When thinking of your organization's path to MDM, you'll want to consider and assess your company's unique requirements. The exam will likely focus more on the settings and configuration of MDM, so we'll focus primarily on them. When you're ready to begin implementing MDM, you can generally break it down into the following 10 steps:

1. Configure the security groups in Active Directory (AD) or Azure AD that will allow you to easily assign policies or apply restrictions based on membership. Many of the later steps will depend on you thoughtfully creating these groups on which you'll base restrictions and permissions:

2. Assign Intune and Office 365 licenses to users from within the Microsoft 365 admin center (admin.microsoft.com) or Azure Active Directory. Users must be assigned an Intune license to be able to enroll their device.

3. Set...

The Azure AD mobility settings allow you, as an IT administrator, the ability to help ensure users are accessing company data and assets in a secure and compliant way, which you specify through configuring MDM integration within Azure AD. If your users are using personal or managed devices to access corporate data and apps, you'll want to configure MDM with Azure AD.

Azure AD registered devices are typically the personal devices in a BYOD scenario on which a user enters their work or school credentials to access their organization resources and data from an organization's domain. The previously mentioned Android and iOS enrollments would be...

Setting an MDM authority gives your administrators the ability to manage the configuration settings for devices throughout your organization. Possible authorities include the following:

• Intune Standalone (configured in Azure)
• Intune co-management (configure using the System Center Configuration Manager console)
• Office 365 MDM (selected in the Microsoft 365 admin center)

When viewing the Intune/Microsoft 365 device management portal, you may see an orange banner prompting you to select an authority. If not, select an option such as Device enrollment to get the authority selection prompt:

In this section, we selected an MDM authority. Now we'll set the device enrollment type and quantity limits.

Device type restrictions in your MDM solution help make sure your organization is secure and compliant. This is achieved by ensuring devices used to access company data are running a supported platform (iOS, Android, and so on.) within specific version ranges and/or are corporate-owned versus personal devices. Device limit restrictions help your organization work within its available license structure, avoiding over-licensing any one individual and potentially running up costs to license the rest.

In the Intune portal under Device enrollment | Enrollment restrictions, you're able to create these restrictions and adjust their priority. Once you create a restriction, you then assign it to everyone or to specific user groups. These restrictions show up listed on the Enrollment restrictions view where you can select one to edit it or...

In this chapter, we covered the following exam topics:

• Planning for MDM
• Configuring MDM integration with Azure AD
• Setting an MDM authority
• Setting device enrollment limits for users

By properly planning for MDM, you're making sure devices accessing an organization's resources are compliant and reduce the risk of data loss. Intune has many settings for customizing the criteria for and actions in response to compliance (or lack thereof).

Configuring MDM with Azure AD allows you the ability to manage AD-registered and AD-joined devices from within Azure AD. Users are also able to automatically enroll their devices. As an administrator, you have the ability to configure a hybrid Azure AD join, which provides the ability to use group policies on devices.

MDM authorities include Intune Standalone, Intune co-management, or Office 365 MDM. Note that O365 MDM still...

1. You need to configure your device management settings so that users cannot access company resources and data using devices running Android 7.0 or earlier. Which of the following must you configure to accomplish this task (select all that apply)?

A. Conditional access policy
B. Compliance policy
C. Terms and conditions users must accept
D. Custom configuration policy

2. Your Windows 10 and Android device users aren't having issues self-enrolling their devices, but your Apple users get an error. Given this information, which of the following is most likely the cause?

A. Users don't have Intune subscription licenses assigned.
B. Apple Configurator profile is bad.
C. Apple MDM push certificate isn't present or valid.
D. Users don't have valid Apple IDs.

• Planning for MDM:
  • Intune deployment planning, design, and implementation guide: https://docs.microsoft.com/en-us/intune/planning-guide.
  • Apply features and settings on your devices using device profiles in Microsoft Intune: https://docs.microsoft.com/en-us/intune/device-profiles.
• Configuring MDM integration with Azure AD:
  • How to: Plan your Azure AD join implementation: https://docs.microsoft.com/en-us/azure/active-directory/devices/azureadjoin-plan
  • How To: Plan your hybrid Azure Active Directory join implementation: https://docs.microsoft.com/en-us/azure/active-directory/devices/hybrid-azuread-join-plan
  • Quickstart: Set up automatic enrollment for Windows 10 devices: https://docs.microsoft.com/en-us/intune/quickstart-setup-auto-enrollment
  • What is a device identity?: https://docs.microsoft.com/en-us/azure/active-directory/devices/overview
• Setting an MDM authority...