book

Microsoft Intune Cookbook - Second Edition

Name: Microsoft Intune Cookbook - Second Edition
Author: Andrew Taylor
ISBN: 9781805807230

by Andrew Taylor

February 2026

Intermediate to advanced

722 pages

14h 28m

English

Packt Publishing

Read now

Unlock full access

Preface
Free Benefits with Your Book
Chapter 1: Getting Started with Microsoft Intune
Technical requirementsChapter materialsCreating a tenantGetting readyHow to do it…Creating a userGetting readyHow to do it…Automating itAssigning Entra ID rolesHow to do it…Automating itConfiguring Entra ID general device settingsHow to do it…Automating itConfiguring Entra ID ESRHow to do it…Automating itCreating Entra ID static groupsGetting readyHow to do it…Automating itCreating Entra ID dynamic groupsGetting readyHow to do it…Creating a dynamic Office user groupCreating a dynamic Autopilot device groupAutomating itDynamic Office user groupDynamic Autopilot device groupConfiguring Entra ID MDM scopeHow to do it…Automating it
Chapter 2: Configuring Your New Tenant for Windows Devices
Technical requirementsChapter materialsConfiguring a Settings catalog policyHow to do it…Automating itThere's more…Configuring a custom policyGetting readyHow to do it…Automating itImporting and ingesting an ADMX policyGetting readyHow to do it…Automating itIngestionPolicy creationGroup policy analyticsGetting readyHow to do it…Automating itProperties catalogHow to do it…Automating it
Chapter 3: Securing Your Windows Devices with Security Policies
Technical requirementsChapter materialsSetting up a security baselineHow to do it…Automating itThere's more…Configuring an antivirus policyHow to do it…Automating itConfiguring Windows Security ExperienceHow to do it…Automating itConfiguring Windows FirewallHow to do it…Automating itConfiguring your BitLocker policyHow to do it…Automating itDeploying ASR rulesGetting readyHow to do it…Automating itThere's more…Enrolling in Defender for EndpointGetting readyHow to do it…Deploying Windows LAPSGetting readyHow to do it…Using the built-in accountCreating a new accountCreating the LAPS policyAccessing and rotating passwordsAutomating itEntra IDEnabling the local admin and renamingCreating a new accountLAPS policyAccessing and rotating passwordsConfiguring Application ControlHow to do it…Automating it
Chapter 4: Setting Up Enrollment and Updates for Windows
Technical requirementsBuilding your update rings – including feature and quality updatesGetting readyHow to do it…Building update ringsBuilding feature updatesAutomating itBuilding update ringsBuilding feature updatesThere's more…Configuring driver updatesHow to do it…Automating itThere's more…Enrolling and using AutopatchHow to do it…Automating itThere's more…Configuring Windows Hello for BusinessHow to do it…Configuring at the tenant levelConfiguring at the group levelAutomating itConfiguring at the tenant levelConfiguring at the group levelSetting up Windows Autopilot enrollment profilesHow to do it…Automating itConfiguring Autopilot device preparationGetting readyHow to do it…Automating itConfiguring an Enrollment Status Page (ESP)How to do it…Automating itThere's more…Enrolling your Windows deviceGetting readyHow to do it…Adding a device identifierRequesting from your hardware vendorJSON injection within the operating systemCSV importOnline enrollmentBuilding the deviceThere's more…
Chapter 5: Android Device Management
Chapter materialsTechnical requirementsSetting up a managed Google Play accountHow to do it…Configuring enrollment profilesHow to do it…Automating itAdding a Google Play applicationHow to do it…Automating itConfiguring a device restrictions policyHow to do it…Automating itConfiguring an OEM policyGetting readyHow to do it…Automating itConfiguring a Wi-Fi policyGetting readyHow to do it…Automating itAdding an app protection policyHow to do it…Adding an app protection policyCreating the Conditional Access policyAutomating itApp protection policyConditional Access policyThere's more…Enrolling an Android device – managed deviceGetting readyHow to do it…Enrolling an Android device – BYODGetting readyHow to do it…Enrolling with personal enrollment allowedEnrolling with personal enrollment blocked
