Microsoft Intune cheat sheets
Microsoft Intune is a cloud-based endpoint management service that secures and manages devices and apps. It runs entirely in the cloud, needs no on-premises infrastructure, and covers the whole device lifecycle: enrolling devices, configuring settings, securing endpoints, deploying apps and keeping software current. It supports Android, iOS/iPadOS, Linux, macOS, tvOS, visionOS and Windows. Intune is built on two management modes you can use separately or together: mobile device management (MDM), where the whole device is enrolled and managed, and mobile application management (MAM), where only work apps and their data are protected.
Everything is managed from the Microsoft Intune admin center, and every admin center action is backed by a Microsoft Graph API call. Microsoft Intune is the product name; the older Endpoint Manager branding has been retired from the documentation. Identity comes from Microsoft Entra ID: users and groups decide what a device can do, and device compliance posture flows back into Entra Conditional Access to gate access to corporate resources. The cheat sheets here cover the three areas that stall deployments most: enrollment methods, configuration profiles and policies, and compliance policies.
Every policy name, status string, enrollment method and limit below was checked against Microsoft Learn during authoring — nothing is from memory, and anything that could not be verified was left out. This site's networking calculators make useful companions when you are also segmenting the networks those endpoints connect to: IPv4 subnet calculator, VLSM calculator and IP range to CIDR.
Cheat sheets
Enrollment
Company Portal BYOD, Windows Autopilot, Android QR and zero-touch, Apple ADE — with verified prerequisites.
Configuration profiles
Templates vs settings catalog, plus compliance, app protection, enrollment restrictions and RBAC.
Compliance
Per-platform conditions, the four actions for noncompliance, and the exact status strings on the dashboard.
Free network tools
Subnet CalculatorIPv6 CalculatorWildcard MaskRange → CIDRSplitterAggregatorVLSM CalculatorPracticeCheat Sheet
FAQ
What is the difference between MDM and MAM in Intune?
MDM (mobile device management) enrolls the whole device: Intune installs an MDM certificate, manages settings, security and apps, and can wipe it. MAM (mobile application management) manages only the work apps and the data inside them — app PINs, data-relocation rules, selective wipe — and works with or without enrollment. MAM is typical for personal BYOD; MDM is typical for corporate devices, and the two often run together on one device.
Do I need Configuration Manager to use Intune?
No. Intune is a cloud service you manage from the Microsoft Intune admin center. Configuration Manager is optional: co-management lets you run Windows devices with both and move specific workloads to Intune. The MDM authority choices are Intune standalone, Intune co-management, Basic Mobility and Security for Microsoft 365 ('Office 365'), or coexistence of Intune and Basic Mobility per user by license.
Which platforms does Intune manage?
Android, iOS/iPadOS, Linux, macOS, tvOS, visionOS and Windows, per the official supported-platforms list. Enrollment is enabled by default for all platforms and gated per platform by enrollment restrictions.
What counts as 'Microsoft Intune Suite'?
The basics — enroll, configure, secure, deploy apps, update — are the Intune subscription itself. Advanced capabilities (endpoint security, certificates, remote support, analytics, device updates, secure remote access, specialty devices) are either included in Microsoft 365 plans, accessible through Microsoft Intune Suite, or buyable as standalone add-ons — and Copilot in Intune is built on Microsoft Security Copilot.