What's changed: Created MD-102 Chapter 1 (domain: Prepare infrastructure for devices). Add devices to Microsoft Entra ID (Entra join vs device registration, hybrid join, dynamic group membership rules), enroll to Intune (automatic enrollment Windows, Apple Business Manager, Android Enterprise types, Samsung Knox/Google Zero Touch, enrollment restrictions), and identity/compliance (roles/scope tags/multi-admin approval, compliance policies, require compliance via Conditional Access, Windows Hello for Business, Windows LAPS).
1.3Identity and compliance
Understand Intune roles/scope tags/multi-admin approval, compliance policies, requiring compliance via Conditional Access, Windows Hello for Business, and Windows LAPS.
Management combines least-privilege delegation, device compliance evaluation, and access control that uses it.
1.3.1Roles and delegation
Assign admin rights via Intune built-in/custom roles. Scope tags limit which objects (scope) an admin can act on, used for delegation in multi-admin environments. Multi-admin approval requires another admin’s approval for critical changes to prevent mistakes or insider misuse.
1.3.2Compliance and access
Compliance policies evaluate compliant/noncompliant whether a device meets requirements (encryption, OS version, threat level). Use the result as a Microsoft Entra Conditional Access condition to control access, e.g., "allow only compliant devices". Distinguish "evaluate compliance" = compliance policy from "allow/block based on that" = Conditional Access. For authentication, configure Windows Hello for Business (passwordless biometric/PIN), and use Windows LAPS to auto-rotate/store local administrator passwords.
Cues: "limit an admin’s scope of objects" = scope tags. "another admin approves critical changes" = multi-admin approval. "evaluate whether a device meets requirements" = compliance policy. "allow only compliant devices" = Conditional Access. "passwordless biometric/PIN" = Windows Hello for Business. "auto-rotate local admin passwords" = Windows LAPS.
Watch the mix-ups: (1) Compliance policy (evaluate) vs Conditional Access (enforce access)—evaluation alone does not block; only CA "require compliant" enforces. (2) Scope tags (scoped delegation) vs roles (permission sets). (3) Windows Hello (authentication) vs Windows LAPS (local admin password management).
1.3.3Section summary
- Scope tags for scoped delegation; multi-admin approval gates critical changes
- Compliance policies evaluate; Conditional Access allows only compliant devices
- Windows Hello for Business = passwordless auth; Windows LAPS = auto-rotate local admin passwords
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. You want to evaluate compliant/noncompliant whether a device meets requirements like encryption and minimum OS version. Best?
Q2. You want to limit access to org resources to only Intune-compliant devices. Best?
Q3. In a multi-admin environment, you want to scope each admin’s manageable objects. Best?
Q4. You want to auto-rotate and securely store the local administrator password on Windows devices. Best?
Q5. What correctly distinguishes a compliance policy from Conditional Access?