 - Scope Groups

Implementation Effort: Medium – Requires group design, role assignment cleanup, and operational governance.

📄️DEV-121 - Scope Tags & Scoped Permissions

Implementation Effort: Medium – Requires defining a tagging taxonomy, applying tags to all relevant objects, and validating role assignments with the Permissions Assessment Report.

📄️DEV-122 - Require SAW for Admin Actions

Implementation Effort: High – Requires device standards, Conditional Access, privileged workflow changes, and exception handling.

📄️DEV-149 - Stage Rollouts with Deployment Plans

Implementation Effort: Medium – Requires defining deployment ring structures, rollout cadence timings, and integrating with Multi-Admin Approval.

📄️DEV-150 - Security Copilot Agents in Intune (Agentic Identity)

Implementation Effort: Medium – Requires Security Copilot setup, provisioning Microsoft Entra agentic identities, and delegating scoped Entra and Defender XDR permissions.

📄️DEV-151 - Detect & Block Shadow AI / Local AI Agents

Implementation Effort: Low – Uses built-in Intune Properties Catalog collection, the Local AI Agent Security Baseline, Compliance Policies, and Defender for Endpoint AI Agent Runtime Protection.

📄️DEV-152 - Controlled Configuration for Defender Antivirus

Implementation Effort: Low – Single policy setting in Intune Endpoint Security Antivirus policies for Windows.

📄️DEV-153 - Windows Backup and Restore for Organizations

Implementation Effort: Low – Configured via a tenant-wide enrollment toggle and a Windows Settings Catalog policy (WindowsBackupAndRestore CSP).

📄️001: Filters

Implementation Effort: Low to Medium – Creating filters is straightforward, but good filter design requires clear targeting rules and testing.

📄️002: Device groups

Implementation Effort: Low to Medium – Group creation is easy, but governance and lifecycle management take planning.

📄️003: User groups

Implementation Effort: Low to Medium – User groups are simple to create, but maintaining accurate membership and ownership matters.

📄️004: Scope Tags

Implementation Effort: Medium – Requires taxonomy definition and cleanup of existing Intune objects.

📄️005: Scope Groups

Implementation Effort: Medium – Requires planned group design and testing with delegated administrators.

📄️006: Organizational Messages

Implementation Effort: Low to Medium – Basic setup is simple, but good message targeting and governance require coordination with communications and endpoint teams.

📄️007: Log Analytics

Implementation Effort: Medium – Requires diagnostic routing decisions, workspace governance, and coordination with security operations or SIEM owners.

📄️008: Data Warehouse

Implementation Effort: Medium – Requires reporting design, data access governance, and downstream analytics tooling.

📄️009: Graph API

Implementation Effort: Medium – Requires API design, app registration governance, permission review, and testing.

📄️010: Multi-Admin Approval

Implementation Effort: Medium – Requires approval policy design and governance of approver groups.

📄️011: Offboarding Strategy

Implementation Effort: Medium – Requires coordination across identity, endpoint, HR, and security operations processes.

📄️012: Connectors

Implementation Effort: Medium to High – Varies by connector; some are cloud-only integrations while others require on-premises infrastructure and certificate services.

📄️013: AI

Implementation Effort: Low to Medium – Enabling AI-assisted experiences is usually straightforward, but governance, licensing, and human review processes need planning.

📄️014: Quiet Time

Implementation Effort: Low – The technical setup is simple, but policy design should align to worker personas and support expectations.

📄️015: Automation / Orchestration

Implementation Effort: Medium to High – Depends on how far the organization goes beyond simple reporting automation into event-driven remediation and integration.

📄️016: DEX

Implementation Effort: Medium – Requires analytics interpretation, device baselines, and remediation ownership.

📄️017: Review enrolled vs unenrolled for BYOD/Corporate

Implementation Effort: Medium to High – Requires device-ownership decisions, enrollment-path design, and user communications.

📄️018: Review security, compliance, resource access requirements (Certs/Wi-Fi/VPN)

Implementation Effort: High – Certificate, Wi-Fi, and VPN design usually spans Intune, identity, network, PKI, and platform teams.

📄️019: Review App config vs App protection policies

Implementation Effort: Medium – Requires app inventory, data-protection decisions, and coordination with app owners.

