Configuration Profiles Best Practise

Question

Simple question, when setting up device configuration profiles, is it good practise to differentiate between Corporate and BYOD devices at the assignment stage?

Reason I ask, if I have a BYOD AAD registered device on Home Windows 10, I don’t want it to be picking up Bitlocker configuration policies, or Compliance/Conditional Access Policies on the same theme, as I would for BYOD AAD Registered/Joined devices Windows 10 Pro.

Answer 1

@Anonymous Thanks for posting in our Q&A.

Of course. If you don't want some devices apply some policies, please don't add these devices in these policies' assignment. Create a device group for home windows devices and create another device group for windows 10 pro devices.

However, it is needed to apply Conditional Access Policies to users, not devices. So, the target user signing in the home windows device will still be limited by the conditional access policy.

---

If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

@Lu Dai-MSFT-0289
Couple of things:

1. When differentiating between Corporate/BYOD is it best to use a filter in the assignment.
2. Can you expand on para 2, not quite sure what you are saying to me, are you saying Conditional Access is tied to identity, hence it's only tied to User Assignment when assigning conditional access policy?

Answer 3

@Lu Dai-MSFT
Firstly, hope you had a merry Xmas and a happy new year.

Many thanks for the clarification, Intune is a great product, but not easy to understand sometimes, due to it’s granularity (many moving parts).