This repository documents a hands-on Microsoft Intune Endpoint Management Lab built to simulate common enterprise endpoint administration, security, application deployment, compliance, monitoring, and troubleshooting responsibilities.
The project follows a Windows endpoint through the modern management lifecycle:
Environment Setup → Enrollment → Configuration → Compliance → Applications → Updates → Security → BitLocker → Conditional Access → Remote Actions → Monitoring → Troubleshooting
The primary managed endpoint used throughout the project is:
INTUNE-WIN-01
The endpoint was Microsoft Entra joined, enrolled into Microsoft Intune, managed as a corporate Windows device, evaluated against compliance requirements, monitored through Intune reporting, and investigated using both cloud-side and local Windows troubleshooting tools.
This project provides practical portfolio evidence for roles such as:
- IT Support Specialist
- Help Desk Technician
- Desktop Support Technician
- Endpoint Support Technician
- Microsoft 365 Support Specialist
- Junior Systems Administrator
- Microsoft Intune Administrator
- Modern Workplace Support
This lab demonstrates hands-on experience with:
- Microsoft Intune
- Microsoft Entra ID
- Windows device enrollment
- MDM management
- Corporate device administration
- Device and group management
- Configuration profiles
- Compliance policies
- Microsoft Defender
- Windows Defender Firewall
- BitLocker disk encryption
- Windows Update management
- Application deployment
- Company Portal
- Mozilla Firefox deployment
- Conditional Access concepts
- Remote device actions
- Endpoint inventory
- Device compliance reporting
- Windows quality update reporting
- PowerShell diagnostics
- Windows MDM troubleshooting
- Intune Management Extension
- Windows Event Logs
- Enterprise Management scheduled tasks
- MDM enrollment investigation
| Component | Configuration |
|---|---|
| Managed Endpoint | INTUNE-WIN-01 |
| Endpoint OS | Windows 11 Enterprise Evaluation |
| Virtualization | Oracle VirtualBox |
| Endpoint Management | Microsoft Intune |
| Identity Platform | Microsoft Entra ID |
| Device Ownership | Corporate |
| Join Type | Microsoft Entra Joined |
| Management | Mobile Device Management |
| Security | Defender, Firewall, BitLocker |
| Administration | Intune Admin Center, Entra Admin Center, PowerShell |
| Updates | Windows Update for Business / Intune Reporting |
Microsoft Entra ID
|
v
Microsoft Intune
|
+----------------+----------------+
| | |
v v v
Configuration Security Applications
| | |
+----------------+----------------+
|
v
INTUNE-WIN-01
|
+-----------------+------------------+
| | |
v v v
Compliance Monitoring Troubleshooting
| | |
+-----------------+------------------+
|
v
Conditional Access
This architecture demonstrates how identity, endpoint management, security, compliance, software deployment, reporting, and troubleshooting work together in a modern Microsoft environment.
The repository contains 16 primary documentation sections.
| # | Section | Documentation |
|---|---|---|
| 01 | Environment and Tenant Setup | View |
| 02 | Device Enrollment | View |
| 03 | Device and Group Management | View |
| 04 | Configuration Profiles | View |
| 05 | Compliance Policies | View |
| 06 | Application Deployment | View |
| 07 | Windows Update Management | View |
| 08 | Device Management | View |
| 09 | Endpoint Security | View |
| 10 | BitLocker Disk Encryption | View |
| 11 | Device Compliance | View |
| 12 | Conditional Access | View |
| 13 | Application Management | View |
| 14 | Remote Device Actions | View |
| 15 | Monitoring and Reports | View |
| 16 | Troubleshooting | View |
The project began by preparing the Microsoft cloud and Windows lab environment required for endpoint management.
Work included:
- Microsoft tenant preparation
- Intune Admin Center access
- Microsoft Entra administration
- Windows virtual machine preparation
- Endpoint naming
- Administrative environment verification
The primary Windows endpoint was named:
INTUNE-WIN-01
The Windows endpoint was connected to Microsoft Entra ID and enrolled for management.
Enrollment work included:
- Microsoft Entra join
- Intune MDM enrollment
- Corporate ownership verification
- Device registration review
- Local enrollment verification
Local verification used:
dsregcmd /statusImportant results included:
AzureAdJoined : YES
Device Name : INTUNE-WIN-01
DeviceAuthStatus : SUCCESS
This confirmed that the endpoint established a Microsoft Entra device relationship.
