{
  "projects/windows-autopilot-intune": {
    "title": "Windows Autopilot & Intune MDM Provisioning",
    "description": "Physical-device provisioning through branded OOBE, ESP, Entra join, security policy, and final Intune compliance.",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Project 11 / Endpoint management</p><h1>Windows Autopilot &amp; Intune MDM Provisioning</h1><p class=\"lead\">Physical-device provisioning through branded OOBE, ESP, Entra join, security policy, and final Intune compliance.</p><div class=\"tags\"><span class=\"status\">COMPLETE</span><span class=\"tag\">Validated lab work</span></div><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/tree/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/windows-autopilot-intune/\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">GitHub documentation <span aria-hidden=\"true\">↗</span></a><a href=\"https://jeremyfontenot.online/windows-autopilot-intune.html\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original portfolio <span aria-hidden=\"true\">↗</span></a><a href=\"#evidence\" data-route=\"evidence\" class=\"\">Evidence library</a></div></div><div class=\"case-layout\"><aside class=\"case-toc\"><p class=\"eyebrow\">Inside this case study</p><a href=\"#overview\" data-anchor=\"overview\">Overview</a><a href=\"#scenario\" data-anchor=\"scenario\">Operational scenario & objectives</a><a href=\"#environment\" data-anchor=\"environment\">Environment & technologies</a><a href=\"#architecture\" data-anchor=\"architecture\">Architecture</a><a href=\"#implementation\" data-anchor=\"implementation\">Implementation & administration</a><a href=\"#troubleshooting\" data-anchor=\"troubleshooting\">Troubleshooting</a><a href=\"#validation\" data-anchor=\"validation\">Validation & results</a><a href=\"#evidence\" data-anchor=\"evidence\">Evidence</a><a href=\"#skills\" data-anchor=\"skills\">Skills demonstrated</a><a href=\"#limitations\" data-anchor=\"limitations\">Limitations & claim boundaries</a><a href=\"#next\" data-anchor=\"next\">Next milestones</a></aside><article><section class=\"content-block\" id=\"overview\"><h2>Overview</h2><p>Physical-device provisioning through branded OOBE, ESP, Entra join, security policy, and final Intune compliance.</p><p><strong>Classification:</strong> Validated lab work.</p></section><section class=\"content-block\" id=\"scenario\"><h2>Operational scenario & objectives</h2><p>Provision a standard-user endpoint, apply required applications and security policies, remediate Secure Boot, and validate compliant management.</p></section><section class=\"content-block\" id=\"environment\"><h2>Environment & technologies</h2><p>Personal physical Windows device, Microsoft 365 developer tenant, assigned Autopilot profile, pilot groups, and Intune policy.</p><div class=\"tags\"><span class=\"tag\">Autopilot</span><span class=\"tag\">Intune</span><span class=\"tag\">Entra join</span><span class=\"tag\">BitLocker</span></div></section><section class=\"content-block\" id=\"architecture\"><h2>Architecture</h2><p>Personal physical Windows device, Microsoft 365 developer tenant, assigned Autopilot profile, pilot groups, and Intune policy.</p><div class=\"doc-grid\"><a href=\"#documentation/88c6903486ec\" data-route=\"documentation/88c6903486ec\" class=\"\">Architecture<small>projects/windows-autopilot-intune/architecture.md</small></a></div></section><section class=\"content-block\" id=\"implementation\"><h2>Implementation & administration</h2><div class=\"imported\"><section class=\"page-hero\"><div class=\"wrap\"><p class=\"eyebrow\">M365 Lab Project 01 · COMPLETE</p><h2>Windows Autopilot &amp; Intune MDM Provisioning</h2><p class=\"lead\">A live physical-device Autopilot deployment demonstrating user-driven Microsoft Entra join, Intune enrollment, branded OOBE, ESP enforcement, required apps, endpoint security, compliance troubleshooting, and post-enrollment validation.</p><div class=\"actions\"><a class=\"button primary\" data-route=\"projects\" href=\"#projects\">Back to projects</a><a class=\"button\" data-route=\"evidence\" href=\"#evidence\">Review proof index</a></div></div></section><section class=\"section\"><div class=\"wrap\"><div class=\"metric-strip\"><div class=\"metric\"><strong>Entra joined</strong><span>Join</span></div><div class=\"metric\"><strong>Intune</strong><span>MDM</span></div><div class=\"metric\"><strong>100%</strong><span>BitLocker</span></div><div class=\"metric\"><strong>Compliant</strong><span>Final state</span></div></div></div></section><section class=\"section\"><div class=\"wrap case-layout\"><article><section class=\"content-block\" id=\"source-f37b0c42-scope\"><p class=\"eyebrow\">Scope</p><h2>Physical endpoint, controlled pilot</h2><p>A registered physical Lenovo endpoint was targeted through dedicated pilot user and device groups. The deployment used a user-driven Microsoft Entra join profile and intentionally kept the enrolled user as a standard user.</p></section><section class=\"content-block\" id=\"source-f37b0c42-enrollment\"><p class=\"eyebrow\">Enrollment</p><h2>Autopilot profile, branding, and ESP</h2><p>The device retrieved the assigned Autopilot profile during OOBE, displayed custom Jeremy Fontenot IT Lab branding, joined Microsoft Entra ID, enrolled into Intune, and completed the configured Enrollment Status Page workflow.</p></section><section class=\"content-block\" id=\"source-f37b0c42-apps\"><p class=\"eyebrow\">Applications</p><h2>Required Microsoft 365 Apps</h2><p>Microsoft 365 Apps was configured as a required ESP blocking application. Post-enrollment validation confirmed O365ProPlusRetail on the x64 Click-to-Run platform.</p></section><section class=\"content-block\" id=\"source-f37b0c42-security\"><p class=\"eyebrow\">Security</p><h2>Compliance and Settings Catalog</h2><p>Compliance and Settings Catalog controls validated BitLocker, TPM, Defender, real-time protection, Windows Firewall, Virtualization Based Security, Secure Boot, storage encryption, and code integrity. The final Intune device state is Compliant.</p></section><section class=\"content-block\" id=\"source-f37b0c42-troubleshooting\"><p class=\"eyebrow\">Troubleshooting</p><h2>Secure Boot and administrative elevation</h2><p>The first compliance evaluation reported BitLocker and Secure Boot as noncompliant. Endpoint evidence showed BitLocker was already fully encrypted while Secure Boot was disabled in firmware. Secure Boot was enabled, Intune was synchronized, and compliance cleared. A separate Entra Device Administrators assignment provided administrative elevation while preserving the pilot user as standard.</p></section><section class=\"content-block\" id=\"source-f37b0c42-validation\"><p class=\"eyebrow\">Validation</p><h2>Endpoint and management-plane proof</h2><p>Validation combined dsregcmd, EnterpriseMgmt scheduled tasks, Microsoft 365 Apps state, manage-bde, Defender, firewall, VBS, Secure Boot, Intune compliance, and Settings Catalog check-in status. Public evidence is sanitized to exclude secrets and unique device identifiers.</p></section><section class=\"content-block\" id=\"source-f37b0c42-lifecycle\"><p class=\"eyebrow\">Device lifecycle</p><h2>Controlled return to the on-premises AD lab</h2><p>After the Autopilot pilot was completed and its evidence preserved, the same physical endpoint was intentionally repurposed as LT-JF01 in the on-premises AD DS lab. The later state was validated with domain authentication, secure channel, DC discovery, domain time, Group Policy, SMB, RPC, VPN transport, and RDP. This lifecycle state is documented separately and does not replace the historical Autopilot result.