跳到主要內容

054: Review security, compliance, resource access requirements (Certs/Wi-Fi/VPN)

Implementation Effort: High

User Impact: Medium to High

Overview​

Before deploying Intune policies broadly, define the controls that devices must satisfy to access organizational resources. For most mobile and modern workplace scenarios, that means understanding device compliance requirements, certificate requirements, Wi-Fi authentication, and VPN connectivity. In a Zero Trust design, access should depend on verified identity, device state, and network or application controls instead of implicit trust.

Documenting these dependencies early moves the deployment from assumptions to explicit, testable requirements.

Implementation Guidance​

  1. List the resources users need to reach: Microsoft 365, line-of-business SaaS apps, intranet sites, legacy on-premises apps, RADIUS-backed Wi-Fi, certificate-based VPN, and any privileged admin tools.
  2. For each resource, record whether access should require a compliant device, a managed app, a certificate, a VPN tunnel, or some combination of those controls.
  3. Identify certificate dependencies early. Many Wi-Fi and VPN designs depend on trusted root, SCEP, or PKCS certificate profiles, plus connector infrastructure such as NDES or a cloud PKI design.
  4. Decide whether users need on-demand VPN, per-app VPN, or always-on connectivity. Avoid routing traffic through VPN when modern, direct cloud access is sufficient.
  5. Confirm that your compliance rules align with the access model. If a device must use Wi-Fi or VPN with certificates, ensure certificate deployment and renewal happen before Conditional Access begins enforcing compliance broadly.
  6. Pilot with real user personas: BYOD, frontline, shared devices, executives, and remote workers.
  7. Document operational ownership for certificate services, wireless infrastructure, VPN gateways, Intune profiles, and Conditional Access policies.

Reference​