Microsoft Endpoint Administrator

Every device starts with an identity and an enrollment. You choose between Entra join, hybrid join and registration, then enroll Windows, Apple and Android devices by the method that suits who owns them.

• Entra join, hybrid join and registration compared
• Device settings and who may join
• Enrolling Windows devices
• Automated enrollment for Apple devices
• Android enrollment for personal and corporate devices
• Enrollment restrictions and limits

You build Enrollment paths for four device types, each tested in a lab tenant.

Delegation and rules keep a large fleet in order. You assign Intune roles with scope tags, group devices with filters, and write compliance policies with actions for devices that fall out of line.

• Intune roles and scope tags
• Groups and assignment filters
• Compliance policy settings by platform
• Actions for noncompliant devices
• Compliance as a Conditional Access signal

You build A role and scope design for two regional IT teams, with compliance policies for each platform.

Autopilot lets a device go from the box to ready without anyone building an image. You register hardware, create deployment profiles, shape the first-run experience, and choose between user-driven, self-deploying and pre-provisioned modes.

• Hardware hashes and device registration
• Deployment profiles and modes
• The enrollment status page
• Pre-provisioning with a technician
• Windows Autopilot device preparation
• Reset, wipe and device reuse

You build An Autopilot deployment that takes a new device through enrollment with apps and policies installed.

Configuration is how a device gets its settings without a technician. You build profiles from the settings catalog and templates for four platforms, import administrative templates, and run scripts where a profile cannot reach.

• The settings catalog and templates
• Administrative templates for Windows
• Profiles for macOS, iOS and Android
• Assignment filters and profile conflicts
• Scripts and shell scripts for the gaps
• Reporting on profile success

You build A set of configuration profiles for four platforms, with a report on which devices received them.

Some jobs need more than policies. You use Remote Help to support users, Cloud PKI to issue certificates, privilege management to limit admin rights, and remote actions to reset or lock a device that is lost.

• What the Intune Suite adds
• Remote Help sessions and permissions
• Cloud PKI for certificate-based access
• Endpoint privilege management
• Remote actions: sync, restart, wipe and lost mode

You build A support runbook that uses remote actions and Remote Help for common device problems.

A managed device is only useful if it is safe. You apply security baselines, set antivirus and firewall policy, enforce disk encryption and store recovery keys, and onboard devices to Defender for Endpoint.

• Security baselines
• Antivirus and attack surface reduction policy
• Firewall policy
• BitLocker and FileVault with recovery keys
• Onboarding to Defender for Endpoint
• Responding to a noncompliant or at-risk device

You build An endpoint security policy set for Windows and macOS, with encryption and recovery verified.

Unpatched devices are the easiest target, and badly timed updates are the easiest way to annoy everyone. You build update rings, schedule feature and quality updates, expedite urgent fixes, and let Autopatch handle the routine.

• Update rings for Windows Update for Business
• Feature and quality update policies
• Driver updates and expedited updates
• Windows Autopatch groups and rings
• Updates for Apple and Android devices
• Reporting and fixing failed updates

You build An update strategy with pilot and broad rings, and reports that show where updates are stuck.

Users need the right apps without asking. You package and deploy Win32, Store, line-of-business and Microsoft 365 apps, handle dependencies and supersedence, and deploy iOS and Android apps.

• Packaging Win32 apps
• Store, line-of-business and Microsoft 365 apps
• Detection rules, requirements and dependencies
• Supersedence and app updates
• Apps on iOS and Android
• Troubleshooting an app that will not install

You build Three apps of different types deployed with detection rules, one of them replacing an older version.

Personal phones hold company data too. You use app protection policies to control data inside apps without managing the device, add app configuration, and tie both to Conditional Access.

• App protection policies without enrollment
• Data transfer, PIN and encryption settings
• Conditional launch and wiping app data
• App configuration for managed and unmanaged apps
• Requiring protected apps with Conditional Access

You build An app protection and configuration setup for personal phones, tested on iOS and Android.

Repetitive admin work belongs in a script. You call the Graph API and the Graph PowerShell SDK to manage devices and policies, and use remediation scripts to detect and fix problems before users notice.

• Microsoft Graph and the Intune endpoints
• The Graph PowerShell SDK and permissions
• Bulk device and policy tasks
• Remediations: detection and fix scripts
• Running scripts safely at scale

You build A PowerShell script that reports on devices through Graph, plus a remediation that fixes one common fault.

Good operations are driven by data. You read startup performance, app reliability and work-from-anywhere reports, find the devices dragging down user experience, and use Security Copilot agents to speed up routine analysis.

• Startup performance and device scores
• App and OS reliability reports
• Readiness for Windows upgrades
• Security Copilot agents in endpoint management
• Turning a report into a fix

You build A health review of a device fleet with three fixes ranked by their effect on users.

One scenario covers a whole life cycle. You enroll devices, deploy Windows and apps, secure and update them, automate routine work and monitor results, then present the design you chose.

• Reading the company’s device and security needs
• Designing enrollment, profiles and compliance
• Deploying apps and protecting data
• Updates, automation and monitoring
• Presenting the management design

You build A working Intune environment for a sample company, with documentation for its support team.