</p></section><section class=\"content-block\" id=\"source-f37b0c42-evidence\"><p class=\"eyebrow\">Evidence</p><h2>Sanitized validation</h2><ul class=\"evidence-list\"><li><a href=\"https://jeremyfontenot.online/projects/windows-autopilot-intune/evidence/\" rel=\"noopener noreferrer\" target=\"_blank\">Evidence index<span>Sanitized screenshots and command outputs</span></a></li><li><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/windows-autopilot-intune/evidence/screenshots/01-autopilot-branded-oobe.webp\" rel=\"noopener noreferrer\" target=\"_blank\">Branded OOBE<span>Tenant-branded work/school Autopilot sign-in</span></a></li><li><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/windows-autopilot-intune/evidence/screenshots/03-esp-device-setup-complete.webp\" rel=\"noopener noreferrer\" target=\"_blank\">ESP progress<span>Device preparation and setup completed</span></a></li><li><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/windows-autopilot-intune/evidence/screenshots/05-intune-final-compliant.webp\" rel=\"noopener noreferrer\" target=\"_blank\">Final compliance<span>Intune reports the corporate device compliant</span></a></li><li><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/windows-autopilot-intune/evidence/screenshots/06-settings-catalog-success.webp\" rel=\"noopener noreferrer\" target=\"_blank\">Settings Catalog<span>Two succeeded with zero errors or conflicts</span></a></li><li><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/main/projects/windows-autopilot-intune/validation.md\" rel=\"noopener noreferrer\" target=\"_blank\">Validation record<span>Autopilot results plus post-project AD lifecycle validation</span></a></li></ul></section></article><aside class=\"case-nav panel\"><p class=\"eyebrow\">Case study</p><a data-route=\"projects/windows-autopilot-intune\" href=\"#projects/windows-autopilot-intune\">Physical endpoint, controlled pilot</a><a data-route=\"projects/windows-autopilot-intune\" href=\"#projects/windows-autopilot-intune\">Autopilot profile, branding, and ESP</a><a data-route=\"projects/windows-autopilot-intune\" href=\"#projects/windows-autopilot-intune\">Required Microsoft 365 Apps</a><a data-route=\"projects/windows-autopilot-intune\" href=\"#projects/windows-autopilot-intune\">Compliance and Settings Catalog</a><a data-route=\"projects/windows-autopilot-intune\" href=\"#projects/windows-autopilot-intune\">Secure Boot and administrative elevation</a><a data-route=\"projects/windows-autopilot-intune\" href=\"#projects/windows-autopilot-intune\">Endpoint and management-plane proof</a><a data-route=\"projects/windows-autopilot-intune\" href=\"#projects/windows-autopilot-intune\">Controlled return to the on-premises AD lab</a><a data-route=\"projects/windows-autopilot-intune\" href=\"#projects/windows-autopilot-intune\">Validation links</a></aside></div></section></div><details><summary>Windows Autopilot &amp; Intune MDM Provisioning <small> / README.md</small></summary><div class=\"document\"><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/windows-autopilot-intune/README.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original source <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation/c9a874b41c67\" data-route=\"documentation/c9a874b41c67\" class=\"\">Open document page</a></div><h2>Windows Autopilot &amp; Intune MDM Provisioning</h2>\n<p><strong>Status:</strong> COMPLETE<br/>\n<strong>Completion date:</strong> 2026-09-22</p>\n<h2>Project objective</h2>\n<p>Build and validate a portfolio-quality Windows Autopilot and Microsoft Intune pilot demonstrating device registration, user-driven Microsoft Entra join, automatic Intune enrollment, branded OOBE, Enrollment Status Page controls, required Microsoft 365 Apps deployment, compliance evaluation, BitLocker, Microsoft Defender, Windows Firewall, Virtualization Based Security, Secure Boot, and post-enrollment management.</p>\n<h2>Environment</h2>\n<ul>\n<li>Microsoft Entra verified domain: <code>jeremyfontenot.online</code></li>\n<li>On-premises AD DS domain: <code>ad.jeremyfontenot.online</code></li>\n<li>Autopilot mode: user-driven</li>\n<li>Join type: Microsoft Entra joined</li>\n<li>Pilot user group: <code>SG-Intune-Autopilot-Pilot-Users</code></li>\n<li>Pilot device group: <code>SG-Intune-Autopilot-Pilot-Devices</code></li>\n<li>Autopilot deployment profile: <code>AP UserDriven EntraJoin Pilot</code></li>\n<li>Enrollment Status Page: <code>ESP Autopilot Pilot</code></li>\n<li>Required application: <code>M365 Apps Autopilot Pilot</code></li>\n<li>Compliance policy: <code>Compliance Windows Autopilot Pilot</code></li>\n<li>Security configuration: <code>Config Windows Autopilot Security Pilot</code></li>\n</ul>\n<h2>End-to-end result</h2>\n<p>A registered physical Lenovo endpoint was safely backed up, reset to Windows OOBE, and successfully completed the live Windows Autopilot deployment flow.</p>\n<p>Validated outcomes include branded OOBE, Microsoft Entra join, Intune MDM enrollment, Enrollment Status Page completion, required Microsoft 365 Apps deployment, BitLocker, Defender, Windows Firewall, VBS, Secure Boot remediation, final Intune compliance, Settings Catalog success, and a separate administrative elevation path while the Autopilot user remained standard.</p>\n<h2>Security and evidence handling</h2>\n<p>Public evidence excludes passwords, recovery keys, MFA codes, private SSH keys, OpenVPN credentials, 1Password recovery material, browser password exports, and other secrets. Unique hardware and directory identifiers are redacted from public screenshots and command output.</p>\n<p>See <a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/windows-autopilot-intune/evidence/README.md\" rel=\"noopener noreferrer\" target=\"_blank\">evidence/README.md</a> for the evidence index.</p></div></details><details><summary>Architecture <small> / architecture.md</small></summary><div class=\"document\"><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/windows-autopilot-intune/architecture.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original source <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation/88c6903486ec\" data-route=\"documentation/88c6903486ec\" class=\"\">Open document page</a></div><h2>Architecture</h2>\n<h2>Logical design</h2>\n<p>The pilot separates user-scoped enrollment enablement from device-scoped Autopilot configuration.</p>\n<h3>User scope</h3>\n<p><code>SG-Intune-Autopilot-Pilot-Users</code> scopes automatic Intune MDM enrollment to the pilot.</p>\n<h3>Device scope</h3>\n<p><code>SG-Intune-Autopilot-Pilot-Devices</code> targets the Autopilot deployment profile, Enrollment Status Page, Microsoft 365 Apps required deployment, compliance policy, and Windows Settings Catalog security configuration.</p>\n<h2>Runtime flow</h2>\n<ol>\n<li>Device hardware identity is registered with Windows Autopilot.</li>\n<li>The device receives the user-driven Microsoft Entra join profile.</li>\n<li>Tenant branding is displayed during OOBE.</li>\n<li>The pilot user authenticates and the device joins Microsoft Entra ID.</li>\n<li>Automatic Intune MDM enrollment occurs.</li>\n<li>Enrollment Status Page blocks completion while required configuration and Microsoft 365 Apps are processed.</li>\n<li>The device reaches the Windows desktop.</li>\n<li>Endpoint-side PowerShell and Intune portal evidence validate the resulting security state and compliance.</li>\n</ol>\n<h2>Security controls</h2>\n<p>The compliance policy evaluates BitLocker, Secure Boot, code integrity, storage encryption, Windows Firewall, TPM, antivirus, antispyware, Microsoft Defender Antimalware, current security intelligence, and real-time protection.</p>\n<p>The Settings Catalog profile applies BitLocker/device encryption settings, Defender protections, PUA blocking, VBS, and Windows Firewall enablement for Domain, Private, and Public profiles.</p>\n<p>The enrolled pilot user remains a standard user. Administrative elevation is provided separately through the Microsoft Entra Device Administrators role.</p></div></details><details><summary>Project 1 Evidence Index <small> / README.md</small></summary><div class=\"document\"><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/windows-autopilot-intune/evidence/README.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original source <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation/caff97cd6e46\" data-route=\"documentation/caff97cd6e46\" class=\"\">Open document page</a></div><h2>Project 1 Evidence Index</h2>\n<p>Public evidence is sanitized. Passwords, recovery keys, MFA codes, private keys, VPN configuration contents, browser password exports, recovery codes, device IDs, certificate thumbprints, and hardware serial numbers are excluded or redacted.</p>\n<h2>Screenshots</h2>\n<ol>\n<li><code>screenshots/01-autopilot-branded-oobe.webp</code> — Autopilot retrieved the tenant experience and displayed custom work/school branding.