📄️020: Data protection

Implementation Effort: Medium – Requires data classification decisions, app inventory review, and staged rollout across user populations.

📄️021: Access requirements

Implementation Effort: Medium to High – Requires alignment across identity, device, app, and data-protection teams.

📄️025: Data protection framework using App protection

Implementation Effort: Medium

📄️026: MAM Compliance and Conditional Access

Implementation Effort: Medium to High

📄️032: Review enrolled vs unenrolled for BYOD/Corporate

Implementation Effort: High

📄️033: Review security, compliance, resource access requirements (Certs/Wi-Fi/VPN)

Implementation Effort: High

📄️034: Review App config vs App protection policies

Implementation Effort: Medium

📄️037: Conditional launch settings

Implementation Effort: Medium

📄️039: Screen capture and Google Assistant

Implementation Effort: Medium

📄️043: Require Play Integrity Verdict (formerly SafetyNet)

Implementation Effort: Low – Built-in conditional launch setting in Intune App Protection Policies for Android.

📄️044: SafetyNet/ Hardware Back Key

Implementation Effort: Medium

📄️045: Data protection framework using App protection

Implementation Effort: Medium

📄️046: MAM Compliance and Conditional Access

Implementation Effort: Medium to High

📄️052: Require Threat Scan on apps

Implementation Effort: Low to Medium

📄️053: Review enrolled vs unenrolled for BYOD/Corporate

Implementation Effort: Medium to High

📄️054: Review security, compliance, resource access requirements (Certs/Wi-Fi/VPN)

Implementation Effort: High

📄️055: Review provisioning strategy

Implementation Effort: High

📄️060: Conditional Access policy

Implementation Effort: High

📄️061: Enrollment Restrictions

Implementation Effort: Low to Medium

📄️074: Entra Shared Device Mode

Implementation Effort: Medium to High

📄️078: Tunnel based VPN access for enrolled devices

Implementation Effort: High

📄️081: Review enrolled vs unenrolled for BYOD/Corporate

Implementation Effort: High

📄️082: Review security, compliance, resource access requirements (Certs/Wi-Fi/VPN)

Implementation Effort: High

📄️083: Review app provisioning strategy

Implementation Effort: Medium

📄️084: Android Device Administrator Retirement

Implementation Effort: Medium

📄️088: Conditional Access policy

Implementation Effort: Medium

📄️089: Enrollment Restrictions

Implementation Effort: Low to Medium

📄️103: Managed Home Screen (MHS) for Android Enterprise

Implementation Effort: Medium – Requires configuring Managed Home Screen app configuration policies, device configuration profiles, and optional Microsoft Entra Shared Device Mode.

📄️104: Entra Shared Device Mode

Implementation Effort: Medium

📄️107: Samsung Knox E-FOTA & Corporate Android eSIM Lifecycle

Implementation Effort: Medium – Requires linking Samsung Knox E-FOTA in the Intune admin center and Android 15+ for full corporate eSIM inventory and remote actions.

📄️108: Specialty, AR/VR & Spatial Computing Devices (Android XR, visionOS & tvOS)

Implementation Effort: Medium – Requires Apple Business Manager (ABM) for userless visionOS/tvOS Automated Device Enrollment or Managed Google Play for Android XR corporate enrollment.

📄️109: Mobile Threat Defense (MTD Role Permissions & Auto-Launch)

Implementation Effort: Medium – Requires enabling the MTD connector in Intune, deploying the MTD app (Microsoft Defender for Endpoint or partner), and enabling MTD role toggles.

📄️110: Tunnel based VPN access for enrolled devices

Implementation Effort: High

📄️114: Review provisioning strategy

Implementation Effort: Medium to High

📄️116: Deploy Hybrid Entra Join

Implementation Effort: High

📄️118: Stop AD DJ for new workstations

Implementation Effort: Medium

📄️119: Autopilot User Enrollment

Implementation Effort: Medium

📄️120: Autopilot Pre-provisioning

Implementation Effort: Medium to High

📄️121: Migrate GPO to MDM policies

Implementation Effort: High

📄️124: Apps Delivery / App Compatibility

Implementation Effort: High

📄️126: Compliance Policies (Client-Driven Evaluation & AI Agent Checks)

Implementation Effort: Medium – Requires defining platform compliance baselines, conditional access integration, and remediation notifications.

