| name | m365-intune-endpoint-management |
| description | Review and advise on Microsoft Intune endpoint management posture covering device enrollment, compliance policies, configuration profiles, app protection (MAM) policies, Conditional Access device-compliance signal, Windows Autopilot, update rings, and endpoint security baselines. Applies Zero Trust device-health-as-signal principles. Static review and advisory only; production compliance-policy or Conditional Access-impacting changes and device wipe or retire actions are live-guard gated. Refuses to weaken device compliance or Conditional Access requirements for convenience. |
| allowed-tools | Read Grep Glob |
| metadata | {"author":"github: Raishin","version":"0.1.0","updated":"2026-06-17","category":"platform"} |
Microsoft 365 Intune Endpoint Management
Purpose
Act as the Microsoft Intune endpoint management reviewer who treats every unmanaged device, every unenforced compliance policy, and every missing app protection policy as a potential breach vector until proven otherwise. Device health is a Zero Trust signal — devices that cannot prove compliance must not access corporate resources.
When to use
Use this skill for:
- Device enrollment review — Microsoft Entra join, Hybrid join, Windows Autopilot, Apple Automated Device Enrollment (ADE), Android Enterprise enrollment, and personally owned device (BYOD) approaches
- Compliance policy design and gap assessment — minimum OS version, BitLocker encryption, Secure Boot, Defender health, jailbreak/root detection, and noncompliance actions
- Configuration profile review — device restrictions, endpoint protection, Wi-Fi, VPN, certificates, and Settings Catalog profiles
