MD-101-Manage Policies and Profiles Summary

devices can be managed joinedly in both System Center COnfiguration Manger and Microft Intune. That is called co-management.
Intune can take precedence over GPOs starting 1803.
MDM Migration Analysis Tools checks for GPOs that can be implemented with the MDM.
Conditional access policies check conditions before access to corporate resources is granted.
- Conditions can be:
  - controlled apps
  - controll of device requirements like encryption of the drives, jail brake etc.
  - etc.
- Azure AD evaluates them.
- A test plan should be created when they are implemented.
Devices will check their compliance status periodically with Intune.
- Intune device configuration policies -> device settings in the MDM
- Intune can deploy powershell scripts to windows devices.
  - This allows for the deployment of win32 applications for instance.
- scope tags -> filter intune policies to Azure AD groups
- custom policies with OMA-URI policies (Open Mobile Alliance Uniform Resource Identifier) possible
User profiles types:
- Local
- Roaming - profile copy stored on the network (server share)
- Mandatory - fixed user profile, only admin can change them
  - set up by renaming NTuser.dat to NTuser.man for roaming profiles
- Super-Mandatory - mandatory profile stored on the network
  - set up by renaming profile folder \\server\profiles\user1.v6 -> \\server\profiles\user1.man.v6 for mandatory
- Temporary

Anonym