What's changed: Created MD-102 Chapter 1 (domain: Prepare infrastructure for devices). Add devices to Microsoft Entra ID (Entra join vs device registration, hybrid join, dynamic group membership rules), enroll to Intune (automatic enrollment Windows, Apple Business Manager, Android Enterprise types, Samsung Knox/Google Zero Touch, enrollment restrictions), and identity/compliance (roles/scope tags/multi-admin approval, compliance policies, require compliance via Conditional Access, Windows Hello for Business, Windows LAPS).
1.1Add devices to Microsoft Entra ID
Understand Microsoft Entra join vs device registration, choosing the right join type, and dynamic group membership rules for devices.
The starting point of endpoint management is adding devices to Microsoft Entra ID. Choose the join type by ownership.
1.1.1Join types
A Microsoft Entra join fully joins an organization-owned device to cloud Entra ID, signing in with an org account and bringing it under cloud management (Intune). Device registration registers a personal (BYOD) device to allow access to org resources without the org owning/managing the whole device. Microsoft Entra hybrid join joins both on-prem AD and Entra ID. Distinguish "org-owned, full join" = Entra join from "BYOD, access only" = registration.
1.1.2Dynamic groups
Grouping devices with dynamic group membership rules auto-updates membership based on attributes (OS, ownership, model). This lets you auto-apply configuration profiles and compliance policies to matching devices. Unlike fixed (assigned) membership, it follows device additions/removals.
Cues: "fully join an org-owned device to cloud, Intune-managed" = Microsoft Entra join. "register a BYOD personal device for access only" = device registration. "join both on-prem AD and Entra" = hybrid join. "auto-group devices by attributes" = dynamic group membership rules.
Watch the mix-ups: (1) Entra join (org-owned, full join) vs device registration (BYOD, access only). (2) Hybrid join is a migration/coexistence scenario with on-prem AD. (3) Dynamic groups (attribute-based) vs assigned groups (fixed manual).
1.1.3Section summary
- Microsoft Entra join = fully join org-owned devices for cloud/Intune management
- Device registration = register BYOD personal devices for access only
- Dynamic group membership rules auto-group devices by attributes
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. You want to fully join an org-purchased Windows device to cloud Microsoft Entra ID, sign in with an org account, and manage it with Intune. Best?
Q2. You want employees’ personal phones (BYOD) to access org resources without the org managing the whole device. Best?
Q3. You want devices matching attributes (OS, ownership) to be auto-added/removed from a group. Best?
Q4. You want devices that remain joined to on-prem Active Directory to also join Microsoft Entra ID (coexistence). Best?
Q5. What correctly distinguishes Microsoft Entra join from device registration?