メインコンテンツへスキップ

033: Review security, compliance, resource access requirements (Certs/Wi-Fi/VPN)

Implementation Effort: High
User Impact: Medium to High

Overview​

Before implementing Microsoft Intune device policies, administrators should review which security, compliance, and network-access controls are required for each device population. This is especially important when deciding whether devices need certificates, Wi-Fi profiles, VPN access, or only app-level protection.

In Zero Trust, resource access should be deliberate and conditional. You should not deploy certificates, network profiles, or compliance controls simply because they are available.

Implementation Guidance​

  1. Define the resources mobile users need to access:
    • Microsoft 365 cloud services
    • On-premises web applications
    • Private line-of-business apps
    • Wi-Fi networks that require certificate-based authentication
    • VPN-protected resources
  2. Determine whether access should be granted through modern internet-native patterns or whether a device-bound control is required.
  3. For each device population, decide whether you need:
    • Intune compliance policy
    • Configuration profiles
    • SCEP/PKCS certificates
    • Wi-Fi profiles
    • Microsoft Tunnel or another VPN profile
  4. Avoid forcing legacy network patterns onto BYOD users when protected app or reverse-proxy access would be more appropriate.
  5. Document which requirements are mandatory for corporate-owned devices and which are optional or unsupported for BYOD.
  6. Validate certificate lifecycle, revocation, and renewal processes before production rollout.
  7. Review the model with identity, network, and security teams so Conditional Access, certificate services, and network controls all align.

This review should produce an architecture decision, not just a checklist. Administrators need to know why each profile exists and who truly needs it.

Reference​