</li>\n<li><code>screenshots/02-esp-device-preparation.webp</code> — Enrollment Status Page began device preparation.</li>\n<li><code>screenshots/03-esp-device-setup-complete.webp</code> — Device preparation and device setup completed while account setup continued.</li>\n<li><code>screenshots/04-compliance-before-remediation.webp</code> — Compliance policy identified BitLocker and Secure Boot as not compliant; device identifier redacted.</li>\n<li><code>screenshots/05-intune-final-compliant.webp</code> — Final Intune inventory showed the corporate device compliant; device identifier and UPN redacted.</li>\n<li><code>screenshots/06-settings-catalog-success.webp</code> — Settings Catalog check-in reported 2 succeeded, 0 errors, 0 conflicts, 0 not applicable, 0 in progress.</li>\n</ol>\n<h2>Command evidence</h2>\n<ul>\n<li><code>01-dsregcmd-sanitized.txt</code></li>\n<li><code>02-intune-enterprisemgmt-tasks-sanitized.txt</code></li>\n<li><code>03-m365-apps-validation.txt</code></li>\n<li><code>04-bitlocker-validation.txt</code></li>\n<li><code>05-defender-validation.txt</code></li>\n<li><code>06-firewall-vbs-secureboot-validation.txt</code></li>\n</ul>\n<p>See <a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/windows-autopilot-intune/validation.md\" rel=\"noopener noreferrer\" target=\"_blank\">validation.md</a> for the consolidated validation matrix.</p></div></details><details><summary>Implementation <small> / implementation.md</small></summary><div class=\"document\"><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/windows-autopilot-intune/implementation.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original source <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation/441b5a30fb0a\" data-route=\"documentation/441b5a30fb0a\" class=\"\">Open document page</a></div><h2>Implementation</h2>\n<h2>1. Pilot-scoped automatic MDM enrollment</h2>\n<p>Automatic Intune enrollment was scoped to <code>SG-Intune-Autopilot-Pilot-Users</code>.</p>\n<h2>2. Autopilot registration and targeting</h2>\n<p>A physical Lenovo endpoint was registered with Windows Autopilot and added to <code>SG-Intune-Autopilot-Pilot-Devices</code>. The device later reported the deployment profile as assigned.</p>\n<h2>3. User-driven Microsoft Entra join</h2>\n<p><code>AP UserDriven EntraJoin Pilot</code> was configured for user-driven Microsoft Entra join, standard-user provisioning, and the device naming template <code>AP-%SERIAL%</code>.</p>\n<h2>4. Microsoft Entra branding</h2>\n<p>Custom background, banner, square logo, sign-in hint, and lab-specific sign-in text were configured and observed during live OOBE.</p>\n<h2>5. Enrollment Status Page</h2>\n<p><code>ESP Autopilot Pilot</code> displayed provisioning progress and blocked completion while the required application and device configuration were processed.</p>\n<h2>6. Microsoft 365 Apps</h2>\n<p><code>M365 Apps Autopilot Pilot</code> was required for the pilot device group. Post-enrollment validation confirmed <code>O365ProPlusRetail</code> on x64 Click-to-Run.</p>\n<h2>7. Compliance and remediation</h2>\n<p><code>Compliance Windows Autopilot Pilot</code> initially reported BitLocker and Secure Boot as noncompliant. Local validation showed BitLocker was already fully encrypted while Secure Boot was disabled. Secure Boot was enabled in firmware and Intune was synchronized; the device then reported compliant.</p>\n<h2>8. Security configuration</h2>\n<p><code>Config Windows Autopilot Security Pilot</code> applied BitLocker, Defender, firewall, PUA, and VBS controls. Final Intune check-in status showed 2 succeeded, 0 errors, 0 conflicts, 0 not applicable, and 0 in progress.</p>\n<h2>9. Administrative access</h2>\n<p>The Autopilot user remained a standard user. A separate tenant administrator was assigned the Microsoft Entra Device Administrators role. UAC elevation was validated before running administrative endpoint checks.</p>\n<h2>10. Safe reset preparation</h2>\n<p>Before destructive reset, selected lab/business data and recovery-critical configuration were backed up to an SMB share. Secret-bearing recovery files are intentionally excluded from this public repository.</p></div></details><details><summary>Lessons Learned <small> / lessons-learned.md</small></summary><div class=\"document\"><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/windows-autopilot-intune/lessons-learned.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original source <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation/157441b450a2\" data-route=\"documentation/157441b450a2\" class=\"\">Open document page</a></div><h2>Lessons Learned</h2>\n<ol>\n<li>Pilot-scoped groups reduce blast radius and simplify troubleshooting.</li>\n<li>Assigned or Active is not proof of endpoint enforcement; validate the resulting device state.</li>\n<li>End-to-end validation matters more than portal configuration screenshots.</li>\n<li>Backup and recovery readiness are part of change management for destructive enrollment testing.</li>\n<li>Keep normal users standard and provide a separate administrative elevation path.</li>\n<li><code>runas</code> is not the same as UAC elevation; validate the actual token.</li>\n<li>Troubleshoot compliance from both endpoint evidence and the Intune management plane.</li>\n<li>Firmware settings such as Secure Boot can determine cloud compliance.</li>\n<li>Endpoint-side PowerShell plus Intune portal status provides stronger evidence than either source alone.</li>\n<li>Never publish recovery codes, private keys, VPN profiles, browser password exports, or BitLocker recovery values.</li>\n</ol></div></details><details><summary>Portfolio Summary <small> / portfolio-summary.md</small></summary><div class=\"document\"><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/windows-autopilot-intune/portfolio-summary.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original source <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation/826296edbb04\" data-route=\"documentation/826296edbb04\" class=\"\">Open document page</a></div><h2>Portfolio Summary</h2>\n<h2>Windows Autopilot &amp; Intune MDM Provisioning</h2>\n<p>Implemented and validated an end-to-end Windows Autopilot deployment using Microsoft Intune and Microsoft Entra ID.</p>\n<p>The project uses dedicated pilot user/device groups, user-driven Microsoft Entra join, automatic Intune MDM enrollment, custom Entra branding, Enrollment Status Page controls, required Microsoft 365 Apps deployment, Windows compliance, and a Settings Catalog security baseline.</p>\n<p>A registered physical Lenovo endpoint was safely backed up, reset to OOBE, and provisioned through the live Autopilot workflow. Post-enrollment validation confirmed Entra join, Intune management, Microsoft 365 Apps, BitLocker, Defender, Windows Firewall, VBS, Secure Boot, and final Intune compliance.</p>\n<p>A real compliance issue was identified and remediated: Secure Boot was disabled in firmware. After enabling Secure Boot and synchronizing the endpoint, Intune reported the device compliant.</p>\n<p>The Autopilot user remains a standard user. Administrative elevation is provided separately through the Microsoft Entra Device Administrators role.</p>\n<p><strong>Status: COMPLETE</strong></p></div></details><details><summary>Troubleshooting <small> / troubleshooting.md</small></summary><div class=\"document\"><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/windows-autopilot-intune/troubleshooting.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original source <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation/78b356285468\" data-route=\"documentation/78b356285468\" class=\"\">Open document page</a></div><h2>Troubleshooting</h2>\n<h2>Autopilot profile propagation</h2>\n<p>Profile assignment did not appear immediately. A service sync and propagation wait were used before the device reported <code>Assigned</code>.</p>\n<h2>ESP assignment display</h2>\n<p>An ESP assignment temporarily appeared stale/soft-deleted even though the target group existed. Refreshing the portal restored the correct Active state without rebuilding the group.