Configuration Policies, Licensing, and Enrollment Fundamentals

Day 1 introduced the enrollment sequence. A device is enrolled first, then configured. This is where configuration comes in. Once a device is enrolled in Intune, a configuration policy is the tool an administrator uses to shape that device over time.

The flow behind every policy is the same three steps.

1. 1

   Enroll the device

   The device is enrolled in Intune, as covered in Day 1.

2. 2

   Create the policy

   An administrator creates a policy and configures the required settings.

3. 3

   Deploy the policy

   The policy is assigned to the required devices or groups.

So what can a configuration policy actually touch? The practical answer is that it can touch almost any setting that exists on a Windows device, because Intune ships with a large catalog of settings called the Settings Catalog. The list below is not the full list. It is a set of common, everyday examples that come up again and again in real administration work, so you get a feel for the kind of thing a policy can do.

• Wallpaper: set or change the desktop wallpaper.
• LAPS policy: apply the Local Administrator Password Solution rotation covered in Day 1.
• Website access: allow or block specific websites.
• Browser extensions: block installation of extensions in Edge, Chrome, and Firefox.
• Malicious or non compliant sites: block sites known to serve malicious code or that fall outside acceptable use.
• Social media platforms: block LinkedIn, WhatsApp Web, X, Facebook, and similar platforms on managed devices.
• Removable storage: allow or block USB storage. Blocking USB storage in Intune is a common walkthrough on its own.

Beginners often mix up a few terms that sound similar. It helps to separate them clearly before going further.

Reading about policies is one thing. Building one makes the idea concrete. Here is the exact path, followed by a short lab you can repeat in a trial tenant.

Mini lab: block a setting and confirm it applied

1. 1

   Create the profile

   Choose Platform as Windows 10 and later, then Profile type as Settings Catalog. Give it a clear name such as Baseline, Block browser extensions.

2. 2

   Add a setting

   Select Add settings, search for the setting you want, for example a browser extension control, and set its value.

3. 3

   Assign to a pilot group

   Assign the policy to a small pilot group, not to all devices. This is covered further in Concept 12.

4. 4

   Sync the device

   On a test device, open Settings, Accounts, Access work or school, then Info, and select Sync. You can also trigger Sync from the device page in Intune.

5. 5

   Verify the result

   In Intune, open the policy and review the per device status. A healthy result shows Succeeded. If it shows Error or Conflict, note the setting and move to the troubleshooting checklist in Concept 24.

Day 1 mentioned that Intune is the cloud counterpart to on premises Group Policy. This concept unpacks what that means in practice.

Traditional on premises management

In an Active Directory environment, organizations manage devices and users through Group Policy Objects (GPOs). Many settings inside a GPO are based on ADMX and ADML template files.

Migrating from GPO to Intune takes planning

Large environments can have a very large number of Group Policies. Moving that volume to Intune is a project, not a single afternoon of work, because targeting models differ. Active Directory can target organizational units and individual objects directly, while Intune assignments are group based and then refined with filters. Mapping one model onto the other, and confirming which settings still apply to cloud native Windows, is where the time goes. Microsoft provides Group Policy analytics to help with exactly this, covered next.

When an organization wants to move from Group Policy to Intune, the first question is always the same. Which of our existing GPO settings are even supported by cloud based MDM? Microsoft answers this with a built in tool called Group Policy analytics.

You export your GPOs to XML, import them into the tool, and it does three useful things.

• It analyzes your on premises GPOs.
• It shows which settings are supported by cloud based MDM providers, including Intune, and which are deprecated or not available.
• It can migrate the supported settings into a Settings Catalog policy that you can then assign to devices.

Before Intune, and even today in many organizations, devices are managed the older way, from inside the company network. Understanding what that setup required explains why cloud based tools feel like such a shift.

