Introduction
Modern organizations face increasing challenges securing and managing endpoints in a world where employees work from anywhere on diverse devices. Traditional on-premises management tools can't follow devices outside the corporate network, leaving gaps in security and visibility. As an IT administrator, you need a comprehensive solution that can protect corporate data while providing a seamless experience for users—whether they're connecting from a company-owned laptop, a personal tablet, or a mobile device.
This is where Mobile Device Management (MDM) and Mobile Application Management (MAM) become essential. MDM allows you to manage and secure entire devices—enforcing encryption, deploying policies, and ensuring compliance—even when devices never connect to your corporate network. MAM protects corporate data within specific applications on personal devices, enabling bring-your-own-device (BYOD) scenarios without requiring full device control.
Microsoft Intune provides cloud-native MDM and MAM capabilities that help organizations secure, deploy, and manage all their users' devices from anywhere. Unlike traditional management tools that require on-premises infrastructure, Intune operates entirely in the cloud—devices only need internet access. This means you can reach and manage devices wherever they are—coffee shops, home offices, or international locations—ensuring consistent security policies and real-time compliance monitoring. But before you can manage devices, you must first prepare your environment and understand how to bring devices under management.
Scenario: Contoso Corporation's modernization journey
You're an IT administrator at Contoso Corporation, a mid-sized organization that plans to modernize its endpoint management strategy. Your current environment relies on on-premises tools, and leadership has decided to adopt Microsoft Intune to support hybrid work scenarios, improve security posture, and enable Zero Trust principles.
Zero Trust is a security strategy built on three core principles: verify explicitly (authenticate every access request), use least privilege access (limit permissions to only what's needed), and assume breach (minimize damage from compromised devices). Intune supports this strategy by verifying device compliance before granting access, enforcing least privilege through app protection policies, and detecting threats through integration with Microsoft Defender for Endpoint.
Your first responsibility is to prepare the foundation: configure identity and licensing, set up your tenant for device enrollment, and establish enrollment pathways for different device types and ownership scenarios. You need to ensure that corporate devices can be securely provisioned, while also supporting employees who want to use personal devices for work (BYOD).
What you learn
In this module, you complete the essential preparation steps before enrolling devices in Microsoft Intune:
- Configure Microsoft Entra ID roles and licensing required for device management
- Prepare your Microsoft Intune tenant with groups, settings, and configurations
- Choose and explain appropriate enrollment methods based on device platforms and ownership
- Understand the readiness requirements for common enrollment scenarios
What is the main goal?
By the end of this module, you're ready to onboard devices into Microsoft Intune with confidence. You understand the prerequisites, have configured the necessary identity and tenant settings, and can recommend the right enrollment approach for different scenarios in your organization.