</p>\n<h2>Branding asset limits</h2>\n<p>The original background exceeded Microsoft Entra upload limits. It was recompressed while retaining the required dimensions.</p>\n<h2>Safe backup before reset</h2>\n<p>Because the Autopilot target was also the administrative laptop, destructive reset was delayed until a dedicated SMB backup target and independent OpenVPN recovery path were validated.</p>\n<h2>Standard user and elevation</h2>\n<p>The Autopilot profile intentionally created a standard user. BitLocker management commands failed from the standard session. Assigning a separate Entra account to Device Administrators provided the supported administrative path. A filtered <code>runas</code> token still showed the Administrators SID as deny-only; a true UAC elevation produced an enabled Administrators token.</p>\n<h2>Initial compliance failure</h2>\n<p>The first compliance report showed BitLocker and Secure Boot as not compliant. Local BitLocker validation showed the OS volume was already fully encrypted. <code>Confirm-SecureBootUEFI</code> returned <code>False</code>, identifying the real firmware gap. Secure Boot was enabled in UEFI, then an Intune sync was performed. Final compliance changed to <code>Compliant</code>.</p>\n<h2>Management boundary</h2>\n<p>After Autopilot, the endpoint is Microsoft Entra joined and Intune-managed rather than AD DS domain joined. Intune/MDM is the authoritative management path for this project endpoint.</p></div></details><details><summary>Validation <small> / validation.md</small></summary><div class=\"document\"><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/windows-autopilot-intune/validation.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original source <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation/552a8ca8fcd7\" data-route=\"documentation/552a8ca8fcd7\" class=\"\">Open document page</a></div><h2>Validation</h2>\n<h2>Final validation matrix</h2>\n<div class=\"table-scroll\"><table>\n<thead>\n<tr>\n<th>Component</th>\n<th>Evidence</th>\n<th>Status</th>\n</tr>\n</thead>\n<tbody>\n<tr>\n<td>Autopilot profile</td>\n<td>Registered device received assigned profile</td>\n<td>COMPLETE</td>\n</tr>\n<tr>\n<td>Branded OOBE</td>\n<td>Custom lab sign-in displayed</td>\n<td>COMPLETE</td>\n</tr>\n<tr>\n<td>Microsoft Entra join</td>\n<td><code>AzureAdJoined : YES</code>, <code>DomainJoined : NO</code></td>\n<td>COMPLETE</td>\n</tr>\n<tr>\n<td>Device authentication</td>\n<td><code>DeviceAuthStatus : SUCCESS</code>, TPM protected</td>\n<td>COMPLETE</td>\n</tr>\n<tr>\n<td>SSO</td>\n<td><code>AzureAdPrt : YES</code></td>\n<td>COMPLETE</td>\n</tr>\n<tr>\n<td>Intune MDM enrollment</td>\n<td>EnterpriseMgmt scheduled tasks present</td>\n<td>COMPLETE</td>\n</tr>\n<tr>\n<td>Device naming</td>\n<td>Autopilot naming template applied</td>\n<td>COMPLETE</td>\n</tr>\n<tr>\n<td>ESP</td>\n<td>Device preparation/setup/account setup completed</td>\n<td>COMPLETE</td>\n</tr>\n<tr>\n<td>Microsoft 365 Apps</td>\n<td><code>O365ProPlusRetail</code>, x64</td>\n<td>COMPLETE</td>\n</tr>\n<tr>\n<td>BitLocker</td>\n<td>Fully encrypted, 100%, Protection On</td>\n<td>COMPLETE</td>\n</tr>\n<tr>\n<td>Defender</td>\n<td>Antivirus, antispyware, real-time, behavior, IOAV enabled</td>\n<td>COMPLETE</td>\n</tr>\n<tr>\n<td>Windows Firewall</td>\n<td>Domain, Private, Public enabled</td>\n<td>COMPLETE</td>\n</tr>\n<tr>\n<td>VBS</td>\n<td><code>VirtualizationBasedSecurityStatus : 2</code></td>\n<td>COMPLETE</td>\n</tr>\n<tr>\n<td>Secure Boot</td>\n<td><code>Confirm-SecureBootUEFI</code> returned <code>True</code> after remediation</td>\n<td>COMPLETE</td>\n</tr>\n<tr>\n<td>Compliance</td>\n<td>Intune device state <code>Compliant</code></td>\n<td>COMPLETE</td>\n</tr>\n<tr>\n<td>Settings Catalog</td>\n<td>2 succeeded; 0 error/conflict/not-applicable/in-progress</td>\n<td>COMPLETE</td>\n</tr>\n<tr>\n<td>Standard-user posture</td>\n<td>Pilot user non-admin; separate elevation path validated</td>\n<td>COMPLETE</td>\n</tr>\n</tbody>\n</table></div>\n<h2>Sanitized command highlights</h2>\n<h3>Entra join and SSO</h3>\n<pre><code class=\"language-text\">AzureAdJoined : YES\nEnterpriseJoined : NO\nDomainJoined : NO\nDeviceAuthStatus : SUCCESS\nTpmProtected : YES\nAzureAdPrt : YES\n</code></pre>\n<h3>Microsoft 365 Apps</h3>\n<pre><code class=\"language-text\">ProductReleaseIds : O365ProPlusRetail\nPlatform          : x64\n</code></pre>\n<h3>BitLocker</h3>\n<pre><code class=\"language-text\">Conversion Status    : Fully Encrypted\nPercentage Encrypted : 100.0%\nEncryption Method    : XTS-AES 128\nProtection Status    : Protection On\nKey Protectors       : Numerical Password, TPM\n</code></pre>\n<h3>Defender</h3>\n<pre><code class=\"language-text\">AntivirusEnabled          : True\nAntispywareEnabled        : True\nRealTimeProtectionEnabled : True\nBehaviorMonitorEnabled    : True\nIoavProtectionEnabled     : True\n</code></pre>\n<h3>Firewall</h3>\n<pre><code class=\"language-text\">Domain  True\nPrivate True\nPublic  True\n</code></pre>\n<h3>VBS</h3>\n<pre><code class=\"language-text\">VirtualizationBasedSecurityStatus : 2\n</code></pre>\n<h3>Secure Boot</h3>\n<pre><code class=\"language-text\">Confirm-SecureBootUEFI\nTrue\n</code></pre>\n<p>No recovery keys, passwords, tokens, device IDs, certificate thumbprints, or hardware serial numbers are included.</p></div></details></section><section class=\"content-block\" id=\"troubleshooting\"><h2>Troubleshooting</h2><p>The original physical-device validation includes Secure Boot remediation followed by Confirm-SecureBootUEFI returning True and an Intune Compliant state. Later endpoint reuse does not invalidate that retained result.</p><div class=\"doc-grid\"><a href=\"#documentation/78b356285468\" data-route=\"documentation/78b356285468\" class=\"\">Troubleshooting<small>projects/windows-autopilot-intune/troubleshooting.md</small></a></div></section><section class=\"content-block\" id=\"validation\"><h2>Validation & results</h2><p>Entra join, MDM enrollment, ESP, required apps, BitLocker, Defender, firewall, VBS, Secure Boot, standard-user posture, and compliance were validated.</p><div class=\"doc-grid\"><a href=\"#documentation/552a8ca8fcd7\" data-route=\"documentation/552a8ca8fcd7\" class=\"\">Validation<small>projects/windows-autopilot-intune/validation.md</small></a></div></section><section class=\"content-block\" id=\"evidence\"><h2>Evidence</h2><p>VERY STRONG — physical-device Autopilot, Entra join, Intune enrollment, branded OOBE, ESP, Microsoft 365 Apps, compliance, BitLocker, Defender, Firewall, VBS, Secure Boot remediation, and post-enrollment management are documented.</p><div class=\"doc-grid\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/windows-autopilot-intune/README.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">README.md<small>Retained documentation supporting Windows Autopilot &amp; Intune MDM Provisioning.</small> <span aria-hidden=\"true\">↗</span></a><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/windows-autopilot-intune/architecture.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">architecture.md<small>Retained documentation supporting Windows Autopilot &amp; Intune MDM Provisioning.</small> <span aria-hidden=\"true\">↗</span></a><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/windows-autopilot-intune/evidence/01-dsregcmd-sanitized.txt\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">01-dsregcmd-sanitized.txt<small>Retained validation records supporting Windows Autopilot &amp; Intune MDM Provisioning.</small> <span aria-hidden=\"true\">↗</span></a><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/windows-autopilot-intune/evidence/02-intune-enterprisemgmt-tasks-sanitized.txt\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">02-intune-enterprisemgmt-tasks-sanitized.txt<small>Retained validation records supporting Windows Autopilot &amp; Intune MDM Provisioning.</small> <span aria-hidden=\"true\">↗</span></a><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/windows-autopilot-intune/evidence/03-m365-apps-validation.txt\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">03-m365-apps-validation.txt<small>Retained validation records supporting Windows Autopilot &amp; Intune MDM Provisioning.