📄️131: MDM based policies for certs

Implementation Effort: Medium to High — certificate-based access usually requires coordination across Intune, PKI, networking, and identity teams.

📄️132: MDM based policies for Wi-Fi

Implementation Effort: Medium — secure Wi-Fi deployment usually requires coordination between Intune admins, network engineers, and PKI owners.

📄️133: MDM based policies for VPN

Implementation Effort: Medium to High — VPN deployments span Intune, identity, PKI, client platform engineering, and network infrastructure teams.

📄️134: Browser

Implementation Effort: Medium — browser hardening is straightforward technically, but extension governance, identity integration, and data protection decisions usually need stakeholder alignment.

📄️135: VDI Strategy

Implementation Effort: High — VDI and Cloud PC decisions affect identity, networking, app delivery, endpoint management, licensing, and operational support models.

📄️136: Enrollment Restrictions

Implementation Effort: Medium — the settings are simple to configure, but good restriction design depends on your join, enrollment, and exception processes.

📄️137: Compliance Policy

Implementation Effort: Medium — the controls are straightforward to configure, but the policy decisions have direct access-control consequences.

📄️138: Disk Encryption (Bitlocker)

Implementation Effort: Medium — BitLocker settings are easy to assign, but prerequisite validation and recovery processes require planning.

📄️139: Security Baselines

Implementation Effort: Medium – Requires reviewing baseline default settings against organizational requirements and testing across deployment rings.

📄️140: Windows Cloud LAPS

Implementation Effort: Medium — policy deployment is straightforward, but process changes for admin access, auditing, and password retrieval are important.

📄️141: Update Rings

Implementation Effort: Medium — defining update governance, pilot groups, and exception handling is more work than creating the policy itself.

📄️142: Feature Updates

Implementation Effort: Medium — setting a target version is simple, but app readiness, hardware readiness, and rollback planning require coordination.

📄️143: Quality Updates

Implementation Effort: Medium — monthly servicing is routine, but emergency patch workflows and hotpatch eligibility need disciplined operations.

📄️144: Delivery Optimization

Implementation Effort: Medium — policy setup is simple, but network-aware design and validation take coordination.

📄️128: Office Apps

Implementation Effort: Medium — app assignment is simple, but update channel, removal of legacy versions, and VDI considerations require planning.

📄️146: Store Apps

Implementation Effort: Low to Medium — onboarding Store apps is relatively easy, but app approval and lifecycle governance still matter.

📄️147: LOB Apps via Intune

Implementation Effort: Medium — simple packages are easy, but enterprise app deployment usually needs detection logic, dependencies, supersedence, and testing.

📄️148: WDAC / App Control

Implementation Effort: High — application allow-listing requires discovery, piloting, exception handling, and sustained operational ownership.

📄️149: WIP for Enrolled

Implementation Effort: Medium — retiring legacy protection features is usually more organizationally difficult than technically difficult.

📄️150: Endpoint Analytics

Implementation Effort: Medium — turning telemetry into action requires ownership and process, not just enabling the feature.

📄️151: Proactive Remediations

Implementation Effort: Medium — scripting is powerful but requires change control, testing, and ownership to avoid creating unmanaged drift.

📄️152: Organizational messages

Implementation Effort: Low to Medium — the technical setup is modest, but communications ownership and targeting discipline are important.

📄️153: Remote Assistance

Implementation Effort: Medium — enabling the service is straightforward, but secure support operations require role, identity, and audit design.

📄️154: Unattended Remote Assistance

Implementation Effort: Medium — the hardest part is governance and support-tool validation, not the toggle itself.

📄️155: Review logs using Azure Monitor in Microsoft Intune

Implementation Effort: Medium — exporting and retaining logs is easy to start, but useful monitoring requires workspace, access, query, and cost planning.

📄️156: WIP for Unenrolled

Implementation Effort: Medium — moving away from legacy unmanaged-device protections usually requires policy, app, and communications work.

📄️157: Deploy MDM based policies for EDR/AV

Implementation Effort: Medium to High — core AV settings are easy to assign, but EDR onboarding, exclusions, and policy precedence require coordination with security operations.

