Summary
In this module, you configured and secured enrolled devices using Microsoft Intune policies. You learned how to deploy configuration profiles that standardize device settings, implement compliance policies that enforce security requirements, and automate remediation for common issues—transforming enrolled devices into fully managed, secure endpoints.
What you accomplished
You now understand how to:
- Create and assign device configuration profiles to standardize settings across Windows, iOS/iPadOS, and Android devices using platform-appropriate methods
- Define and apply compliance policies that evaluate device security posture and identify noncompliant devices across all platforms
- Target policies effectively using dynamic groups, assignment filters, and applicability rules for precise policy delivery
- Validate policy application and monitor compliance status to ensure settings deploy successfully
- Automate remediation for common compliance issues using PowerShell scripts and compliance actions
Key takeaways
Configuration profiles apply settings: Use the Settings catalog for modern Windows configuration with searchable settings, device restrictions for iOS/iPadOS and Android platform controls, and templates for common scenarios like Wi-Fi, VPN, and certificates. Assign profiles to user groups for personal settings or device groups for security controls.
Compliance policies evaluate security: Define platform-specific requirements (BitLocker and firewall for Windows, jailbreak detection for iOS, root detection for Android) that devices must meet. Compliance status integrates with Conditional Access to block noncompliant devices from accessing corporate resources, supporting Zero Trust's "verify explicitly" principle.
Targeting determines policy reach: Dynamic groups automatically include devices based on properties (OS version, ownership, department). Assignment filters add real-time conditions at policy assignment (storage capacity, manufacturer, naming patterns). Applicability rules ensure Windows settings only apply to compatible OS versions and editions.
Monitoring reveals policy effectiveness: Device status shows overall success per device, per-setting status identifies which specific settings failed, and compliance reports reveal security posture trends. Regular monitoring prevents the silent failure problem where policies don't deploy but nobody notices.
Automation reduces manual work: Detection scripts check for issues, remediation scripts fix problems automatically, and compliance actions respond to noncompliance with graduated timelines (notify, lock, retire). This creates self-healing systems that reduce support tickets and improve security posture without manual intervention.
Contoso Corporation's policy deployment
Returning to the scenario, you successfully deployed comprehensive policy management for Contoso Corporation:
| Category | Configuration |
|---|---|
| Configuration Profiles | BitLocker encryption, firewall rules, Wi-Fi/VPN settings for Windows; passcode requirements and app restrictions for iOS/iPadOS; work profile security for Android |
| Compliance Policies | Windows Corporate Security Baseline (BitLocker, antivirus, firewall, OS version); enhanced Finance requirements; mobile platform policies with jailbreak/root detection |
| Dynamic Groups | Windows 11 devices, Sales team, corporate-owned devices, Finance department |
| Assignment Filters | High-storage devices (512GB+), Dell devices, Windows 11 Enterprise edition |
| Remediation Scripts | Firewall enablement (daily), disk cleanup (weekly), Windows Update service check (daily) |
| Compliance Actions | Email notifications (day 1), warning notifications (day 3), device lock (day 7), retirement (day 30) |
With these policies deployed, Contoso achieved standardized device security, automated compliance monitoring across Windows and mobile platforms, reduced IT support tickets through self-healing Windows devices, and readiness for Conditional Access integration with platform-specific security requirements.
Next steps
With devices configured and compliant, you can learn about:
- App protection policies (MAM) to protect corporate data in mobile applications
- Conditional Access to enforce device compliance before granting resource access
- App deployment to deliver corporate applications to managed devices
- Windows Update management to control operating system updates and feature releases
Additional resources
To learn more about device configuration and compliance, visit: