Microsoft Intune Microsoft Intune

Referenz für Intune Admin Center, Enrollment, Autopilot, Compliance, App-Schutz und deviceManagement APIs. Reference for the Intune admin center, enrollment, Autopilot, compliance, app protection, and deviceManagement APIs.

🛠️ Überblick & Admin Center 🛠️ Overview & admin center

Das Intune Admin Center vereint Geräte, Apps, Endpoint Security, Enrollment, Reports und Troubleshooting. Scope Tags und RBAC sind entscheidend für Delegation zwischen Regionen oder Support-Teams. The Intune admin center brings together devices, apps, endpoint security, enrollment, reports, and troubleshooting. Scope tags and RBAC are essential for delegation between regions or support teams.

📥 Enrollment je Plattform 📥 Device enrollment by platform

🚀 Windows Autopilot 🚀 Windows Autopilot

Autopilot standardisiert Windows Bereitstellung. Profile, ESP, Geräteimport, Pre-Provisioning und Lizenz-/Join-Modell müssen aufeinander abgestimmt sein. Autopilot standardizes Windows provisioning. Profiles, ESP, device import, pre-provisioning, and the licensing/join model must be aligned.

✅ Compliance Policies ✅ Compliance policies

⚙️ Configuration Profiles ⚙️ Configuration profiles

📦 App Management 📦 App management

🛡️ App Protection Policies 🛡️ App protection policies

MAM-Richtlinien schützen Daten in unterstützten mobilen Apps auch ohne vollständiges Enrollment. Zentrale Felder sind Data Protection, Access Requirements und Conditional Launch. MAM policies protect data in supported mobile apps even without full enrollment. Key areas are data protection, access requirements, and conditional launch.

• Data Protection umfasst Save As Einschränkungen, Zwischenablage, Verschlüsselung und Datenübertragung. Data protection includes Save As restrictions, clipboard controls, encryption, and data transfer restrictions.
• Access Requirements definieren PIN, Biometrie oder minimale App-Version. Access requirements define PIN, biometrics, or minimum app version.
• Conditional Launch reagiert auf Jailbreak, Offline-Dauer oder inaktive Benutzer. Conditional launch reacts to jailbreak, offline duration, or inactive users.

🧰 Device Actions 🧰 Device actions

🔐 Conditional Access Integration 🔐 Conditional Access integration

Intune und Entra Conditional Access arbeiten eng zusammen. Typische Zugriffsanforderungen sind Require compliant device oder Require app protection policy. Intune and Entra Conditional Access work closely together. Typical access requirements are Require compliant device or Require app protection policy.

• Corporate Geräte: oft Require compliant device. Corporate devices: often Require compliant device.
• BYOD mobil: häufig Require app protection policy. Mobile BYOD: often Require app protection policy.
• Für Admin-Portale und sensible Apps zusätzliche Auth Strengths und Defender Signale prüfen. For admin portals and sensitive apps, also consider auth strengths and Defender signals.

🛡️ Endpoint Security 🛡️ Endpoint security

📈 Reporting 📈 Reporting

Wichtige Berichte sind Enrollment Failures, Device Compliance, Endpoint Security Status, App Install Status und Assignment Errors. Für große Rollouts sind Export und Trendanalyse entscheidend. Important reports include enrollment failures, device compliance, endpoint security status, app install status, and assignment errors. Export and trend analysis are essential for large rollouts.

🌐 Graph API deviceManagement 🌐 Graph API deviceManagement

# Beispiel: Managed Devices per Graph lesen
Connect-MgGraph -Scopes "DeviceManagementManagedDevices.Read.All"

Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/v1.0/deviceManagement/managedDevices?$top=10"

# Beispiel: Compliance Policies lesen
Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/v1.0/deviceManagement/deviceCompliancePolicies"

# Beispiel: Mobile Apps lesen
Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/v1.0/deviceAppManagement/mobileApps"

deviceManagement Endpoint ReferenzdeviceManagement endpoint reference

Top 30 Windows CSPsTop 30 Windows CSPs

Wichtige RBAC RollenImportant RBAC roles

Intune Filter SyntaxIntune filter syntax

Connect-MgGraph -Scopes "DeviceManagementManagedDevices.Read.All","DeviceManagementConfiguration.Read.All"
Get-MgDeviceManagementAssignmentFilter | Select-Object DisplayName,Platform,Rule

Proactive RemediationsProactive remediations

Proactive Remediations bestehen aus Detection Script, Remediation Script, Zeitplan, Scope und Reporting. Sie eignen sich für Health Checks, Drift Correction und schnelle Reparaturen ohne vollständige Paketierung.Proactive remediations consist of a detection script, remediation script, schedule, scope, and reporting. They fit health checks, drift correction, and quick repairs without full packaging.

$service = Get-Service -Name w32time
if ($service.Status -ne "Running") { exit 1 }
exit 0

Win32 Packaging GuideWin32 packaging guide

• 1. Quellordner bereinigen und nur benötigte Installationsdateien packen.1. Clean the source folder and package only required installation files.
• 2. Setup-Switches für Silent Install, Detection und Uninstall dokumentieren.2. Document silent install, detection, and uninstall switches.
• 3. IntuneWinAppUtil.exe zum Erzeugen von .intunewin verwenden.3. Use IntuneWinAppUtil.exe to generate the .intunewin package.
• 4. In Intune Detection Rules, Return Codes, Dependencies und Supersedence sauber modellieren.4. Model detection rules, return codes, dependencies, and supersedence cleanly in Intune.

.\IntuneWinAppUtil.exe -c C:\Packageszip -s 7z2301-x64.msi -o C:\Packages\Output

GitHub ReferenzenGitHub references