📄️158: MDM based policies for security baselines

Implementation Effort: Medium

📄️159: MDM based policies for BitLocker

Implementation Effort: Medium

📄️160: MDM based policies for firewall

Implementation Effort: Medium

📄️161: Attack surface reduction

Implementation Effort: High

📄️162: Account & Administrator Protection

Implementation Effort: Low – Configured through Intune Endpoint Security Account Protection profiles and Settings Catalog.

📄️163: Microsoft Cloud PKI

Implementation Effort: Low – Cloud-hosted root and issuing CAs require no on-premises servers, NDES, or Intune Certificate Connectors.

📄️165: Custom Compliance Policies

Implementation Effort: High

📄️166: Endpoint Privilege Management (EPM)

Implementation Effort: Medium – Requires defining elevation rules, configuring support-approval workflows, and transitioning users from local admin to standard user accounts.

📄️167: Remote Help (Attended & Unattended)

Implementation Effort: Low – Cloud-based remote assistance deployed via Intune with built-in Microsoft Entra ID authentication and Intune RBAC controls.

📄️168: Policies for Office Apps

Implementation Effort: Medium

📄️171: Review current management needs

Implementation Effort: Medium

📄️172: Evaluate macOS management with Intune + JAMF

Implementation Effort: High

📄️174: Device config policies through settings catalog

Implementation Effort: Medium

📄️175: Deploy macOS SSO extension

Implementation Effort: High

📄️178: Deploy MDM based policies for EDR/AV

Implementation Effort: High

📄️179: Certificates / Wi-Fi / VPN

Implementation Effort: High

📄️183: Local account management

Implementation Effort: Medium

📄️184: Managed macOS Updates (Declarative Device Management)

Implementation Effort: Low – Configured directly in the Intune Settings Catalog using Apple Declarative Device Management (DDM).

📄️186: Autopilot Device Preparation & Device Association

Implementation Effort: Medium – Requires configuring device preparation policies, enrollment time grouping, and optional device association for corporate-owned hardware.

📄️187: Enterprise App Management (EAM)

Implementation Effort: Low – Prepackaged catalog apps include pre-filled install commands, detection rules, and automatic update policies.

📄️189: Setup Notification and monitoring of Service Health Dashboard

Implementation Effort: Low

📄️Review Unenrolled BYOD MAM in the Context of Intune App Protection Policies

Implementation Effort: Medium

📄️Review Corporate Enrolled Devices in the Context of Intune App Protection Policies

Implementation Effort: Medium

📄️Review Data Protection Framework

Implementation Effort: Medium

📄️Backup to Android Backup Services

Implementation Effort: Low

📄️Transfer Telecommunication Data

Implementation Effort: Low

📄️Allow User to Save Copies to Selected Services

Implementation Effort: Low

📄️Cut, Copy, Paste in App Protection Policies

Implementation Effort: Low

📄️Approved Keyboards (Android Only)

Implementation Effort: Low

📄️Encryption in App Protection Policies

Implementation Effort: Low

📄️App Data Sync with Native Apps or Add-ins

Implementation Effort: Low

📄️Restrict Web Content Transfer with Other Apps

Implementation Effort: Low

📄️SafetyNet / Hardware Backed Key

Implementation Effort: Low

📄️Screen Capture and Google Assistant

Implementation Effort: Low

📄️App Protection and Conditional Access

Implementation Effort: Low

📄️RMD-MAM-33 - Apple Intelligence & Android AI Data Controls

Implementation Effort: Low – Configured through Intune App Protection Policies (MAM) and Settings Catalog (DDM for iOS/macOS and Android Enterprise).

📄️MDM 01: Intune MDM for iOS and Android: Corporate-Owned vs BYOD Deployment Strategies

Implementation Effort: Medium

📄️MDM_02: Device Compliance Policy in Intune for iOS and Android MDM

Implementation Effort: Medium

📄️MDM_03: Enrollment Restrictions for MDM for iOS and Android in Intune

Implementation Effort: Low

📄️MDM_04: Mobile Threat Defense for iOS and Android MDM in Intune

Implementation Effort: Medium

📄️Company Portal Customization

Implementation Effort: Low

📄️Windows Hotpatch & Virtualization-Based Security (VBS)

Implementation Effort: Low – Hotpatching is enabled by default for eligible devices in Windows Autopatch starting May 2026; requires Windows 11 Enterprise E3/E5 and Virtualization-Based Security (VBS) enabled.