Microsoft Intune Deploy Guide and Device Onboarding Process

You deploy compliance policies to groups of devices or users. When deployed to users, any device the user signs into must then meet the policies requirements. Some common examples of compliance requirements include:

• Requiring a minimum operating system version.
• Use of a password or PIN that meets certain complexity and length requirements.
• A device being at or below a threat level as determined by mobile threat defense software you use. Mobile threat defense software includes Microsoft Defender for Endpoint or one of Intune’s other supported partners.

In the final phase of deployment, devices are registered or joined in Microsoft Entra ID, enrolled in Microsoft Intune, and checked for compliance.

Make enrollment in Intune easier for employees and students by enabling automatic enrollment for Windows. For more information, see Enable automatic enrollment.

• Microsoft Entra join with automatic enrollment: This option is supported on devices that are procured by you or the device user for work use. Enrollment occurs during the out-of-box-experience, after the user signs in with their work account and joins Microsoft Entra ID or by choosing to join the device in Microsoft Entra ID when connecting a work or school account from the Settings app (as described in Windows device enrollment guide - End user tasks). This solution is for when you don't have access to the device, such as in remote work environments. When these devices enroll, their device ownership changes to corporate-owned and you get access to management features that aren't available on devices marked as personal-owned.

• Windows Autopilot user-driven or self-deploying mode: Automatic enrollment is supported with the Windows Autopilot user-driven (for both the Microsoft Entra hybrid join and Microsoft Entra join scenarios) or self-deploying (Microsoft Entra join only) profiles and can be used for corporate-owned desktops, laptops, and kiosks. Device users get desktop access after required software and policies are installed. A Microsoft Entra ID P1 or P2 license is required. We recommend using only Microsoft Entra join, which provides the best user experience and is easier to configure. In scenarios where on-premises Active Directory is still needed, Microsoft Entra hybrid join can be used but you have to install the Intune connector for Active Directory, and your devices must be able to connect to a domain controller via either an on-premises network or VPN connection.

• Co-management with Configuration Manager: Co-management is best for environments that already manage devices with Configuration Manager, and want to integrate Microsoft Intune workloads. Co-management is the act of moving workloads from Configuration Manager to Intune and telling the Windows client who the management authority is for that particular workload. For example, you can manage devices with compliance policies and device configuration workloads in Intune, and utilize Configuration Manager for all other features, like app deployment and security policies.

• Enrollment using Group Policy: A Group Policy can be used to trigger the automatic enrollment of Microsoft Entra hybrid joined devices without any user interaction. The enrollment process starts in the background (via a scheduled task) after a Microsoft Entra ID-synced user signs in on the device. We recommend this method in environments where devices are Microsoft Entra hybrid joined and not managed using Configuration Manager.

1 Settings - Access work or school

Join this device to Microsoft Entra ID

2 Login with your Entra ID

Make sure this is your organization then join:

Once done, you will get a message to ask you switch account:

3 Switch Account to log in 

Switch user

4 Onboard Account 

Videos

 

References

$AzureAdCred = Get-Credential Connect-AzureAD -Credential $AzureAdCred

[netsec@centos1docker hihttps]$ netstat -lntp | grep 80 (No info could be read for "-p": geteuid()=1000 but you should be root.) tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN - [netsec@centos1docker hihttps]$ 

root@4ccb3643b7e4:/#  cat /etc/nginx/conf.d/wp.conf  server { listen 80; server_name opc2armwp.51sec.eu.org 51sec.org www.51sec.org; } 

#/bin/bash

set_chinese_lang
apt-get autoremove -y
echo "Install Done!"
echo "Now you can reboot and connect port 3389 with rdp client"
echo "Note: chromium-browser is not displayed on the desktop, please start it manually if necessary"
echo "Default Username: rdpuser"
echo "Default Password: rdpuser_password"