What's changed: Created MD-102 Chapter 1 (domain: Prepare infrastructure for devices). Add devices to Microsoft Entra ID (Entra join vs device registration, hybrid join, dynamic group membership rules), enroll to Intune (automatic enrollment Windows, Apple Business Manager, Android Enterprise types, Samsung Knox/Google Zero Touch, enrollment restrictions), and identity/compliance (roles/scope tags/multi-admin approval, compliance policies, require compliance via Conditional Access, Windows Hello for Business, Windows LAPS).
1.2Enroll devices to Microsoft Intune
Understand Windows automatic enrollment, macOS/iOS personal enrollment, Android Enterprise enrollment types, automatic enrollment via Apple Business Manager/Samsung Knox/Google Zero Touch, and enrollment restrictions.
To bring devices under Intune management, choose an enrollment method by platform and ownership.
1.2.1Windows and Apple
Configuring automatic enrollment makes Windows devices auto-enroll into Intune at Microsoft Entra join. For Apple devices (macOS/iOS/iPadOS), use personal enrollment for personal devices, or integrate Apple Business Manager with Intune for automatic (ADE) enrollment of org-owned devices. Distinguish "Windows auto-enrollment" = automatic enrollment from "Apple corporate auto-enrollment" = Apple Business Manager.
1.2.2Android and enrollment restrictions
Android Enterprise has enrollment types by ownership: fully managed (corporate, full management), dedicated (kiosk), corporate-owned work profile (corporate, work/personal separation), and personally-owned work profile (personal, work profile). Auto-enroll corporate Android by integrating Samsung Knox Mobile Enrollment or Google Zero Touch with Intune. Enrollment restrictions limit which platforms or personal devices may enroll.
Cues: "auto-enroll Windows at Entra join" = automatic enrollment. "auto-enroll Apple corporate devices" = Apple Business Manager. "auto-enroll Android corporate devices" = Samsung Knox/Google Zero Touch. "corporate Android with work/personal separation" = corporate-owned work profile. "dedicated kiosk" = dedicated. "limit personal/platform enrollment" = enrollment restrictions.
Watch the mix-ups: (1) Automatic enrollment (Windows) vs Apple Business Manager (Apple) vs Knox/Zero Touch (Android) are per-platform auto-enrollment. (2) Choose Android Enterprise types (fully managed/dedicated/work profile) by ownership/use. (3) Enrollment restrictions limit eligibility—distinct from the enrollment method itself.
1.2.3Section summary
- Automatic enrollment enrolls Windows into Intune at Entra join
- Apple corporate = Apple Business Manager; Android corporate = Samsung Knox/Google Zero Touch
- Choose Android Enterprise types by ownership; enrollment restrictions limit eligibility
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. You want org-owned Windows devices to auto-enroll into Intune at Microsoft Entra join without extra manual steps. Best?
Q2. You want to auto-enroll/configure many org-owned iPhones into Intune by integrating with Apple’s service. Best?
Q3. For corporate-owned Android with work/personal separation under org management, which Android Enterprise enrollment type is best?
Q4. You want to manage single-purpose dedicated Android devices (kiosks) for reception/warehouse. Best enrollment type?
Q5. You want to restrict certain platforms or personal devices from enrolling into Intune. Best?