Mobile Device Management (Intunes)

• Configuration Manager for on-premises endpoint management and Windows Server, including deploying software updates and managing data centersYou can use Intune and Configuration Manager together in a co-management scenario, use tenant attach, or use both. With these options, you get the benefits of the web-based admin center and can use other cloud-based features available in Intune.For more specific information, go to:
  • What is co-management
  • Frequently asked questions about co-management
  • How to enable tenant attach
• Windows Autopilot for modern OS deployment and provisioningWith Windows Autopilot, you can provision new devices and send these devices directly to users from an OEM or device provider. For existing devices, you can reimage these devices to use Windows Autopilot and deploy the latest Windows version.For more specific information, go to:
  • Windows Autopilot overview
  • Windows Autopilot deployment for existing devices
• Endpoint analytics for visibility and reporting on end user experiences, including device performance and reliabilityYou can use Endpoint analytics to help identify policies or hardware issues that slow down devices. It also provides guidance that can help you proactively improve end user experiences and reduce help desk tickets.For more specific information, go to:
  • What is Endpoint analytics
  • Enroll Intune devices into Endpoint analytics

• Microsoft 365 for end user productivity Office apps, including Outlook, Teams, Sharepoint, OneDrive, and moreUsing Intune, you can deploy Microsoft 365 apps to users and devices in your organization. You can also deploy these apps when users sign in for the first time.For more specific information, go to:
  • Add Microsoft 365 Apps to Windows 10/11 devices with Microsoft Intune
  • Microsoft 365 docs: Manage devices with Intune
• Microsoft Defender for Endpoint to help enterprises prevent, detect, investigate, and respond to threatsIn Intune, you can create a service-to-service connection between Intune and Microsoft Defender for Endpoint. When they’re connected, you can create policies that scan files, detect threats, and report threat levels to Microsoft Defender for Endpoint. You can also create compliance policies that set an allowable level of risk. When combined with conditional access, you can block access to organization resources for devices that are noncompliant.For more specific information, go to:
  • Enforce compliance for Microsoft Defender for Endpoint with Conditional Access in Intune
  • Configure Microsoft Defender for Endpoint in Intune
• Windows Autopatch for automatic patching of Windows, Microsoft 365 apps for enterprise, Microsoft Edge, and Microsoft TeamsWindows Autopatch is a cloud based service. It keeps software current, gives users the latest productivity tools, minimizes on-premises infrastructure, and helps free up your IT admins to focus on other projects. Windows Autopatch uses Microsoft Intune to manage patching for Intune-enrolled devices or devices using co-management (Intune + Configuration Manager).For more specific information, go to:
  • What is Windows Autopatch?
  • Frequently Asked Questions about Windows Autopatch

• Managed Google Play: When you connect to your Managed Google Play account, admins can access your organization’s private store for Android apps, and deploy these apps to your devices.For more information, go to Add Managed Google Play apps to Android Enterprise devices with Intune.
• Apple tokens and certificates: When they’re added, your iOS/iPadOS and macOS devices can enroll in Intune and receive policies from Intune. Admins can access your volume purchased iOS/iPad and macOS app licenses, and deploy these apps to your devices.For more information, go to:
  • Get an Apple MDM push certificate
  • Automatically enroll iOS/iPadOS devices by using Apple’s Automated Device Enrollment
  • Manage iOS and macOS apps purchased through Apple Business Manager with Microsoft Intune

• TeamViewer: When you connect to your TeamViewer account, you can use TeamViewer to remotely assist devices.For more information, go to Use TeamViewer to remotely administer Intune devices.

With these services, Intune:

• Gives admins simplified access to third party partner app services.
• Can manage hundreds of third party partner apps.
• Supports public retail store apps, line of business (LOB) apps, private apps not available in the public store, custom apps, and more.