</small> <span aria-hidden=\"true\">↗</span></a><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/windows-autopilot-intune/evidence/04-bitlocker-validation.txt\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">04-bitlocker-validation.txt<small>Retained validation records supporting Windows Autopilot &amp; Intune MDM Provisioning.</small> <span aria-hidden=\"true\">↗</span></a><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/windows-autopilot-intune/evidence/05-defender-validation.txt\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">05-defender-validation.txt<small>Retained validation records supporting Windows Autopilot &amp; Intune MDM Provisioning.</small> <span aria-hidden=\"true\">↗</span></a><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/windows-autopilot-intune/evidence/06-firewall-vbs-secureboot-validation.txt\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">06-firewall-vbs-secureboot-validation.txt<small>Retained validation records supporting Windows Autopilot &amp; Intune MDM Provisioning.</small> <span aria-hidden=\"true\">↗</span></a><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/windows-autopilot-intune/evidence/README.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">README.md<small>Retained documentation supporting Windows Autopilot &amp; Intune MDM Provisioning.</small> <span aria-hidden=\"true\">↗</span></a><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/windows-autopilot-intune/evidence/index.html\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">index.html<small>Retained documentation supporting Windows Autopilot &amp; Intune MDM Provisioning.</small> <span aria-hidden=\"true\">↗</span></a></div><div class=\"source-links\"><a href=\"#evidence\" data-route=\"evidence\" class=\"\">Browse and filter the complete evidence library</a><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/tree/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/windows-autopilot-intune/\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">GitHub project source <span aria-hidden=\"true\">↗</span></a></div></section><section class=\"content-block\" id=\"skills\"><h2>Skills demonstrated</h2><div class=\"tags\"><span class=\"tag\">Autopilot</span><span class=\"tag\">Intune</span><span class=\"tag\">Entra join</span><span class=\"tag\">BitLocker</span></div><a href=\"#skills\" data-route=\"skills\" class=\"\">View the complete capability map →</a></section><section class=\"content-block\" id=\"limitations\"><h2>Limitations & claim boundaries</h2><div class=\"note\">Live physical-device personal-lab validation. Secrets and unique hardware/directory identifiers are excluded or redacted. Later reconfiguration of the endpoint does not invalidate the documented completed Autopilot project.</div></section><section class=\"content-block\" id=\"next\"><h2>Next milestones</h2><p>Project is complete. Preserve the completed Autopilot evidence independently of later endpoint reuse or transition back to the on-premises AD lab.</p></section></article></div><section class=\"section\"><p class=\"eyebrow\">Continue exploring</p><h2>Related projects</h2><div class=\"grid grid-2\"><article class=\"project-card\" data-project data-category=\"Endpoint management\" data-search=\"macos abm to intune enterprise runbook real microsoft-side configuration paired with explicitly simulated apple enrollment and endpoint workflows. intune apns filevault abm / ade simulation\"><div class=\"card-head\"><span class=\"project-number\">PROJECT 12</span><span class=\"status\">COMPLETE</span></div><h3><a href=\"#projects/macos-abm-intune-runbook\" data-route=\"projects/macos-abm-intune-runbook\" class=\"\">macOS ABM to Intune Enterprise Runbook</a></h3><p>Real Microsoft-side configuration paired with explicitly simulated Apple enrollment and endpoint workflows.</p><div class=\"tags\"><span class=\"tag\">Intune</span><span class=\"tag\">APNs</span><span class=\"tag\">FileVault</span><span class=\"tag\">ABM / ADE simulation</span></div><div class=\"card-footer\"><a href=\"#projects/macos-abm-intune-runbook\" data-route=\"projects/macos-abm-intune-runbook\" class=\"\">Read case study <span class=arrow>↗</span></a><a href=\"#evidence\" data-route=\"evidence\" class=\"text-link\">Evidence</a></div></article></div></section>",
    "active": "Projects"
  },
  "projects/macos-abm-intune-runbook": {
    "title": "macOS ABM to Intune Enterprise Runbook",
    "description": "Real Microsoft-side configuration paired with explicitly simulated Apple enrollment and endpoint workflows.",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Project 12 / Endpoint management</p><h1>macOS ABM to Intune Enterprise Runbook</h1><p class=\"lead\">Real Microsoft-side configuration paired with explicitly simulated Apple enrollment and endpoint workflows.</p><div class=\"tags\"><span class=\"status\">COMPLETE</span><span class=\"tag\">Real configuration + simulation</span></div><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/tree/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/macos-abm-intune-runbook/\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">GitHub documentation <span aria-hidden=\"true\">↗</span></a><a href=\"https://jeremyfontenot.online/macos-abm-intune-runbook.html\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original portfolio <span aria-hidden=\"true\">↗</span></a><a href=\"#evidence\" data-route=\"evidence\" class=\"\">Evidence library</a></div></div><div class=\"case-layout\"><aside class=\"case-toc\"><p class=\"eyebrow\">Inside this case study</p><a href=\"#overview\" data-anchor=\"overview\">Overview</a><a href=\"#scenario\" data-anchor=\"scenario\">Operational scenario & objectives</a><a href=\"#environment\" data-anchor=\"environment\">Environment & technologies</a><a href=\"#architecture\" data-anchor=\"architecture\">Architecture</a><a href=\"#implementation\" data-anchor=\"implementation\">Implementation & administration</a><a href=\"#troubleshooting\" data-anchor=\"troubleshooting\">Troubleshooting</a><a href=\"#validation\" data-anchor=\"validation\">Validation & results</a><a href=\"#evidence\" data-anchor=\"evidence\">Evidence</a><a href=\"#skills\" data-anchor=\"skills\">Skills demonstrated</a><a href=\"#limitations\" data-anchor=\"limitations\">Limitations & claim boundaries</a><a href=\"#next\" data-anchor=\"next\">Next milestones</a></aside><article><section class=\"content-block\" id=\"overview\"><h2>Overview</h2><p>Real Microsoft-side configuration paired with explicitly simulated Apple enrollment and endpoint workflows.</p><p><strong>Classification:</strong> Real configuration + simulation.</p></section><section class=\"content-block\" id=\"scenario\"><h2>Operational scenario & objectives</h2><p>Document a complete enterprise management runbook while clearly separating configured controls, available capabilities, and simulated endpoint procedures.</p></section><section class=\"content-block\" id=\"environment\"><h2>Environment & technologies</h2><p>Real Intune tenant and APNs relationship; macOS policy configuration. No managed Mac or legitimate ABM/ADE deployment is claimed.</p><div class=\"tags\"><span class=\"tag\">Intune</span><span class=\"tag\">APNs</span><span class=\"tag\">FileVault</span><span class=\"tag\">ABM / ADE simulation</span></div></section><section class=\"content-block\" id=\"architecture\"><h2>Architecture</h2><p>Real Intune tenant and APNs relationship; macOS policy configuration. No managed Mac or legitimate ABM/ADE deployment is claimed.</p><div class=\"doc-grid\"><a href=\"#documentation/425951ec3f27\" data-route=\"documentation/425951ec3f27\" class=\"\">Architecture — macOS ABM to Intune<small>projects/macos-abm-intune-runbook/architecture.md</small></a></div></section><section class=\"content-block\" id=\"implementation\"><h2>Implementation & administration</h2><div class=\"imported\"><div class=\"macos-project\">\n<section class=\"page-hero macos-hero\">\n<div class=\"wrap macos-hero-grid\">\n<div>\n<p class=\"eyebrow\">M365 Lab Project 05 · COMPLETE</p>\n<h2>macOS management, designed like an <span class=\"accent\">enterprise control plane.</span></h2>\n<p class=\"lead\">Real Microsoft Intune configuration for APNs, macOS compliance, and FileVault—paired with a rigorously bounded Apple Business Manager, ADE, Platform SSO, certificate, and lifecycle runbook.