Microsoft 365 Endpoint Administrator

The process of making a created sensitivity label available to specific users or groups within an organization so they can apply it to their content.

• Labels are useless until published.
• Published via label policies in Microsoft Purview.
• Targeted to specific users/groups.

A feature within Microsoft Entra Conditional Access that allows administrators to define access policies based on the network location from which a user is attempting to access resources.

• Can restrict access from specific countries/regions.
• Can require MFA when accessing from untrusted locations.
• Requires named locations to be configured in Microsoft Entra ID.

A set of rules in Microsoft Intune that devices must meet to be considered compliant. Non-compliant devices can be restricted from accessing corporate resources.

• Defines device health and configuration requirements.
• Can include settings for passcodes, OS versions, encryption, and jailbreak detection.
• Integrates with Conditional Access to enforce access for compliant devices only.

Pre-configured groups of settings for Windows devices that align with security best practices recommended by Microsoft, designed for easy deployment.

• Simplifies deployment of security configurations.
• Based on Microsoft's security recommendations.
• Can be customized and assigned to groups.

A Microsoft tool designed to meet and accomplish your hybrid identity goals. It synchronizes user identities, groups, and device objects between on-premises Active Directory and Azure Active Directory.

• Handles synchronization of user accounts, groups, and device objects.
• Supports password hash synchronization, pass-through authentication, and federation.
• Essential for hybrid identity scenarios, including object lifecycle management (creation, updates, deletions).

A feature in Azure AD that allows devices to automatically enroll in a Mobile Device Management (MDM) solution like Intune when they are joined to Azure AD or registered with Azure AD.

• Requires Azure AD Premium license.
• Configured in Azure AD > Mobility (MDM and MAM).
• Applies to devices that are Azure AD joined or Hybrid Azure AD joined.

A feature of Azure Active Directory that enables organizations to enforce policies for accessing resources based on specific conditions, such as user location, device state, application, and sign-in risk.

• Acts as a gatekeeper for resource access.
• Can require multi-factor authentication, compliant devices, or trusted locations.
• Integrates with Intune for device compliance checks.

A feature in Microsoft Intune that allows administrators to upload and deploy custom PowerShell scripts to Windows devices, providing options for execution context, retry behavior, and reporting.

• Supports running scripts in user or system context.
• Provides success/failure reporting for script execution.
• Ideal for automating tasks, configuring settings not available via profiles, or running diagnostics.

An Intune enrollment method for corporate-owned Android devices that creates a separate work profile to isolate and manage corporate apps and data, while allowing personal use of the device.

• Separates corporate and personal data.
• IT manages only the work profile.
• Suitable for corporate-owned devices with personal use.

Specific users, groups, or roles that are intentionally excluded from the scope of a Conditional Access policy, often as a safety measure to prevent administrative lockouts.

• Global Administrator role is often excluded by default from new CA policies.
• Exclusions take precedence over inclusions.
• Critical for maintaining access in case of misconfigured policies.

Enrollment methods for corporate-owned mobile devices designed for specific functions (e.g., kiosk, digital signage, frontline worker tools) that offer high levels of management and often zero-touch deployment.

• Examples: Apple Automated Device Enrollment (ADE), Android Enterprise Dedicated Devices.
• Provides granular control over device settings, apps, and restrictions.
• Simplifies initial setup for end-users, often requiring no user interaction.

A zero-touch enrollment method for corporate-owned iOS/iPadOS devices purchased directly from Apple, allowing automatic MDM enrollment during initial device setup.

• Requires integration with Intune.
• Provides automatic, mandatory enrollment.
• Ideal for large-scale corporate deployments.

Azure AD device states (Registered, Joined, Hybrid Joined) define how a device connects to Azure AD, while Intune compliance status indicates if it meets organizational policies.

• Registered: BYOD, provides SSO.
• Joined/Hybrid Joined: Corporate, full management.
• Compliance requires MDM (e.g., Intune) evaluation.

A condition in Conditional Access policies that allows defining trusted or untrusted network locations (IP ranges, countries) to control access to resources.

• Uses named locations (IP ranges).
• Can include or exclude specific locations.
• Essential for geographically restricted access.

A condition within Conditional Access policies that allows administrators to define access requirements based on the management and compliance status of a device (e.g., Compliant, Hybrid Azure AD joined, Azure AD registered).

• Crucial for enforcing 'managed device' or 'compliant device' access policies.
• Leverages Intune's device compliance status.
• Can be combined with other conditions for granular control.

A grant control in Conditional Access that mandates a device must be marked as compliant by an MDM solution (like Intune) to gain access to protected resources.

• Enforces device health and security standards.
• Integrates with Intune compliance policies.
• Fundamental for Zero Trust device access.

The process of linking a created policy (e.g., compliance, configuration, app protection) to specific user groups or device groups within Microsoft Intune, enabling the policy to be evaluated and enforced on those targets.

• Policies are inactive until assigned.
• Can be assigned to user groups or device groups.
• Assignment determines the scope of policy application.

Labels that classify and protect organizational data, allowing for the automatic application of encryption, access restrictions, visual markings, and other protection settings based on data sensitivity.

• Part of Microsoft Purview Information Protection (MPIP).
• Can be applied manually by users or automatically by policies.
• Enforce protection like encryption and access control, persistent with the data.

A customized version of the Google Play Store for Android Enterprise deployments, used by IT administrators to approve, distribute, and manage applications for corporate-managed Android devices.

• Integrates with Intune for app management on Android Enterprise devices.
• IT admins approve apps before they are available to users/devices.
• Used for both public apps and private line-of-business (LOB) apps.

A policy that defines how long an organization keeps content (e.g., emails, documents, Teams messages) and, optionally, when to delete it after the retention period.

• Retains content for compliance.
• Can also automatically delete content.
• Applies across various Microsoft 365 services.

Rules that govern the lifecycle of data within Microsoft 365, specifying how long content should be retained (or deleted) to meet regulatory, legal, and business requirements.

• Apply to various locations: Exchange mailboxes, SharePoint sites, OneDrive accounts, Teams chats/channels.
• Can retain content for a specified period, delete content after a period, or both.
• Prevent permanent deletion during the retention period.

A condition in Conditional Access policies that evaluates whether a device is Azure AD registered/joined and/or compliant with Intune policies, influencing access decisions.

• Checks device registration/join status.
• Verifies device compliance from Intune.
• Critical for 'trusted device' access scenarios.

Allows administrators to extend Intune's compliance capabilities by defining custom rules using PowerShell scripts, enabling checks for specific device configurations or application states.

• Uses PowerShell scripts to evaluate compliance.
• Enables checks beyond built-in compliance settings.
• Reports device compliance status back to Intune.

A Microsoft Purview feature that automatically applies sensitivity labels to content at rest in cloud services (e.g., SharePoint, OneDrive, Exchange) based on defined conditions.

• Applies labels to existing content in cloud locations.
• Uses sensitive information types (SITs) for detection.
• Does not require user interaction for application.