What on premises management requires

• The company has to buy, set up, and maintain its own servers.
• Someone has to install and patch the operating system on those servers.
• Security updates and patching are handled by the company team.
• To manage a device outside the office network, the device often needs to connect back in through a VPN (Virtual Private Network).
• A separate antivirus setup and its own management server are usually needed on top of everything else.
• Access to company resources is often limited to company issued laptops on the company network.

What changes with cloud based management

Intune removes most of the items above. There is no server for your company to buy or patch, because Microsoft runs and maintains that infrastructure as part of the cloud service. Basic management does not require a VPN, since the device talks to Intune over the internet. As long as the device has an internet connection, an administrator can manage it from anywhere.

Before comparing device management tools against each other, it helps to separate what an organization actually needs from what a vendor happens to offer as extras.

Before comparing solutions, confirm the tool covers the basic requirements first, and treat everything past that as a bonus.

• Application deployment: deploy and manage applications as required.
• Patch deployment: install Windows updates and operating system updates.
• Security management: apply measures that protect organizational data.
• Compliance: ensure devices meet company compliance requirements.
• Configuration policy: configure devices as required, as covered in Concept 1.

Not every device that touches company data needs to be fully managed. Intune supports two different levels of control, and picking the right one matters, especially for personal devices.

MDM is the right approach for a company owned laptop or phone, since the company owns the hardware and can manage it fully. MAM is common for personal devices, where an employee wants to check work email or Teams on their own phone, but the company should not be able to touch personal photos, personal apps, or wipe the entire phone.

A device rarely sits next to the administrator managing it. It might be on a different floor, in a different city, or in a different country, and Intune still needs a way to act on it.

Why remote actions matter

Three conditions make a remote action possible: the device is outside the office, the administrator cannot reach it physically, and the device is online and able to communicate with Intune. This is possible because of the cloud based model covered in Concept 6.

What can be done remotely

• Restart the device.
• Sync to pull the latest policies.
• Trigger a scan, such as a compliance or malware scan.
• Check for updates.
• Retire or wipe the device, once it is online.

Remote wipe as a last resort

If a device is reported lost or stolen, an administrator can initiate a remote wipe. If the device is offline, the command stays pending until the device next connects to the internet, and it executes then. Command behavior, expiry, and platform specifics can vary, so always confirm the result in the device record rather than assuming the wipe completed.

Application management

Intune allows organizations to install applications on devices based on department requirements. Common examples include Microsoft 365 apps such as Word, Excel, and PowerPoint, Microsoft Teams, browsers, antivirus applications, and line of business software.

Patch and driver management

Patching covers installing Windows updates and operating system updates through Intune. Driver management is separate. For machines from vendors such as Dell, HP, or Lenovo, Intune can deliver vendor drivers, including Wi-Fi drivers, LAN drivers, and other network drivers.

Remote action results and device status are visible from this monitoring area. Once an action such as a wipe or retire is initiated, plan carefully, because it removes data and the record of the request remains in the audit history covered in Concept 17.

Not every configuration policy is meant to apply to every device in the company. Policies are generally split into two kinds, based on how wide their reach is.

A password complexity policy should not change depending on which office a person sits in, so that is a global policy applied company wide. A wallpaper celebrating a regional festival, or accounting software that only Finance uses, should not be pushed to every device in every country. That is a local policy, scoped to the group of devices or users it is meant for.

Creating a policy is only half the job. Deciding exactly who receives it, and what happens when two policies disagree, is where real administration lives.

Include and exclude groups

Every policy is assigned to one or more groups. You can include a group, and you can also exclude a group. Exclusion is useful when you want a policy to reach everyone in a large group except a small set, for example all staff except the IT test team. Within a single policy, if a device or user ends up in both an included group and an excluded group, the exclusion wins and the policy does not apply to that device or user.

Filters

Filters refine an assignment based on device properties, such as operating system version, ownership, or device model. A filter lets you say, in effect, assign this policy to this group, but only where the device is corporate owned and running Windows 11. Filters keep you from creating many narrow groups just to handle small differences.