</p>\n<div class=\"actions\"><a class=\"button primary\" data-route=\"evidence\" href=\"#evidence\">Explore proof</a><a class=\"button\" href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/tree/main/projects/macos-abm-intune-runbook\" rel=\"noopener noreferrer\" target=\"_blank\">Review documentation</a></div>\n</div>\n<div aria-label=\"Architecture overview\" class=\"macos-orbit\">\n<span class=\"orbit-core\">INTUNE</span>\n<span class=\"orbit-node node-1\">ABM</span>\n<span class=\"orbit-node node-2\">ADE</span>\n<span class=\"orbit-node node-3\">ENTRA</span>\n<span class=\"orbit-node node-4\">FILEVAULT</span>\n<span class=\"orbit-node node-5\">EAP-TLS</span>\n<span class=\"orbit-node node-6\">LIFECYCLE</span>\n</div>\n</div>\n</section>\n<section class=\"section macos-status-band\">\n<div class=\"wrap\">\n<div class=\"metric-strip\">\n<div class=\"metric\"><strong>REAL</strong><span>APNs relationship</span></div>\n<div class=\"metric\"><strong>REAL</strong><span>Compliance policy</span></div>\n<div class=\"metric\"><strong>REAL</strong><span>FileVault baseline</span></div>\n<div class=\"metric\"><strong>BOUND</strong><span>ABM / ADE simulation</span></div>\n</div>\n</div>\n</section>\n<section class=\"section\">\n<div class=\"wrap\">\n<div class=\"section-head\">\n<p class=\"eyebrow\">Architecture</p>\n<h2>One chain of trust. Three explicit evidence states.</h2>\n<p>Every major component is labeled as real configuration, validated capability, or simulated/documented procedure. No endpoint result is claimed without an enrolled Mac.</p>\n</div>\n<div aria-label=\"Apple Business Manager to Intune architecture\" class=\"macos-flow\">\n<div><span>01</span><strong>Apple Business Manager</strong><small>SIMULATED / DOCUMENTED</small></div>\n<div><span>02</span><strong>Enrollment Program Token</strong><small>SIMULATED / DOCUMENTED</small></div>\n<div><span>03</span><strong>Automated Device Enrollment</strong><small>SIMULATED / DOCUMENTED</small></div>\n<div class=\"flow-real\"><span>04</span><strong>Microsoft Intune</strong><small>REAL CONFIGURATION</small></div>\n<div class=\"flow-real\"><span>05</span><strong>Compliance + FileVault</strong><small>REAL CONFIGURATION</small></div>\n<div><span>06</span><strong>Managed macOS endpoint</strong><small>NOT VALIDATED</small></div>\n</div>\n</div>\n</section>\n<section class=\"section macos-split\">\n<div class=\"wrap grid grid-2\">\n<article class=\"panel macos-glass\">\n<p class=\"eyebrow\">Implemented in the real tenant</p>\n<h2>Microsoft-side controls that actually exist.</h2>\n<ul class=\"list-clean\">\n<li>Apple MDM Push certificate created and accepted by Intune.</li>\n<li>APNs expiration documented for 2027-09-26.</li>\n<li><strong>Project 5 - macOS Enterprise Compliance</strong> created.</li>\n<li>System Integrity Protection, password, encryption, firewall, Stealth Mode, and Gatekeeper requirements configured.</li>\n<li><strong>Project 5 - macOS FileVault Baseline</strong> created in Settings Catalog.</li>\n<li>FileVault enabled, anti-disable control configured, and recovery-key escrow location guidance defined.</li>\n</ul>\n</article>\n<article class=\"panel macos-glass macos-boundary\">\n<p class=\"eyebrow\">Intentionally not overstated</p>\n<h2>Apple-side and endpoint-only work stays documented.</h2>\n<ul class=\"list-clean\">\n<li>No Apple Business Manager organization was fabricated.</li>\n<li>No Enrollment Program Token or ADE device sync is claimed.</li>\n<li>No Platform SSO registration is claimed on a managed Mac.</li>\n<li>No EAP-TLS authentication or certificate issuance is claimed.</li>\n<li>No FileVault recovery key is published or represented as escrowed.</li>\n<li>No retire, wipe, or reassignment action is claimed as executed.</li>\n</ul>\n</article>\n</div>\n</section>\n<section class=\"section\">\n<div class=\"wrap\">\n<div class=\"section-head\">\n<p class=\"eyebrow\">Validated capability surface</p>\n<h2>What the real tenant exposes for macOS administration.</h2>\n</div>\n<div class=\"grid grid-3 macos-cap-grid\">\n<article class=\"panel\"><span class=\"tile-code\">IDENTITY</span><h3>Platform SSO</h3><p>Platform SSO settings were located in the real macOS Settings Catalog. Endpoint registration remains unvalidated without a managed Mac.</p></article>\n<article class=\"panel\"><span class=\"tile-code\">NETWORK ACCESS</span><h3>Enterprise Wi-Fi</h3><p>Intune exposes WPA-Enterprise, WPA2-Enterprise, EAP-FAST, EAP-SIM, EAP-TLS, EAP-TTLS, LEAP, and PEAP. The documented design uses WPA2-Enterprise + EAP-TLS.</p></article>\n<article class=\"panel\"><span class=\"tile-code\">CERTIFICATES</span><h3>SCEP / PKCS</h3><p>macOS SCEP, PKCS, imported PKCS, and trusted-certificate workflows are available. No live enterprise PKI issuance is claimed.</p></article>\n<article class=\"panel\"><span class=\"tile-code\">APPLICATIONS</span><h3>DMG, PKG, M365, Edge</h3><p>macOS app deployment types include DMG, PKG, line-of-business apps, Microsoft 365 Apps, Microsoft Edge, Defender, web clips, and links.</p></article>\n<article class=\"panel\"><span class=\"tile-code\">INVENTORY</span><h3>0 enrolled Macs</h3><p>The real inventory view was validated and currently contains zero managed macOS devices—a deliberate boundary, not a hidden gap.</p></article>\n<article class=\"panel\"><span class=\"tile-code\">LIFECYCLE</span><h3>Retire, wipe, delete, restart, rename, sync</h3><p>The real bulk-action surface exposes the expected lifecycle controls. None was executed without a managed test Mac.</p></article>\n</div>\n</div>\n</section>\n<section class=\"section macos-evidence-section\" id=\"source-b32f94a8-evidence\">\n<div class=\"wrap\">\n<div class=\"section-head\">\n<p class=\"eyebrow\">Evidence-backed documentation</p>\n<h2>Every claim has a narrow proof target.</h2>\n<p>The project documentation records implementation state, validation boundaries, operational renewal work, lifecycle administration, and troubleshooting without publishing secrets.</p>\n</div>\n<div class=\"macos-shot-grid\">\n<figure class=\"macos-shot-card\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/macos-abm-intune-runbook/evidence/evidence-board-security.webp\" rel=\"noopener noreferrer\" target=\"_blank\"><a href=\"https://jeremyfontenot.online/projects/macos-abm-intune-runbook/evidence/evidence-board-security.webp\" rel=\"noopener noreferrer\" target=\"_blank\">Open original screenshot: Sanitized composite of real Apple MDM push certificate, macOS compliance, FileVault, and Platform SSO configuration evidence</a></a><figcaption><strong>Real tenant security evidence.</strong> APNs issuance, compliance policy settings, FileVault controls, and Platform SSO capability—derived from screenshots captured during this project.</figcaption></figure>\n<article class=\"macos-shot-note\"><span class=\"tile-code\">EVIDENCE BOUNDARY</span><h3>The screenshot says exactly what the caption says.</h3><p>This published derivative intentionally excludes Apple account identifiers and certificate details. It proves Microsoft-side configuration and capability only; ABM, ADE, endpoint enforcement, recovery-key escrow, and destructive lifecycle actions remain documented rather than fabricated.</p><div class=\"proof-links\"><a class=\"proof-primary\" href=\"https://jeremyfontenot.online/projects/macos-abm-intune-runbook/evidence/\" rel=\"noopener noreferrer\" target=\"_blank\">Open evidence gallery</a></div></article>\n</div>\n<div class=\"grid grid-2\">\n<article class=\"proof-card\"><span class=\"tile-code\">IMPLEMENTATION</span><h3>Real configuration record</h3><p>APNs, compliance, FileVault, enrollment restrictions, Platform SSO capability, Wi-Fi, SCEP, apps, inventory, and lifecycle inspection.</p><div class=\"proof-links\"><a class=\"proof-primary\" href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/main/projects/macos-abm-intune-runbook/implementation.md\" rel=\"noopener noreferrer\" target=\"_blank\">Read implementation</a></div></article>\n<article class=\"proof-card\"><span class=\"tile-code\">VALIDATION</span><h3>Real vs. simulated matrix</h3><p>A complete matrix distinguishes configured objects, validated capabilities, endpoint-dependent checks, and simulation-only procedures.