The enrolled endpoint was reviewed and managed through Microsoft Intune.
Activities included:
- Device property review
- Device ownership review
- Operating-system review
- Group-based administration
- User and device targeting concepts
- Preparing targets for applications and policies
Group-based management demonstrates how administrators can scale configuration beyond individual devices.
Configuration profiles were used to demonstrate centralized Windows configuration.
The deployment workflow followed:
Create → Configure → Assign → Synchronize → Monitor
Configuration profiles can be used to standardize:
- Windows settings
- Device restrictions
- Security settings
- Authentication settings
- User experience
- Browser configuration
- Administrative templates
Compliance policies were used to evaluate whether the managed endpoint satisfied organizational security requirements.
The project explored requirements involving:
- Secure Boot
- Code integrity
- Operating-system version
- Password requirements
- Firewall
- Antivirus
- Antispyware
- Microsoft Defender
An important distinction demonstrated in the project is:
Configuration profiles configure endpoints.
Compliance policies evaluate endpoints.
Microsoft Intune application deployment was used to demonstrate centralized software delivery.
The workflow included:
Add Application → Configure → Assign → Synchronize → Monitor → Verify
Applications used during the lab included:
- Company Portal
- Mozilla Firefox
This demonstrates how required software can be delivered remotely to managed Windows endpoints.
Windows Update management was used to demonstrate centralized patch-management concepts.
The project covered:
- Windows Update for Business
- Quality updates
- Update policies
- Update monitoring
- Patch-status reporting
- Windows quality update distribution
Later reporting confirmed that the managed endpoint appeared in Intune Windows Update reports.
The project included day-to-day administration of the corporate Windows endpoint.
Activities included:
- Reviewing device properties
- Checking ownership
- Reviewing compliance
- Synchronizing the device
- Reviewing hardware and inventory
- Monitoring applications
- Exploring remote administrative actions
This section represents the ongoing management phase after enrollment.
Microsoft Intune Endpoint Security was used to manage and verify Windows security controls.
Security areas included:
- Microsoft Defender Antivirus
- Windows Defender Firewall
- Secure Boot
- TPM
- BitLocker integration
- Security-policy monitoring
Microsoft Defender status was verified locally with PowerShell.
Example:
Get-MpComputerStatusThe endpoint reported active antivirus and real-time protection.
Windows Firewall was also verified:
Get-NetFirewallProfileDomain, Private, and Public profiles were enabled.
BitLocker was implemented to demonstrate enterprise data-at-rest protection.
The lab included:
- BitLocker policy configuration
- Operating-system drive encryption
- TPM verification
- TPM key protector
- Recovery-password protector
- BitLocker protection verification
- Intune recovery-key escrow verification
Final endpoint verification showed:
VolumeStatus : FullyEncrypted
ProtectionStatus : On
EncryptionPercentage : 100
KeyProtector : {Tpm, RecoveryPassword}
The repository does not publish the actual 48-digit recovery password.
Only non-sensitive recovery-key evidence is retained.
A Windows compliance policy was created and evaluated against the managed endpoint.
The workflow followed:
Define Requirements
↓
Create Policy
↓
Assign Policy
↓
Synchronize Endpoint
↓
Evaluate Device
↓
Review Compliance
The final endpoint state reported:
Compliant
Organization-level Intune reporting later showed:
Compliant devices: 1
Noncompliant devices: 0
Total devices: 1
Microsoft Entra Conditional Access was explored using device compliance as part of the access-control model.
The lab security model included:
- User identity
- Multifactor authentication
- Managed device
- Compliant device
- Conditional Access evaluation
Conceptually:
User
+
MFA
+
Managed Compliant Device
↓
Conditional Access
↓
Access Decision
The Conditional Access configuration was maintained in Report-only mode during testing.
This demonstrated safer policy deployment and reduced the risk of accidental lockout.
Application management extended the earlier deployment work by monitoring software associated with the endpoint.
The project demonstrated:
- Required application assignment
- Application deployment monitoring
- Managed Apps
- Discovered Apps
- Software inventory
- Endpoint verification
Mozilla Firefox was deployed to INTUNE-WIN-01 through Microsoft Intune.
Intune monitoring also showed Company Portal and Firefox associated with required installation intent.
Remote administrative actions were tested from Microsoft Intune.