Conflicts between separate policies

A conflict is a different situation from exclusion. A conflict happens when two separate policies both target the same device and set the same underlying setting to two different values. In that case the device may report a Conflict state for that setting until the overlap is resolved. This is not decided by include or exclude logic, it is simply two sources of truth disagreeing on one setting. The practical rule is simple. Keep assignments clean, avoid overlapping policies that fight over the same setting, and check the per setting status when something does not apply as expected.

Why access needs to be restricted

Not every administrator should be able to do everything. An Intune team member should only be able to perform Intune management tasks. If that same person can also perform unrelated Entra ID administration outside their role, that is a real risk for the company, not a convenience.

What reporting provides

Intune reporting gives a day to day view of the environment. It shows information such as who the primary user on a device is, battery and hardware details, which applications are installed, and device status across its lifecycle. Reporting is split into two types with two different audiences, covered next in Concept 14.

Reporting inside Intune is not one single thing. It is useful to think of it as two different views, built for two different audiences.

A simple example ties this together. Suppose a set of company laptops are still running an operating system version that is approaching its end of support date. Spotting that fact and flagging that those devices need replacement is organizational reporting, because it is information leadership needs to make a budget decision. Actually deploying the update, pushing a policy, or checking whether an app installed correctly on those machines is operational reporting, the daily hands on work of the administrator.

Fixing problems on managed devices can happen in two very different ways, depending on when the fix actually happens.

Reactive remediation is the traditional support model. Something breaks, the user reports it, then it gets fixed. Proactive remediation flips that around. Intune can run small detection and remediation scripts across managed devices on a schedule. The detection script checks for a known problem, and if it is found, the remediation script tries to fix it automatically, sometimes before the user notices anything was wrong.

Company assets extend beyond laptops and desktops. They include hardware generally, network hardware, storage devices, and printers. A dedicated asset management team, separate from the Intune administration team, typically owns tracking this inventory.

What an asset management team tracks includes:

• Who owns each asset.
• Where each asset is located.
• How many assets are currently in use.
• How many are in transit.
• How many are in stock.

Administrative actions taken inside Intune and Entra ID are recorded. This applies to actions taken by user accounts and service accounts alike.

Examples of what typically shows up under audit events include:

• Application created
• Device enrolled
• Certificate generated
• Device or compliance policy updated
• Windows Update for Business configuration updated
• Remote action initiated
• Remediation script run
• Delete or wipe command initiated

Day 1 introduced the idea that automatic enrollment scope is capped by available licenses. This concept looks at what those licenses actually are, using Microsoft current structure.

Three capability plans

Microsoft organizes Intune capabilities into three plans.

User based and device based licensing

A common beginner assumption is that Intune licensing works like buying one license per laptop. That is only partly true.

• User based licensing is the normal model. A license is assigned to a person, and each user license generally covers a reasonable number of that person devices, commonly up to fifteen managed devices per user.
• Device based licensing exists for devices that are not tied to one person, such as kiosks, shared devices, phone room devices, and other single use or no user affinity scenarios. These use a device only subscription and apply to specific enrollment methods.

Licensing and Windows activation

When a user with an eligible Windows Enterprise subscription, included with plans such as Microsoft 365 E3 or E5, signs in to a Windows Pro device that is Entra joined or hybrid Entra joined, the device can step up to Windows Enterprise automatically in the background. Microsoft calls this Subscription Activation, and it replaces the older approach of activating machines through a Key Management Service server or product keys.

Both a device and an individual application go through a similar life story inside Intune. Thinking of it as a lifecycle, with a clear beginning and end, makes the whole system easier to hold in your head.

Device lifecycle

Application lifecycle

An individual application installed through Intune follows the same pattern. Take a browser as a running example.

Seeing both lifecycles side by side is useful, because the same four stage thinking, create or enroll, configure, protect, and retire, shows up again and again across Intune.

Every device enrolled in Intune is identified as one of two ownership types.

• Personal: a device purchased by the individual user.
• Corporate: a device purchased by the organization.