Chapter 6: iOS Device Management
Chapter materialsImportant notesTechnical requirementsConfiguring a connector between Apple and IntuneGetting startedHow to do it…Configuring an Apple VPP tokenGetting startedHow to do it…Automating itAdding enrollment profile tokensHow to do it…Automating itConfiguring iOS policies using the settings catalogHow to do it…Automating itConfiguring iOS policies using device restrictionsHow to do it…Automating itDeploying applications via Apple VPPGetting startedHow to do it…Automating itConfiguring iOS update settingsHow to do it…Automating itConfiguring an app protection policyGetting startedHow to do it…Automating itThere's more…Looking at app configuration policiesLearning about iOS app provisioning profilesEnrolling your device: corporateGetting startedHow to do it…There's more…Enrolling your device: BYODGetting startedHow to do it…
Chapter 7: macOS Device Management
Chapter materialsImportant notesTechnical requirementsConfiguring a macOS settings catalog policyHow to do it…Automating itDeploying shell scripts to macOSGetting readyHow to do it…Deploying a shell scriptDeploying a custom profileAutomating itDeploying a shell scriptDeploying a custom profileConfiguring update policies for macOSHow to do it…Automating itDeploying apps to macOSGetting readyHow to do it…App StoreDMG applicationsPKG applicationsMicrosoft 365 appsMicrosoft EdgeMicrosoft Defender for EndpointAutomating itApp StoreDMG applicationsPKG applicationsMicrosoft 365 appsMicrosoft EdgeMicrosoft Defender for EndpointConfiguring a macOS enrollment profileGetting readyHow to do it…Automating itConfiguring Platform SSO for Entra integrationHow to do it…Automating itEnrolling your corporate deviceGetting readyHow to do it…
Chapter 8: Setting Up Your Compliance Policies
Technical requirementsChapter materialsActions for non-complianceConfiguring notification templatesHow to do it…Automating itDeploying a Windows compliance policyGetting readyCompliance settingsHow to do it…Automating itDeploying an Android compliance policyGetting readyCompliance settingsHow to do it…Automating itDeploying an iOS compliance policyGetting readyCompliance settingsHow to do it…Automating itDeploying a macOS compliance policyGetting readyCompliance settingsHow to do it…Automating itDeploying a Linux compliance policyGetting readyAllowed DistributionsCustom ComplianceDevice EncryptionPassword PolicyHow to do it…Automating itConfiguring and deploying a Windows custom compliance policyGetting readyPowerShell scriptJSON fileHow to do it…PowerShell scriptCompliance policyAutomating itUsing conditional access to restrict access based on complianceGetting readyHow to do it...Automating it
Chapter 9: Monitoring Your New Environment
Technical requirementsMonitoring applicationsGetting readyHow to do it...App configuration statusApp install statusApp licensesApp protection statusDiscovered appsAutomating itApp configuration statusApp install statusApp licensesApp protection statusDiscovered appsMonitoring device configurationHow to do it...Devices with restricted appsEncryption reportCertificatesAssignment failuresAutomating itDevices with restricted appsEncryption reportCertificatesAssignment failuresMonitoring device complianceGetting readyHow to do it...Non-compliant devicesPolicies with non-compliant and error devicesAutomating itNon-compliant devicesPolicies with non-compliant and error devicesMonitoring device enrollmentGetting readyHow to do it...Enrollment failuresWindows Autopilot deploymentsAutopilot device preparation deployment statusAutomating itEnrollment failuresWindows Autopilot deploymentsAutopilot device preparation enrollmentsMonitoring updates across platformsGetting readyHow to do it...Windows updatesiOS update statusmacOS update statusAutomating itWindows updatesiOS update statusmacOS update statusMonitoring device actionsGetting readyHow to do it...Automating itUsing device queryGetting readyHow to do it…Multiple devicesSingle devicesAutomating itReviewing audit logsGetting readyHow to do it...Automating it

