Top identity Interview Questions & Answers

Intune is Microsoft’s cloud-based endpoint management service. It manages devices (Windows, macOS, iOS, Android, Linux), apps, and data on them, and integrates with Entra ID for identity and conditional access.

MDM enrolls the entire device and enforces policies across the whole OS. MAM enrolls only specific apps — useful for BYOD where users won’t allow full device management.

Intune is the device-management plane; Entra ID is the identity plane. Intune reports device compliance state to Entra ID, and Entra ID’s Conditional Access policies consume that signal to gate access to Microsoft 365, Azure, and federated apps.

Windows Autopilot (HWID-registered devices auto-join on first boot), Apple Business Manager (DEP-based iOS/macOS enrollment), Android Enterprise zero-touch (OEM-integr).

Intune evaluates each device against compliance rules (encryption, OS version, jailbreak status, etc.) and exposes a boolean state to Entra ID. Conditional Access policies then allow or deny resource access based on that state. The user gets blocked if their device falls out of compliance until it re-checks and passes.

Win32 apps use the Intune Win32 prep tool to wrap an .exe or .msi installer into an .intunewin file. You upload it, define install / uninstall commands, detection rules, and assign the package to a group. Intune pushes and silently installs the app on managed devices.

Group Policy uses ADMX/ADML files and runs only on domain-joined machines via the legacy Win32 policy engine. CSPs are the modern, declarative equivalent that work over the MDM channel on any Intune-managed device.

Enroll the phone in Intune via Android Enterprise work profile. Apply a device compliance policy (encryption, screen lock, OS version). Apply an app protection policy to Outlook for Android. Block access to Exchange Online via Conditional Access unless the device is compliant.

Use a phased co-management strategy over 6–12 months:

• Enable co-management on existing ConfigMgr clients. Devices dual-manage from both ConfigMgr and Intune.
• Pilot Intune workloads on a small group.
• Move workloads in waves: compliance.
• Run both in parallel for at least one full reporting cycle.
• Decommission ConfigMgr only after all workloads have shifted.

Enable Defender for Endpoint integration in Intune. Devices onboarded to Defender report threat signals to Intune; Intune can mark a device non-compliant if Defender detects active threats, which then triggers Conditional Access blocks.

MAM can protect managed apps but cannot reach personal apps or the underlying OS. A determined user can take a screenshot of corporate data displayed in a managed app. For highly sensitive data, push for MDM enrollment or accept the residual risk with explicit user consent and aggressive app protection policies.

Check, in order:

• Device HWID uploaded to Intune and assigned to an Autopilot deployment profile.
• Device has the correct Autopilot profile with Entra ID join config.
• Network can reach login.microsoftonline.com, graph.microsoft.com, and manage.microsoft.com.
• TPM is enabled and owned.
• Collect %ProgramData%\Microsoft\Windows\Autopilot\Logs and Microsoft-Windows-DeployLX\* event logs.