</p><div class=\"proof-links\"><a class=\"proof-primary\" href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/main/projects/macos-abm-intune-runbook/validation.md\" rel=\"noopener noreferrer\" target=\"_blank\">Read validation</a></div></article>\n<article class=\"proof-card\"><span class=\"tile-code\">OPERATIONS</span><h3>Renewal calendar</h3><p>APNs renewal, ABM token renewal, certificate trust, application review, compliance review, and FileVault recovery validation are treated as recurring operational responsibilities.</p><div class=\"proof-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/main/projects/macos-abm-intune-runbook/renewal-calendar.md\" rel=\"noopener noreferrer\" target=\"_blank\">Open renewal calendar</a></div></article>\n<article class=\"proof-card\"><span class=\"tile-code\">LIFECYCLE</span><h3>Retire, wipe, reassignment, lost/stolen</h3><p>The runbook separates record deletion from destructive wipe and documents ownership checks, authorization, asset state, identity revocation, and reassignment.</p><div class=\"proof-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/main/projects/macos-abm-intune-runbook/device-lifecycle.md\" rel=\"noopener noreferrer\" target=\"_blank\">Open lifecycle runbook</a></div></article>\n</div>\n<div class=\"macos-doc-strip\">\n<a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/main/projects/macos-abm-intune-runbook/architecture.md\" rel=\"noopener noreferrer\" target=\"_blank\">Architecture</a>\n<a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/main/projects/macos-abm-intune-runbook/troubleshooting.md\" rel=\"noopener noreferrer\" target=\"_blank\">Troubleshooting</a>\n<a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/main/projects/macos-abm-intune-runbook/lessons-learned.md\" rel=\"noopener noreferrer\" target=\"_blank\">Lessons learned</a>\n<a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/main/projects/macos-abm-intune-runbook/simulated-deployment-scenario.md\" rel=\"noopener noreferrer\" target=\"_blank\">Simulated deployment</a>\n</div>\n</div>\n</section>\n</div></div><details><summary>Project 5 — Simulated macOS ABM to Intune Runbook <small> / README.md</small></summary><div class=\"document\"><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/macos-abm-intune-runbook/README.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original source <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation/eb7faf9d899d\" data-route=\"documentation/eb7faf9d899d\" class=\"\">Open document page</a></div><h2>Project 5 — Simulated macOS ABM to Intune Runbook</h2>\n<p><strong>Status:</strong> COMPLETE<br/>\n<strong>Project type:</strong> FREE WITH SIMULATION<br/>\n<strong>Microsoft-side implementation:</strong> REAL CONFIGURATION where validated<br/>\n<strong>Apple Business Manager / ADE:</strong> SIMULATED / DOCUMENTED</p>\n<h2>Objective</h2>\n<p>Demonstrate an enterprise macOS management design spanning Apple Business Manager (ABM), Microsoft Intune, Automated Device Enrollment (ADE), Microsoft Entra authentication, Platform SSO, enterprise Wi-Fi, certificates, FileVault, compliance, application deployment, inventory, and lifecycle administration.</p>\n<p>The project deliberately separates what was actually configured in the Microsoft Intune tenant from Apple- and endpoint-dependent workflows that could not be executed legitimately in the lab.</p>\n<h2>What was actually configured</h2>\n<p>The following work was performed in the real Microsoft Intune tenant:</p>\n<ul>\n<li>Apple MDM Push (APNs) certificate created through Apple's Push Certificates Portal and uploaded to Intune.</li>\n<li>APNs certificate validated as active in Intune; renewal due <strong>2027-09-26</strong>.</li>\n<li>macOS compliance policy created:</li>\n<li>System Integrity Protection required.</li>\n<li>Password required to unlock.</li>\n<li>Storage encryption required.</li>\n<li>Firewall enabled.</li>\n<li>Stealth Mode enabled.</li>\n<li>Gatekeeper limited to the Mac App Store and identified developers.</li>\n<li>Noncompliance marked immediately.</li>\n<li>macOS FileVault Settings Catalog profile created:</li>\n<li>FileVault enabled.</li>\n<li>Users prevented from disabling FileVault.</li>\n<li>Recovery-key escrow location guidance configured.</li>\n<li>Intune macOS enrollment restrictions reviewed and validated.</li>\n<li>Platform SSO configuration capability reviewed in the Settings Catalog.</li>\n<li>Enterprise Wi-Fi capability reviewed, including WPA/WPA2-Enterprise and EAP methods.</li>\n<li>SCEP certificate profile capability reviewed.</li>\n<li>macOS app deployment types reviewed.</li>\n<li>macOS inventory and bulk lifecycle actions reviewed.</li>\n</ul>\n<h2>What remains simulated/documented</h2>\n<p>The following workflows are documented but were <strong>not</strong> represented as implemented:</p>\n<ul>\n<li>Apple Business Manager organization enrollment and verification.</li>\n<li>Reseller/device assignment into ABM.</li>\n<li>Intune Enrollment Program Token exchange with ABM.</li>\n<li>Automated Device Enrollment synchronization.</li>\n<li>ADE enrollment profile deployment.</li>\n<li>macOS Setup Assistant ADE experience.</li>\n<li>Platform SSO registration on a managed Mac.</li>\n<li>Certificate issuance through a live enterprise PKI/SCEP path.</li>\n<li>Enterprise RADIUS authentication.</li>\n<li>FileVault recovery-key escrow from an enrolled Mac.</li>\n<li>Compliance evaluation on an enrolled Mac.</li>\n<li>App installation on a managed Mac.</li>\n<li>Device reassignment, retire, wipe, and lost/stolen execution against a real Mac.</li>\n</ul>\n<h2>Architecture</h2>\n<pre><code class=\"language-text\">Apple procurement / reseller\n        ↓\nApple Business Manager\n        ↓\nIntune Enrollment Program Token\n        ↓\nAutomated Device Enrollment profile\n        ↓\nmacOS Setup Assistant\n        ↓\nMicrosoft Entra authentication\n        ↓\nMicrosoft Intune enrollment\n        ↓\nConfiguration + applications + compliance\n        ↓\nFileVault + recovery-key escrow\n        ↓\nInventory + lifecycle administration\n</code></pre>\n<p>See <a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/macos-abm-intune-runbook/architecture.md\" rel=\"noopener noreferrer\" target=\"_blank\">architecture.md</a> for the full real-versus-simulated boundary.</p>\n<h2>Evidence</h2>\n<p>The evidence gallery is available at:</p>\n<ul>\n<li><a href=\"https://jeremyfontenot.online/projects/macos-abm-intune-runbook/evidence/\" rel=\"noopener noreferrer\" target=\"_blank\">Project 5 evidence index</a></li>\n<li><a data-route=\"projects/macos-abm-intune-runbook\" href=\"#projects/macos-abm-intune-runbook\">Live case study</a></li>\n</ul>\n<p>Screenshots are direct captures from the real Intune tenant or Apple Push Certificates Portal. No simulated screenshot is presented as real administration.</p>\n<h2>Documentation</h2>\n<ul>\n<li><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/macos-abm-intune-runbook/architecture.md\" rel=\"noopener noreferrer\" target=\"_blank\">Architecture</a></li>\n<li><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/macos-abm-intune-runbook/implementation.md\" rel=\"noopener noreferrer\" target=\"_blank\">Implementation</a></li>\n<li><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/macos-abm-intune-runbook/validation.md\" rel=\"noopener noreferrer\" target=\"_blank\">Validation</a></li>\n<li><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/macos-abm-intune-runbook/troubleshooting.md\" rel=\"noopener noreferrer\" target=\"_blank\">Troubleshooting</a></li>\n<li><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/macos-abm-intune-runbook/lessons-learned.md\" rel=\"noopener noreferrer\" target=\"_blank\">Lessons learned</a></li>\n<li><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/macos-abm-intune-runbook/renewal-calendar.md\" rel=\"noopener noreferrer\" target=\"_blank\">Renewal calendar</a></li>\n<li><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/macos-abm-intune-runbook/device-lifecycle.md\" rel=\"noopener noreferrer\" target=\"_blank\">Device lifecycle</a></li>\n<li><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/macos-abm-intune-runbook/simulated-deployment-scenario.md\" rel=\"noopener noreferrer\" target=\"_blank\">Simulated deployment scenario</a></li>\n<li><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/macos-abm-intune-runbook/portfolio-summary.md\" rel=\"noopener noreferrer\" target=\"_blank\">Portfolio summary</a></li>\n</ul>\n<h2>Security and evidence handling</h2>\n<p>The repository does not publish Apple credentials, private keys, enrollment tokens, bearer tokens, FileVault recovery keys, passwords, MFA secrets, or session cookies. Screenshots selected for publication avoid personal Apple-account identifiers and sensitive certificate material.