The attack-surface article argued the family and sent you to the Intune guide for the audit-to-block ladder itself. This build pins the rules to values, resolves the merge conflict from the attack-surface side, and wires the web-protection substrate that most…
The protection-engine article argued which of these settings are dials rather than switches and where each should land. This pins them. Most are a single deliberate choice made once, and they are gathered here as values with the reason attached.…
The security settings management article argued what this channel is and the one rule that governs it: an Intune-enrolled device ignores it, so it exists to configure the machines Intune deliberately does not manage. This is the build. It is…
The onboarding article mapped the doors a device can take into Defender and argued which one to use for which population. This is the build for the door most estates start with, the Intune channel, taken from an empty connection…
Wiring the Cloud PKI certificate into EAP-TLS Wi-Fi: the vendor-neutral RADIUS checklist, the Wi-Fi profile settings, the per-platform traps, and an end-to-end test that proves a revoked certificate gets refused.
Standing up the Cloud PKI hierarchy and the profiles that deliver from it: root CA, issuing CA, trusted certificate profiles, and the SCEP profile, ending with a validated end-to-end issuance and revocation test.
Microsoft gives you coexistence primitives but no migration doctrine. The sequencing that cannot strand a device, and the honest ledger at the end: NDES retires, the connector retires conditionally, AD CS almost never does.
Cloud PKI issues the client certificates, but Microsoft sells nothing that terminates EAP-TLS. The authenticator decision, NPS, cloud RADIUS, or the box itself, quietly decides how much Active Directory you keep.
