SOP — Manage User Devices with Microsoft Intune

Goal: enroll and govern company and BYOD devices across four platforms with a consistent pattern — enroll → make compliant → configure → deliver apps → enforce access. Replace example values with your own.

0. Prerequisites

• A Microsoft 365 plan that includes Intune Plan 1 (Business Premium, E3, or E5) assigned to each managed user.
• An admin with the Intune Administrator (and Entra) role.
• The MDM-enrollment DNS records for mptwork.com already published (set in the M365 SOP):
  • enterpriseregistration.mptwork.com → enterpriseregistration.windows.net
  • enterpriseenrollment.mptwork.com → enterpriseenrollment.manage.microsoft.com
• For Apple: a company Apple ID (not personal) for the Apple MDM push certificate and Apple Business Manager.
• For Android: a corporate Google account for Managed Google Play.

Part 1 — Set up Intune and the enrollment foundation

1. Sign in to https://intune.microsoft.com. Confirm Intune is the MDM authority (default for new tenants).
2. Windows automatic enrollment: in the Entra admin center → Devices → Mobility (MDM and MAM) → Microsoft Intune → set MDM user scope = All (or a pilot group). This makes Entra-joined Windows devices auto-enroll into Intune.
3. Enrollment restrictions: Intune → Devices → Enrollment → Device platform restrictions. Block platforms you don't manage and set personal-device rules (e.g., block personally-owned Windows but allow personal iOS/Android).
4. Branding: Intune → Tenant administration → Customization → set the Company Portal name to "MPT Work," support contact, and logo.

Part 2 — Platform enrollment prerequisites

2.1 Apple (macOS + iOS/iPadOS)

1. Apple MDM push (APNs) certificate: Intune → Devices → Enrollment → Apple → Apple MDM push certificate. Download the CSR from Intune, upload it at the Apple Push Certificates Portal signed in with the company Apple ID, then upload the resulting certificate back into Intune. Record the Apple ID and the annual expiry.
2. Apple Business Manager (ABM): link ABM to Intune by downloading the public key from Intune, uploading it in ABM to create an MDM server, then uploading the ABM token back into Intune (Enrollment program tokens / Automated Device Enrollment). In ABM, assign device serial numbers to the Intune MDM server.
3. Apps & Books (VPP) token: upload the ABM Apps & Books token so Intune can license App Store apps.

2.2 Android

1. Intune → Devices → Enrollment → Android → Managed Google Play → connect using the corporate Google account. This enables Android Enterprise management modes.

2.3 Windows

1. Auto-enrollment scope is set (Part 1). For zero-touch corporate provisioning, configure Windows Autopilot (Part 4.1).

Part 3 — Create device groups

Create dynamic Entra groups so policies target the right devices automatically (Intune/Entra → Groups → New group → Dynamic Device):

Also create user groups for assignment (e.g., Staff-Corp, Staff-BYOD).

Part 4 — Enroll devices (per platform)

4.1 Windows

• Corporate (Autopilot): Intune → Devices → Enrollment → Windows → Deployment profiles → create an Autopilot profile (user-driven, Entra join). Import device hardware hashes (from the OEM/reseller or via Get-WindowsAutopilotInfo). The device auto-provisions and enrolls on first boot.
• Existing/BYOD: user signs in with name@mptwork.com → Settings → Accounts → Access work or school → Connect → Join this device to Microsoft Entra (auto-enrolls), or installs the Company Portal app.

4.2 macOS

• Corporate (ADE): serial assigned in ABM → device enrolls automatically during Setup Assistant. Apply an enrollment profile (Devices → Enrollment → Apple → Enrollment profiles).
• BYOD: user installs Company Portal from the web and enrolls.

4.3 iOS / iPadOS

• Corporate (ADE): ABM-assigned devices enroll during Setup Assistant (supervised).
• BYOD: install Company Portal (Device enrollment) — or use MAM-only (no enrollment; protect data inside apps via App Protection Policies, Part 7).

4.4 Android

Choose the enrollment mode in Enrollment → Android:

• Personally-owned work profile (BYOD) — separates work/personal data on the user's device.
• Corporate-owned work profile / Fully managed — company devices.
• Dedicated (kiosk) — single-purpose/shared devices. Users enroll via the Company Portal (BYOD) or the corporate enrollment flow (QR/NFC/zero-touch).

Part 5 — Compliance policies

Compliance policies define "healthy"; Conditional Access (Part 8) blocks access for noncompliant devices. Intune → Devices → Compliance policies → Create policy (one per platform), assign to the platform device group, and set Actions for noncompliance (e.g., mark noncompliant after a 1-day grace, email the user).

Part 6 — Configuration profiles

Push settings and security baselines. Intune → Devices → Configuration (Settings catalog/templates) and Endpoint security.

Disk encryption and antivirus are configured here; full Defender for Endpoint (EDR, ASR, vulnerability management) is in the endpoint-protection companion SOP.

Part 7 — Application management

1. Add apps: Intune → Apps → All apps → Add:
   • Windows: Win32 (.intunewin), MSI, or Microsoft Store apps.
   • macOS: PKG/DMG line-of-business apps or VPP store apps.
   • iOS: App Store / VPP apps; configure app configuration policies as needed.
   • Android: Managed Google Play apps (approve in the connected store).
2. Assign apps as Required (auto-install) or Available (self-service via Company Portal) to user groups.
3. App Protection Policies (MAM) for iOS/Android (and Windows): enforce encryption, PIN, copy/paste and save-as restrictions inside managed apps — works on BYOD/MAM-only devices without full enrollment.

Part 8 — Enforce access (Conditional Access)

1. Entra admin center → Protection → Conditional Access → New policy.
2. Target users/apps (e.g., all users → Office 365), and under Grant require Require device to be marked as compliant (and/or Entra hybrid join).
3. Exclude the bg-admin* break-glass accounts. Start in report-only, validate, then enforce.

This is the linchpin: only devices that pass the Part 5 compliance policies can reach corporate resources.

Part 9 — Remote actions and device lifecycle

From Intune → Devices → select a device → remote actions:

Leaver workflow: block the user's sign-in (M365 SOP), then Retire (BYOD) or Wipe (corporate) the enrolled devices.

Part 10 — Monitoring and ongoing operations

Appendix A — Enrollment method by platform

Appendix B — Notes and caveats

• APNs certificate must be renewed every year by the same company Apple ID; if it lapses, all Apple devices fall out of management.
• Pilot first: assign new compliance/config policies and Conditional Access to a small group (or report-only) before tenant-wide rollout.
• Verify current steps against Microsoft Learn — Intune portal layout, enrollment flows, and feature names change frequently.