Actions included:
- Sync
- Restart
- Collect diagnostics
The remote restart request was successfully submitted to Intune but remained:
Pending
The diagnostics collection request also remained:
Pending
These results were preserved exactly as observed rather than represented as completed.
This became the basis for the troubleshooting investigation later in the project.
Microsoft Intune reporting was used to monitor the endpoint after configuration and management activities had been performed.
Monitoring included:
- Managed device overview
- Compliance state
- Default compliance policy details
- Device configuration status
- Managed applications
- Discovered applications
- Organization-level compliance reports
- Windows Update reports
Intune discovered approximately:
58 applications/components
on the managed endpoint.
The device compliance report showed:
Compliant: 1
Noncompliant: 0
Total Devices: 1
Windows quality update reporting showed the endpoint associated with:
2026-08 B
The detailed report displayed:
Total Devices: 1
On This Update or Later: 1
Needs Update: 0
Not Applicable: 0
This demonstrated that endpoint management includes verifying results, not simply deploying settings.
One of the strongest parts of the project was troubleshooting unexpected endpoint-management behavior.
Remote Intune actions remained pending.
Observed states included:
Restart Pending
Collect diagnostics Pending
An Explorer-related Windows error was also observed during the same troubleshooting period.
The investigation used both cloud-side and endpoint-side evidence.
dsregcmd /statusImportant results:
AzureAdJoined : YES
DeviceAuthStatus : SUCCESS
This showed that the device still had a valid Microsoft Entra relationship.
The Intune Management Extension service was checked locally.
The service reported:
Status : Running
StartType : Automatic
This ruled out a stopped Intune Management Extension as the immediate explanation.
Enterprise Management scheduled tasks were inspected.
Multiple MDM enrollment-related task paths were observed.
This became an important troubleshooting clue.
The following registry location was inspected:
HKLM:\SOFTWARE\Microsoft\Enrollments
Multiple GUID-based enrollment entries were present.
These were documented without immediately deleting them.
Windows Device Management Enterprise Diagnostics Provider logs were reviewed.
Repeated MDM-related errors included Event IDs:
404
454
The investigation also reviewed warning and informational events around the same timeframe.
The evidence did not support describing the endpoint as completely disconnected from Intune.
The endpoint simultaneously demonstrated:
- Microsoft Entra joined state
- Successful device authentication
- Running Intune Management Extension
- Intune compliance
- Enterprise Management scheduled tasks
- Multiple MDM enrollment artifacts
- MDM event-log errors
- Pending remote actions
The issue was therefore documented as a management-processing and/or reporting problem without claiming an unverified root cause.
A key support principle demonstrated by this case was:
Collect and correlate evidence before making destructive changes.
The investigation followed a layered process:
1. Observe the symptom
↓
2. Review Intune
↓
3. Verify Microsoft Entra join
↓
4. Verify local management services
↓
5. Inspect MDM scheduled tasks
↓
6. Inspect enrollment information
↓
7. Review Windows event logs
↓
8. Correlate findings
↓
9. Document results
This approach avoids immediately resorting to actions such as:
- Deleting the Intune device
- Removing MDM registry keys
- Deleting scheduled tasks
- Disconnecting the organizational account
- Retiring the endpoint
- Rebuilding the virtual machine
Those actions may sometimes be appropriate, but evidence should be collected first.
The managed device overview shows INTUNE-WIN-01, its ownership, compliance state, management information, and remote-action status.
The organization-level compliance report showed one compliant managed device and zero noncompliant devices.
This report shows Windows quality update distribution across the managed environment.
The detailed report showed that the managed endpoint was on the selected update or later.
Intune reported dozens of discovered applications and Windows components on the managed endpoint.
Local diagnostics confirmed the Microsoft Entra join state and successful device authentication.
The Intune Management Extension service was confirmed running and configured for automatic startup.
Windows MDM event logs were reviewed during the pending remote-action investigation.
The repository also contains 10 simulated endpoint-support tickets documenting common Microsoft Intune support scenarios.
| # | Scenario |
|---|---|
| 001 | Device Enrollment Failure |
| 002 | Noncompliant Device |
| 003 | Application Deployment Failure |
| 004 | Windows Update Failure |
| 005 | BitLocker Recovery |
| 006 | Configuration Profile Conflict |
| 007 | Stale Device |
| 008 | Company Portal Issue |
| 009 | Conditional Access Blocked |
| 010 | Device Retirement |
These tickets demonstrate how Intune administration skills translate into help desk and endpoint-support workflows.