Chapter 10: Looking at Reporting
Technical requirementsChecking device management reportsGetting readyHow to do it…Reviewing device complianceChecking device configurationReviewing Group Policy analyticsCloud-attached devicesReviewing Device Attestation StatusAutomating reportsReviewing device complianceReviewing device configurationReviewing Group Policy analyticsCloud-attached devicesReviewing Device Attestation StatusReviewing endpoint security reportsHow to do it…Reviewing Microsoft Defender AntivirusReviewing firewall reportsAutomating the reportsReviewing Microsoft Defender AntivirusFirewall reportReviewing endpoint analytics reportsGetting readyStartup performanceApplication reliabilityWork from anywhereResource performanceBattery HealthHow to do it…Automating the reportsUsing Intune Data Warehouse with Power BIHow to do it…Checking Windows updates via reportingGetting readyHow to do it…There's more…Expanding Windows Update reportingGetting readyHow to do it…Exporting diagnostics to AzureGetting readyHow to do it…
Chapter 11: Packaging Your Windows Applications
Chapter materialsAssigning applicationsSystem contextUser contextTechnical requirementsUsing the Microsoft Store integrationHow to do it…Automating itPackaging into MSIXGetting readyHow to do it…PackagingDeploying our MSIX packagePackaging Win32 applicationsGetting readyCalling MSI/exe directlyBatch scriptPowerShell scriptPSADTHow to do it…Application detectionAutomating itManaging app supersedence and dependenciesApplication supersedenceDependenciesGetting readyHow to do it…Configuring application supersedenceConfiguring application dependencyDeploying Office applicationsGetting startedHow to do it…Updating Office applicationsGetting readyOffice portalSettings catalogHow to do it...Automating itWindows app protectionGetting readyHow to do it…Automating it
Chapter 12: PowerShell Scripting Across Intune
Technical requirementsDeploying platform scriptsGetting readyHow to do it…Automating itConfiguring RemediationsGetting readyHow to do it…Automating itThere's more…Viewing outputRunning remediations on demandUsing custom detection scripts in appsHow to do it…Examples of application detection scriptsAutomating itUsing custom requirements scripts in appsHow to do it…Examples of custom requirements scriptsAutomating it
Chapter 13: Tenant Administration
Technical requirementsReviewing your connectorsGetting readyHow to do it…Automating itAdding filtersHow to do it…Automating itConfiguring Intune rolesHow to do it…How it works…Using scope tagsHow to do it…Automating itCustomizing the end user experienceHow to do it…Automating itThere's more…Customizations in Microsoft EntraCustomizing the Microsoft 365 portalDeploying custom notificationsHow to do it…Automating itSetting up terms and conditionsHow to do it…Setting up terms and conditionsConfiguring Entra's Terms of UseAutomating itTerms and conditionsTerms of UseConfiguring multi-admin approvalsHow to do it…Automating itAutomating the policy creation processAutomating the request approval processChecking your tenant versionHow to do it…Using Intune's troubleshooting toolsHow to do it…Enrollment notificationsHow to do it…Automating itEmail templatesPush templatesConfiguring device restrictionsHow to do it…Device limit restrictionsDevice platform restrictionsAutomating itDevice limit restrictionsDevice platform restrictionsConfiguring quiet time policiesHow to do it…Automating itReviewing admin tasksHow to do it...Automating it
Chapter 14: Looking at Intune Suite
Technical requirementsChapter materialsDeploying and using Remote HelpGetting startedHow to do it…Automating itLearning about Microsoft Tunnel for Mobile Application ManagementGetting readyHow to do it…Reviewing device anomaliesHow to do it…Automating itConfiguring Endpoint Privilege ManagementHow to do it…Automating itThere's more…Deploying certificates with Cloud PKIHow to do it…Root CAIssuing CAAutomating itRoot CAIssuing CAMaking app packaging easier with Enterprise App ManagementHow to do it…Automating itThere's more…
Chapter 15: Using AI with Security Copilot
Technical requirementsEnabling Security Copilot in and removing it from your tenantHow to do it…Using Explorer to interrogate your devicesHow to do it…Using Security Copilot within IntuneHow to do it…Device promptsPolicy promptsKQL assistanceLetting agents help you in Intune, Entra, and DefenderHow to do it…Intune agentsEntra agentsDefender agentsBuilding your own agentsHow to do it…
Chapter 16: Unlock Your Exclusive Benefits
Unlock this Book’s Free Benefits in three Easy StepsNeed Help
Other Books You May Enjoy
Index

Content preview from Microsoft Intune Cookbook - Second Edition

8 Setting Up Your Compliance Policies

Now that we have successfully enrolled devices from all of the major platforms (Windows, macOS, iOS, and Android), we need a method of ensuring they are always managed, updated, and compliant with our own requirements. For that, we can use compliance policies. These allow us to configure a set of requirements that devices must meet to be classed as compliant within the environment. Then, we can add a Conditional Access policy on top to restrict access to corporate data from any devices that do not meet the criteria. This increases our security posture and also gives us the ability to quickly monitor our estate for any major issues.

In addition to showing you how to deploy these policies, we will also look ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Publisher Resources

ISBN: 9781805807230

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

Microsoft Intune Cookbook - Second Edition

by Andrew Taylor

8

Setting Up Your Compliance Policies

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.