Designing, deploying, and operating Microsoft Intune. Home of the Intune Deployment Guide.
The two surviving iOS BYOD builds: web-based device enrollment with JIT registration and the Company Portal self-service trap, and account-driven User Enrollment with the service discovery file that kills most first attempts, plus the argument for when each one earns its place.
The Android BYOD build after June 2026: group-scoped enrollment restrictions as the real boundary, the certificate-first Wi-Fi prerequisite, and the one-way Move to Android Management API policy with its verification list, before the CY2026 auto-migration runs it for you.
Running MAM after the design is done: the January 2026 version-floor enforcement, conditional launch as a precedence engine, the two offline timers, selective wipe mechanics, and the Conditional Access grant that actually enforces it.
The operational capabilities the July 2026 change folded into Microsoft 365 E3: Remote Help built on your identity, Advanced Analytics with Device Query, and Tunnel for MAM. What each one is, where its boundary sits, and why these are the easy yes of the Suite.
Microsoft Cloud PKI retires the NDES, connector, and on-premises issuing CA you run purely to hand certificates to your endpoints. What it removes, the cloud-root versus bring-your-own-CA decision, what it will and will not issue, and the boundary that keeps it honest as an endpoint issuer rather than an enterprise PKI.
Endpoint Privilege Management runs users as standard and elevates specific tasks by policy. How the isolated-virtual-account model works, the spectrum of elevation types, why the reporting is the migration path, the Windows-only scope, and how it is now licensed through E5.
As of July 2026 the Intune Suite is folded into Microsoft 365 E3 and E5. What landed in each plan, the EM+S carve-out that will catch people, what each component is, and the deliberate order I would adopt them in.
Enterprise App Management is Microsoft's managed application supply chain. What it actually is, the packaging labor it removes, how it is now licensed through E5, and where it sits against Winget and the deeper third-party tools.
