One iPhone, still sealed, to a device that Conditional Access will accept as compliant, with nobody touching it but the person it belongs to. Every setting, why it is set that way, the two decisions you cannot revisit without a wipe, and the state you should see at each of eight checkpoints.
An Apple enrollment policy is read by the device once, during activation, and never again, which makes it the only object in this stack whose half-life is the hardware refresh cycle. Inside it sits an authentication choice that decides whether your fleet is governed or merely managed, and a first-party limitation that contradicts what every Zero Trust article on this site tells you to do.
Every Apple device in your estate arrives through one of four doors, and the door decides what you are allowed to do with the device for the rest of its life. Here is what each one buys, what each one forecloses permanently, and the one Apple built that Intune has not opened.
A laptop that never touches the corporate network mounts a file share and opens a remote desktop session, with Kerberos single sign-on intact and multifactor authentication enforced at the identity layer. Domain controllers published properly, the Kerberos negative cache defused, and an honest account of what this does not replace.
Connectors, a connector group that is not Default, Quick Access with the port expression that leaves DNS alone, private DNS suffixes in a split-brain estate, and the first per-app application promoted out of discovery and rescoped. With the end-to-end test that actually proves the enterprise application beat Quick Access.
Private Access is a real VPN retirement path, and the way to walk it is not the tidy one. You replace the tunnel with broad access first, then spend months making it smaller, and the thing you replaced it with never entirely goes away.
A reproducible walkthrough: turn on collaboration protection and close the download door, make the Safe Links rewrite decision explicit, and set the anti-phishing engine to act, with self-tests that prove each engine is live.
A reproducible walkthrough: enable and scope the Standard preset, populate the impersonation lists by hand, carve one custom exception, and wire quarantine notifications, validated end to end.
