Hey there, tech folks! Fresh from wrapping up the "Plan Device Management" lab– a solid 45-minute dive into Intune auto-enrollment, device joining in Microsoft Entra ID, and configuration profiles. I documented it all right after finishing, capturing the steps and my takeaways.

Outcomes achieved: Configured Intune auto-enrollment in Microsoft Entra ID, joined a device to Microsoft Entra ID and confirmed Intune enrollment, created and verified a configuration profile on the device. Let's break it down!

Why I Bothered Documenting This

Labs like these reinforce the concepts, turning theory into muscle memory. Kept the tone relaxed with personal notes. Grabbed screenshots on the fly to highlight key moments.


Step 1: Configuring Intune Auto-Enrollment in Microsoft Entra ID

Kicked off in the W10-Admin VM, setting up a user and group, then checked auto-enrollment.

  • Added user Dan Park: Users > Active users > Add a user, input First: Dan, Last: Park, Display: Dan Park, Username: DanP (domain included), manual password InitialPwd!-5182989, skipped force change, picked Microsoft 365 E5 (no Teams) license, completed. (Check Here to know how to create Users.)
  • Set up security group: Groups > Active groups > Security groups > Add a security group, Security type, named Mobile Users, described as Mobile Users Group, done. (Check Here to know how to create Groups.)
  • Included Dan in the group: Clicked Mobile Users, Members > View all and manage members > Add members, selected Dan Park.
  • New tab to portal.azure.com, signed in as needed.
  • Checked/Set auto-enrollment: Microsoft Entra ID > Mobility (MDM and WIP) > Microsoft Intune, MDM user scope to All, saved.


  • Takeaway: Process was clean, but hitting refresh helped spot new entries fast. Insight: Auto-enrollment links Entra ID joins to Intune management automatically, ideal for policy enforcement without extra steps. It's key for scalable deployments, cutting down manual work while keeping devices compliant. Using groups like Mobile Users targets policies precisely, adhering to least privilege to prevent unnecessary restrictions.

Overall for Step 1: Around 10 minutes; highlighted the foundation for smooth device onboarding.

Step 2: Joining a Device to Microsoft Entra ID and Verifying Enrollment in Intune

Moved to the W10 With Office VM for the join, then verified back in admin tools.

  • In W10 VM: Settings > Accounts > Access work or school > +Connect > Join this device to Microsoft Entra ID, used DanP@<tenantname> and password InitialPwd!-5182989, joined, confirmed.</tenantname>


  • Checked connected account Info for Device Sync Status, managed areas, connection details.
  • Azure Portal: Microsoft Entra ID > Devices > All devices, confirmed Join Type as Microsoft Entra joined, MDM as Microsoft Intune, reviewed properties.
  • Accessed endpoint.microsoft.com, signed in if required.
  • Devices > All devices, refreshed for W10 device, confirmed enrollment.
  • Takeaway: Quick join, but sync wait is common – worth the hold. Insight: Entra ID join moves auth to cloud for SSO and access controls. Intune enrollment then auto-applies management, enabling features like remote actions. This setup blocks unauthorized devices and supports lost device recovery, vital for remote or BYOD environments.

Step 3: Creating a Configuration Profile and Verifying Assignment

Built the profile in Endpoint Manager, forced a sync, and checked on-device.

  • Endpoint Manager: Devices > Configuration > + Create > New Policy, Windows 10 and later platform, Templates type, Device Restrictions template.


  • On the Basics tab, in Name, enter Win10DevRestrict and select Next. On the Configuration Settings tab, expand Microsoft Defender Antivirus, enable Real-time monitoring, and then select Next.
  • Assignments: Included groups > Add groups > Mobile Users selected, continued.
  • Skipped, Review and Create > Created.
  • All devices > W10 device > Sync, yes to confirm.
  • W10 VM: Settings > Accounts > Access work or school > Info, verified recent sync, synced if necessary.
  • Signed out of W10 VM.
  • Signed in as DanP@<tenantname> with InitialPwd!-5182989.</tenantname>
  • Followed PIN setup (864200), installed Authenticator.
  • Checked profile: Settings > Update & Security > Windows Security > Virus & threat protection > Manage settings, Real-time protection on and admin locked.
  • Takeaway: Pushing configs is seamless – lock-down visibility was cool. Insight: Real-time monitoring in Defender scans on-access to stop malware installs or executions instantly, curbing threats like ransomware. Graying it out stops user tampering, ensuring uniform protection. Profiles overall standardize security, aiding compliance (e.g., GDPR) by documenting enforced controls and minimizing config drift risks.

Wrapping Up: The Modern IT Reality

This 45-minute lab packed in a lot of concepts that are reshaping how IT works. The shift from manual device configuration to automated policy enforcement, the move from on-premises identity to cloud-based authentication, and the integration of security controls directly into the device management process. Most importantly, I got to see how all these enterprise tools actually fit together instead of just reading about them. Creating policies that automatically enforce security settings across managed devices isn't just a cool feature – it's becoming essential as work becomes more distributed and security threats become more sophisticated. Ready to dive deeper into conditional access and application management next. This foundation of device enrollment and basic policy enforcement is just the starting point for what modern endpoint management can actually accomplish. Time to tackle the next challenge! 💪