Ticket documentation is stored in:
Help-Desk-Tickets/
The repository includes supporting PowerShell utilities.
Scripts/
├── 01-Device-Inventory.ps1
├── 02-Endpoint-Health-Check.ps1
└── 03-Intune-Troubleshooting.ps1
These scripts support tasks such as:
- Device inventory
- Endpoint health checks
- Intune troubleshooting
- Windows management verification
Examples of commands used during the lab include:
dsregcmd /statusGet-Service IntuneManagementExtensionGet-ScheduledTaskGet-WinEventGet-ChildItem "HKLM:\SOFTWARE\Microsoft\Enrollments"Get-ComputerInfoGet-MpComputerStatusGet-NetFirewallProfileGet-BitLockerVolumeGet-TpmConfirm-SecureBootUEFITest-NetConnection login.microsoftonline.com -Port 443These commands allowed cloud-side Intune information to be compared against the actual Windows endpoint state.
Microsoft-Intune-Endpoint-Management-Lab/
│
├── README.md
│
├── Documentation/
│ ├── 01-Environment-and-Tenant-Setup.md
│ ├── 02-Device-Enrollment.md
│ ├── 03-Device-and-Group-Management.md
│ ├── 04-Configuration-Profiles.md
│ ├── 05-Compliance-Policies.md
│ ├── 06-Application-Deployment.md
│ ├── 07-Windows-Update-Management.md
│ ├── 08-Device-Management.md
│ ├── 09-Endpoint-Security.md
│ ├── 10-BitLocker-Disk-Encryption.md
│ ├── 11-Device-Compliance.md
│ ├── 12-Conditional-Access.md
│ ├── 13-Application-Management.md
│ ├── 14-Remote-Device-Actions.md
│ ├── 15-Monitoring-Reports.md
│ └── 16-Troubleshooting.md
│
├── Help-Desk-Tickets/
│ ├── Ticket-001-Device-Enrollment-Failure.md
│ ├── Ticket-002-Noncompliant-Device.md
│ ├── Ticket-003-Application-Deployment-Failure.md
│ ├── Ticket-004-Windows-Update-Failure.md
│ ├── Ticket-005-BitLocker-Recovery.md
│ ├── Ticket-006-Configuration-Profile-Conflict.md
│ ├── Ticket-007-Stale-Device.md
│ ├── Ticket-008-Company-Portal-Issue.md
│ ├── Ticket-009-Conditional-Access-Blocked.md
│ └── Ticket-010-Device-Retirement.md
│
├── Screenshots/
│ ├── 01-Environment/
│ ├── 02-Enrollment/
│ ├── 03-Devices/
│ ├── 04-Configuration-Profiles/
│ ├── 05-Compliance/
│ ├── 06-Applications/
│ ├── 07-Windows-Updates/
│ ├── 08-Device-Management/
│ ├── 09-Endpoint-Security/
│ ├── 10-BitLocker/
│ ├── 11-Compliance/
│ ├── 12-Conditional-Access/
│ ├── 13-Application-Management/
│ ├── 14-Remote-Actions/
│ ├── 15-Monitoring-Reports/
│ └── 16-Troubleshooting/
│
├── Scripts/
│ ├── 01-Device-Inventory.ps1
│ ├── 02-Endpoint-Health-Check.ps1
│ └── 03-Intune-Troubleshooting.ps1
│
├── Diagrams/
├── Reports/
└── .gitignore
The project contains more than 120 screenshots documenting configuration, verification, monitoring, and troubleshooting.
Evidence is organized by section rather than stored in one large folder.
This creates a clear workflow:
Documentation → Configuration → Screenshot Evidence → Verification
The project intentionally preserves both successful and unsuccessful results.
Examples include:
- Successful Microsoft Entra join
- Successful Intune management
- Successful device compliance
- Successful BitLocker encryption
- Successful application deployment evidence
- Successful Windows Update reporting
- Pending remote actions
- MDM event-log errors
- Empty configuration reporting
Preserving unexpected results demonstrates troubleshooting ability rather than presenting the lab as a collection of perfect screenshots.
