Every Intune app type for Windows and macOS, how the Intune Management Extension installs Win32 apps with detection, requirements, return codes, supersedence and dependencies, how Store and Enterprise App Catalog apps differ, how macOS PKG and DMG installs work, and how to read the logs when an install fails.
How Intune compliance works end to end, from per-platform settings, the built-in default policy, grace periods and custom compliance through the Entra device object to a Conditional Access grant that requires a compliant device or an app protection policy, plus the MDE risk signal and how to unblock a user.
How Conditional Access evaluates a sign-in, every condition, grant and session control, the Microsoft baseline and templates, break-glass exclusions, naming, report-only rollout, and the Graph and PowerShell shapes behind it all.
Which Intune profile type to use for Windows and macOS, how settings reach the device through MDM CSPs and the Intune Management Extension, how conflicts are resolved and reported, and how platform scripts, remediations, filters, policy sets and Graph export fit together.
Every Intune enrolment path and when to use it, Autopilot user-driven, pre-provisioning, self-deploying and device preparation, hybrid join and the Intune Connector for AD, GPO and co-management, Apple ADE and account-driven enrolment, with the restrictions, ESP and failure codes that decide whether a device lands.
Microsoft's SSE in one article, Entra Internet Access for web filtering and the Microsoft 365 profile, Entra Private Access as the VPN replacement through private network connectors, the client on four platforms, traffic forwarding profiles, compliant network Conditional Access, logging to Sentinel, and the limits that bite.
How GPO and MDM policy interact on a hybrid-joined Windows device, the ADMX vs CSP model, MDMWinsOverGP and its limits, Group Policy analytics import and migrate, coexistence patterns, refresh timing, reading conflicts, a GPO fundamentals refresh for AZ-800, and the end state.
Every documented hand-off between Intune and another Microsoft product, as one matrix, with the MDE two-way data flow, the Conditional Access signal chain, where each switch lives, and what silently breaks when a licence or tenant is wrong.
Every documented product-to-product link in the Defender family, where each switch lives, what it needs, what it unlocks, and how to prove it is working.
The three Windows device identity states in Entra ID, what each unlocks for SSO, Conditional Access, Intune, Windows Hello and LAPS, how hybrid join actually registers through the SCP, userCertificate and Entra Connect, why Entra join plus cloud Kerberos trust is now the default answer, and how to verify, clean up and troubleshoot.
What Intune manages through MDM enrolment and MAM without enrolment, the platforms it covers, how the admin center and Graph namespaces are laid out, Plan 1 versus Plan 2 versus Intune Suite with its add-ons, user and device licensing, and the tenant setup steps that must be done before the first device enrols.
Two-tier AD CS design and hardening (ESC classes, strong certificate mapping, MDI sensor), how certificates reach Intune devices through SCEP via NDES and the Certificate Connector, PKCS, and when Microsoft Cloud PKI or BYOCA removes NDES altogether.
The Intune diagnostic toolkit, the Troubleshooting blade, device sync, MDM diagnostic report, DeviceManagement event log, IME logs with CMTrace, Collect diagnostics, enrolment error codes, the Reports blade, Endpoint analytics, the data warehouse, exportJobs, and Log Analytics routing.
The tie-together mental model for this knowledge base, AD DS as the on-prem authority, Entra ID as the cloud authority, the sync bridge between them, device join as the fork that decides GPO or Intune, where each Defender product touches AD, what still needs AD in 2026, and the migration arc most clients are on.
How Intune drives Windows servicing through update rings, feature, quality, expedite and driver policies, what Windows Autopatch adds on top, how the deadline and grace model really behaves, how to get Windows Update for Business reports flowing, and how macOS updates are enforced with DDM.