For more platform-specific requirements to enroll third party partner devices in Intune, go to:

• Deployment guide: Enroll Android devices in Microsoft Intune
• Deployment guide: Enroll iOS and iPadOS devices in Microsoft Intune
• Deployment guide: Enroll Linux devices in Microsoft Intune
• Deployment guide: Enroll macOS devices in Microsoft Intune

Organization-owned devices are enrolled in Intune for mobile device management (MDM). MDM is device centric, so device features are configured based on who needs them. For example, you can configure a device to allow access to Wi-Fi, but only if the signed-in user is an organization account.

In Intune, you create policies that configure features & settings and provide security & protection. The devices are fully managed by your organization, including the user identities that sign in, the apps that are installed, and the data that’s accessed.

When devices enroll, you can deploy your policies during the enrollment process. When enrollment completes, the device is ready to use.

For personal devices in bring-your-own-device (BYOD) scenarios, you can use Intune for mobile application management (MAM). MAM is user centric, so the app data is protected regardless of the device used to access this data. There’s a focus on apps, including securely accessing apps and protecting data within the apps.

With MAM, you can:

• Publish mobile apps to users.
• Configure apps and automatically update apps.
• View data reports that focus on app inventory and app usage.

You can also use MDM and MAM together. If your devices are enrolled and there are apps that need extra security, then you can also use MAM app protection policies.

For more information, go to:

• What is device enrollment in Intune?
• App protection policies overview
• Create and assign app protection policies

Windows Hello for Business helps protect against phishing attacks and other security threats. It also helps users sign in to their devices and apps more quickly and easily.

Windows Hello for Business replaces passwords using a PIN or biometrics, such as fingerprint, facial recognition. This biometric information is stored locally on the devices and is never sent to external devices or servers.

For more information, go to:

• Windows Hello for Business Overview
• Manage Windows Hello for Business on devices when they enroll in Intune
• Manage identities using Microsoft Intune

VPN policies gives users secure remote access to your organization network.Using common VPN connection partners, including Check Point, Cisco, Microsoft Tunnel, NetMotion, Pulse Secure, and more, you can create a VPN policy with your network settings. When the policy is ready, you deploy this policy to your users and devices that need to connect to your network remotely.

In the VPN policy, you can use certificates to authenticate the VPN connection. When you use certificates, your end users don’t need to enter usernames and passwords.

For more information, go to:

• • Create VPN profiles to connect to VPN servers in Intune
  • Use certificates for authentication in Microsoft Intune
  • Microsoft Tunnel for Microsoft Intune

For users who need to connect to your organization network on-premises, you can create a Wi-Fi policy with your network settings. You can connect to a specific SSID, select an authentication method, use a proxy, and more. You can also configure the policy to automatically connect to Wi-Fi when the device is in range.

In the Wi-Fi policy, you can use certificates to authenticate the Wi-Fi connection. When you use certificates, your end users don’t need to enter usernames and passwords.

When the policy is ready, you deploy this policy to your on-premises users and devices that need to connect to your on-premises network.

For more information, go to:

• Create Wi-Fi policy to connect to Wi-Fi networks in Intune
• Use certificates for authentication in Microsoft Intune

When you enable SSO, users can automatically sign in to apps and services using their Azure AD organization account, including some mobile threat defense partner apps.

Specifically:

• On Windows devices, SSO is automatically built in and used to sign in to apps and websites that use Azure AD for authentication, including Microsoft 365 apps. You can also enable SSO on VPN and Wi-Fi policies.
• On iOS/iPadOS and macOS devices, you can use the Microsoft Enterprise SSO plug-in to automatically sign in to apps and websites that use Azure Active Directory (AD) for authentication, including Microsoft 365 apps.
• On Android devices, you can use the Microsoft Authentication Library (MSAL) to enable SSO to Android apps.For more information, go to:
  • How SSO to on-premises resources works on Azure AD joined devices
  • Use the Microsoft Enterprise SSO plug-in on iOS/iPadOS and macOS devices in Microsoft Intune
  • Enable cross-app SSO on Android using MSAL