Windows 11 endpoint management on Microsoft Intune — device enrolment, configuration and compliance policy, and the Conditional Access tie-in that turns compliance from a report into an access control.
Lab licensing note: built on a Microsoft Intune Plan 1 trial (EMS bundle, includes Microsoft Entra ID P1/P2). Trial started 5 August 2026, expires ~4 September 2026. Screenshots in this repo are the permanent record of a temporary tenant.
I have run Intune in production — iOS and Android enrolment, application deployment and configuration profile assignment for 500+ users at Genus PLC. What that role did not cover was the Windows side: Entra join, Windows compliance policy authoring, and wiring compliance state into Conditional Access.
This lab is that extension. It is not "learning Intune from scratch" — it is taking existing mobile endpoint management experience upward into Windows management and identity-driven access control, which is where the SC-500 syllabus and the roles I am targeting both sit.
| Component | State |
|---|---|
| Windows 11 Enterprise VM (Hyper-V, Gen 2, vTPM, Secure Boot) | Built |
| Microsoft Entra join | Complete |
| Automatic MDM enrolment into Intune | Complete |
| Configuration profile | in progress |
| Compliance policy (BitLocker, Secure Boot, minimum OS build) | in progress |
| Conditional Access requiring a compliant device | in progress |
Enrolment is verified in three places rather than one, because a device appearing in one view and not another is itself the diagnostic signal.
1. Intune admin centre → Devices → All devices — device present, ownership Corporate, compliance Compliant
2. Entra admin centre → Devices → Properties — join type Microsoft Entra joined, MDM Microsoft Intune, Compliant Yes
3. On the device — dsregcmd /status (elevated) — AzureAdJoined : YES, TpmProtected : YES, DeviceAuthStatus : SUCCESS, and MdmUrl populated
Hyper-V VM security settings — Secure Boot enabled with the Microsoft Windows template, and Trusted Platform Module enabled. Without the vTPM the compliance policy's BitLocker, Secure Boot and TPM checks cannot return meaningful results.
MDM user scope — Entra admin centre → Mobility (MDM and MAM) → Microsoft Intune, user scope set to All. This is the setting that makes automatic enrolment happen off the back of the Entra join.
Licence assignment — the enrolling user holds Microsoft Entra ID P2 and Intune, both Active. An unlicensed user cannot enrol a device.
Those two dsregcmd fields are a diagnostic pair worth reading rather than just checking.
AzureAdJoined : YES with a blank MdmUrl is the signature of MDM automatic enrolment
not being configured — the device joined Entra correctly, but nothing ever told it to enrol.
The fix is MDM user scope in the Entra admin centre, not anything on the device.
Full build detail, including the settings that are not optional and why, is in
docs/01-lab-setup.md.
- All lab accounts carry a
lab.UPN prefix. - Administration is performed as a native cloud admin account, never a personal Microsoft account — an MSA is an external identity in the directory and breaks both WAM and device code authentication.
- No tenant IDs, object GUIDs or real UPNs are committed. Identifiers in screenshots are redacted.
azure-secure-landing-zone— security-first Azure landing zone in Terraformentra-id-automation— PowerShell + Microsoft Graph automation for Entra ID
MIT