Through this project, I:
- Built a Microsoft Intune endpoint-management lab
- Created and managed a Windows enterprise endpoint
- Joined a Windows endpoint to Microsoft Entra ID
- Enrolled the endpoint into Microsoft Intune
- Managed the endpoint as a corporate device
- Worked with device and group management
- Created and reviewed configuration profiles
- Created compliance policies
- Verified Microsoft Defender protection
- Verified Windows Defender Firewall protection
- Configured and troubleshot BitLocker
- Verified TPM and Secure Boot
- Deployed and monitored applications
- Worked with Company Portal
- Deployed Mozilla Firefox
- Managed Windows Update settings
- Generated Windows quality update reports
- Explored Conditional Access with compliant-device requirements
- Issued Intune remote device actions
- Monitored remote-action status
- Reviewed discovered application inventory
- Generated compliance reports
- Verified Microsoft Entra join using
dsregcmd - Verified Intune Management Extension health
- Inspected Enterprise Management scheduled tasks
- Investigated MDM enrollment registry entries
- Reviewed Windows MDM event logs
- Documented MDM-related errors
- Created 10 simulated help desk tickets
- Created supporting PowerShell scripts
- Built a documented troubleshooting case study
The skills demonstrated in this repository map directly to common endpoint-support scenarios.
Potential investigation:
- Verify enrollment
- Review Intune check-in
- Review policy assignment
- Verify Microsoft Entra join
- Review MDM event logs
- Inspect Enterprise Management tasks
Potential investigation:
- Review Managed Apps
- Verify assignment
- Check Intune Management Extension
- Synchronize device
- Review deployment status
- Verify endpoint installation
Potential investigation:
- Review compliance policy
- Identify failed requirement
- Verify Defender
- Verify Firewall
- Verify Secure Boot
- Verify BitLocker
- Synchronize and recheck
Potential investigation:
- Verify identity
- Verify MFA
- Review device compliance
- Review Conditional Access policy
- Confirm managed-device state
Potential investigation:
- Review device action status
- Review last check-in
- Verify network connectivity
- Verify Microsoft Entra join
- Check Intune Management Extension
- Inspect MDM tasks
- Review event logs
This project reinforced that modern endpoint administration requires multiple technologies working together.
Identity
+
Enrollment
+
Configuration
+
Security
+
Compliance
+
Applications
+
Updates
+
Monitoring
+
Troubleshooting
A device simply appearing in Microsoft Intune does not prove that every management function is operating correctly.
Likewise, one error does not prove that the entire enrollment is broken.
Effective troubleshooting requires comparing cloud-side management information with the actual Windows endpoint state.
Collect evidence before deleting enrollment information, removing the device, or rebuilding Windows.
If a remote action remains pending, document it as pending.
Useful evidence can come from:
- Microsoft Intune
- Microsoft Entra ID
- Windows Services
- Scheduled Tasks
- Registry
- Event Logs
- PowerShell
Real troubleshooting evidence is often more valuable than another successful configuration screenshot.
The repository does not expose the actual BitLocker recovery password.
Recovery-key screenshots retain only non-sensitive evidence such as the Key ID and escrow status.
This lab provides practical evidence relevant to:
- Help Desk
- IT Support
- Desktop Support
- Endpoint Support
- Microsoft 365 Support
- Microsoft Intune
- Microsoft Entra ID
- Windows Administration
- Modern Workplace Support
- Junior Systems Administration
The project demonstrates more than portal navigation.
It demonstrates the ability to:
Configure → Manage → Secure → Monitor → Troubleshoot → Document
a modern Windows endpoint using Microsoft cloud-management technologies.
Potential future extensions include:
- Additional managed Windows endpoints
- Dynamic Microsoft Entra groups
- Windows Autopilot
- Additional Win32 application deployments
- Security baselines
- Attack Surface Reduction policies
- Microsoft Defender for Endpoint integration
- Additional Conditional Access scenarios
- Remediation scripts
- Additional Windows Update rings
- Feature update policies
- Multi-device compliance reporting
- Additional help desk cases
The Microsoft Intune Endpoint Management Lab demonstrates the lifecycle of a managed Windows endpoint from enrollment through administration, security, compliance, application deployment, Windows Update reporting, remote management, monitoring, and troubleshooting.
The project combines:
Microsoft Intune + Microsoft Entra ID + Windows 11 + PowerShell
and demonstrates practical experience with modern enterprise endpoint support and administration.