The initial ownership value that Intune assigns is determined by the enrollment method used, not by anything the end user selects. An end user cannot choose or change this value. It is set based on how the device was enrolled, and an administrator can edit it afterward if needed. Corporate owned devices unlock more granular settings, including stricter password options.

Before a Windows device can enroll in Intune, it first has an identity in Microsoft Entra ID. That identity takes one of three forms, and each maps to a different enrollment method and ownership outcome.

Entra Registered

A registered device gets a device object in Microsoft Entra ID as part of registration. This is commonly how a personal laptop or phone gets just enough identity to access corporate resources like Outlook, Teams, or OneDrive.

Entra Joined

A joined device is fully joined to Microsoft Entra ID and is associated with a company provided machine. The user signs in with their company account from first boot.

Hybrid Entra Joined

A hybrid joined device is joined to on premises Active Directory first. Local Active Directory is then synchronized with Microsoft Entra ID using Microsoft Entra Connect, giving the device a presence in both directories. This state is common in organizations partway through a migration from on premises AD to a fully cloud based identity model.

With the three Entra device states from Concept 21 in mind, the path a Windows device takes to reach Intune management follows a consistent order.

1. 1

   Register or join Microsoft Entra ID

   The device first establishes one of the three Entra device states covered above.

2. 2

   Automatic enrollment runs, if enabled

   With automatic enrollment enabled and the correct MDM scope and license in place, the device becomes eligible to enroll.

3. 3

   Device is enrolled in Intune

   The device is now managed, and the configuration profiles covered in Concept 1 can be assigned to it.

Enrollment prerequisites checklist

Before automatic enrollment works, confirm each of these is in place.

• An active Microsoft Intune subscription.
• Microsoft Entra ID P1 or P2, which automatic MDM enrollment requires.
• The MDM authority set to Intune.
• The MDM user scope set to Some or All, not None.
• A valid Intune license assigned to the user, or a device license for userless scenarios.
• A supported Windows edition, such as Windows Pro, Enterprise, or Education.
• An appropriate admin role. Configuring automatic enrollment (the MDM authority and user scope settings) needs a Global Administrator or an Intune Administrator role, while day to day enrollment and policy management can use a narrower role such as Policy and Profile Manager.
• Enrollment restrictions and Conditional Access reviewed, so the device is allowed and access rules are understood.

A hybrid Entra joined device, covered in Concept 21, can be managed by both an on premises Group Policy Object and an Intune configuration policy at the same time. When those two disagree on the same setting, only one wins.

This default exists because Group Policy has historically been the authoritative source of truth on a domain joined machine, and MDM inherits that precedence unless told otherwise.

Reversing the default: MDM wins over GPO

Starting with Windows 10 version 1803, a setting allows you to change precedence so that MDM wins over Group Policy. With this in place, the Intune managed setting takes priority over the conflicting local GPO setting for that device.

A short troubleshooting checklist

When a configuration policy does not apply as expected, work through these in order before assuming the policy itself is broken.

1. 1

   Confirm the device is managed

   On the device page, the Managed value should show MDM. If it does not, the device is not enrolled and will not receive configuration or compliance policies.

2. 2

   Check the assignment

   Confirm the device or user is actually in an included group, is not in an excluded group, and passes any filter applied to the assignment.

3. 3

   Force a sync

   Trigger Sync from the device, or from the device page in Intune, then wait for the next check in.

4. 4

   Read the per setting status

   Open the policy and review status. Look for Error or Conflict on specific settings rather than judging the whole policy at once.

5. 5

   Resolve conflicts and license gaps

   If a setting shows Conflict, find the overlapping policy. If the user has no valid license, the device will not enroll or apply policy, so verify licensing too.

The three portals you will hear about

Intune is not the only MDM tool

Intune is one of several Mobile Device Management tools on the market, and naming competitors is a common interview question. Well known ones include Ivanti, VMware Workspace ONE (formerly AirWatch), Samsung Knox, ManageEngine, and Hexnode.