</p>\n<h2>Technologies demonstrated</h2>\n<p>Apple Business Manager architecture, Apple Push Notification service, Microsoft Intune, Microsoft Entra ID, Automated Device Enrollment concepts, Platform SSO, Settings Catalog, FileVault, macOS compliance, enterprise Wi-Fi, EAP-TLS, SCEP/PKCS concepts, macOS application deployment, inventory, device lifecycle, renewal operations, and evidence-based administration.</p></div></details><details><summary>Architecture — macOS ABM to Intune <small> / architecture.md</small></summary><div class=\"document\"><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/macos-abm-intune-runbook/architecture.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original source <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation/425951ec3f27\" data-route=\"documentation/425951ec3f27\" class=\"\">Open document page</a></div><h2>Architecture — macOS ABM to Intune</h2>\n<h2>Status boundary</h2>\n<p>This project uses three explicit implementation states:</p>\n<ul>\n<li><strong>REAL CONFIGURATION</strong> — actually configured or directly validated in the real Microsoft Intune tenant.</li>\n<li><strong>SIMULATED / DOCUMENTED</strong> — accurately designed and documented, but not executed because the required Apple infrastructure or managed macOS endpoint is unavailable.</li>\n<li><strong>NOT VALIDATED</strong> — a Microsoft-side policy may exist, but endpoint behavior was not tested on an enrolled Mac.</li>\n</ul>\n<h2>Intended enterprise flow</h2>\n<pre><code class=\"language-text\">Authorized reseller / Apple procurement\n        │\n        ▼\nApple Business Manager\n        │\n        │ device assignment to MDM server\n        ▼\nMicrosoft Intune MDM server\n        │\n        │ Enrollment Program Token\n        ▼\nAutomated Device Enrollment\n        │\n        ▼\nmacOS Setup Assistant\n        │\n        ▼\nMicrosoft Entra authentication\n        │\n        ▼\nMicrosoft Intune enrollment\n        │\n        ├───────────────┬────────────────┬────────────────┐\n        ▼               ▼                ▼                ▼\nConfiguration       Applications      Compliance       Security\nprofiles                                                controls\n        │               │                │                │\n        ├─ Platform SSO │                │                ├─ FileVault\n        ├─ Wi-Fi / PKI  │                │                └─ Firewall\n        └─ restrictions │                │\n        └───────────────┴────────────────┴────────────────┘\n                                │\n                                ▼\n                    Inventory + lifecycle\n                                │\n                  ┌─────────────┼─────────────┐\n                  ▼             ▼             ▼\n                Retire         Wipe       Reassignment\n</code></pre>\n<h2>Apple service boundary</h2>\n<h3>Apple Push Notification service — REAL CONFIGURATION</h3>\n<p>A real Apple MDM Push certificate was created in Apple's Push Certificates Portal using the Intune-generated CSR and uploaded back to the Intune tenant.</p>\n<p>Validated state:</p>\n<ul>\n<li>Vendor: Microsoft Corporation.</li>\n<li>APNs certificate created successfully.</li>\n<li>Intune upload completed successfully.</li>\n<li>Certificate expiration: <strong>2027-09-26</strong>.</li>\n</ul>\n<p>The Apple account used to own the certificate is intentionally excluded from public evidence.</p>\n<h3>Apple Business Manager — SIMULATED / DOCUMENTED</h3>\n<p>No Apple Business Manager organization is available in the lab. Therefore, the following are not represented as implemented:</p>\n<ul>\n<li>organization verification;</li>\n<li>reseller/device assignment;</li>\n<li>MDM server creation in ABM;</li>\n<li>ABM server token issuance;</li>\n<li>Enrollment Program Token import;</li>\n<li>ADE device sync;</li>\n<li>ADE profile assignment;</li>\n<li>Setup Assistant ADE behavior.</li>\n</ul>\n<h2>Microsoft service boundary</h2>\n<h3>Microsoft Intune — REAL CONFIGURATION</h3>\n<p>The real tenant was used to create or inspect:</p>\n<ul>\n<li>Apple enrollment administration;</li>\n<li>macOS compliance policy;</li>\n<li>macOS FileVault Settings Catalog profile;</li>\n<li>macOS enrollment restrictions;</li>\n<li>Platform SSO settings;</li>\n<li>enterprise Wi-Fi settings;</li>\n<li>SCEP certificate settings;</li>\n<li>macOS application types;</li>\n<li>macOS inventory;</li>\n<li>macOS bulk device lifecycle actions.</li>\n</ul>\n<h3>Microsoft Entra ID</h3>\n<p>Microsoft Entra is the intended identity provider for Company Portal enrollment and Platform SSO. Endpoint Platform SSO registration is <strong>NOT VALIDATED</strong> because there is no enrolled macOS endpoint.</p>\n<h2>Real vs. simulated matrix</h2>\n<div class=\"table-scroll\"><table>\n<thead>\n<tr>\n<th>Component</th>\n<th>Classification</th>\n<th>Evidence / boundary</th>\n</tr>\n</thead>\n<tbody>\n<tr>\n<td>Intune tenant access</td>\n<td>REAL CONFIGURATION</td>\n<td>Real portal configuration captured</td>\n</tr>\n<tr>\n<td>APNs certificate</td>\n<td>REAL CONFIGURATION — COMPLETE</td>\n<td>Created in Apple portal; uploaded to Intune</td>\n</tr>\n<tr>\n<td>ABM organization</td>\n<td>SIMULATED / DOCUMENTED</td>\n<td>No ABM organization available</td>\n</tr>\n<tr>\n<td>Enrollment Program Token</td>\n<td>SIMULATED / DOCUMENTED</td>\n<td>Intune creation workflow inspected only</td>\n</tr>\n<tr>\n<td>ADE</td>\n<td>SIMULATED / DOCUMENTED</td>\n<td>Requires ABM + eligible device</td>\n</tr>\n<tr>\n<td>macOS compliance policy</td>\n<td>REAL CONFIGURATION — COMPLETE</td>\n<td>Policy created in Intune</td>\n</tr>\n<tr>\n<td>Compliance enforcement</td>\n<td>NOT VALIDATED</td>\n<td>No enrolled macOS endpoint</td>\n</tr>\n<tr>\n<td>FileVault policy</td>\n<td>REAL CONFIGURATION — COMPLETE</td>\n<td>Settings Catalog profile created</td>\n</tr>\n<tr>\n<td>FileVault encryption on endpoint</td>\n<td>NOT VALIDATED</td>\n<td>No enrolled macOS endpoint</td>\n</tr>\n<tr>\n<td>Recovery-key escrow</td>\n<td>NOT VALIDATED</td>\n<td>No enrolled macOS endpoint</td>\n</tr>\n<tr>\n<td>Platform SSO capability</td>\n<td>REAL CONFIGURATION — VALIDATED</td>\n<td>Settings exposed in Intune</td>\n</tr>\n<tr>\n<td>Platform SSO endpoint registration</td>\n<td>SIMULATED / DOCUMENTED</td>\n<td>No managed Mac</td>\n</tr>\n<tr>\n<td>Enterprise Wi-Fi capability</td>\n<td>REAL CONFIGURATION — VALIDATED</td>\n<td>Enterprise profile surface inspected</td>\n</tr>\n<tr>\n<td>WPA2-Enterprise + EAP-TLS</td>\n<td>SIMULATED / DOCUMENTED DESIGN</td>\n<td>No RADIUS/PKI deployment</td>\n</tr>\n<tr>\n<td>SCEP certificate capability</td>\n<td>REAL CONFIGURATION — VALIDATED</td>\n<td>SCEP profile surface inspected</td>\n</tr>\n<tr>\n<td>Certificate issuance</td>\n<td>SIMULATED / DOCUMENTED</td>\n<td>No live enterprise PKI/SCEP service</td>\n</tr>\n<tr>\n<td>macOS application deployment capability</td>\n<td>REAL CONFIGURATION — VALIDATED</td>\n<td>Supported app types inspected</td>\n</tr>\n<tr>\n<td>Application installation</td>\n<td>NOT VALIDATED</td>\n<td>No managed Mac</td>\n</tr>\n<tr>\n<td>macOS inventory</td>\n<td>REAL CONFIGURATION — VALIDATED</td>\n<td>Inventory page available; 0 Macs enrolled</td>\n</tr>\n<tr>\n<td>Retire / Wipe / Delete / Restart / Rename / Sync</td>\n<td>REAL CONFIGURATION — VALIDATED CAPABILITY</td>\n<td>Actions exposed; none executed</td>\n</tr>\n<tr>\n<td>Device reassignment</td>\n<td>SIMULATED / DOCUMENTED</td>\n<td>No enrolled Mac</td>\n</tr>\n<tr>\n<td>Lost/stolen workflow</td>\n<td>SIMULATED / DOCUMENTED</td>\n<td>Operational procedure only</td>\n</tr>\n</tbody>\n</table></div>\n<h2>Enterprise Wi-Fi design</h2>\n<p>The intended secure WLAN model is:</p>\n<pre><code class=\"language-text\">macOS device\n   │\n   ├─ trusted root certificate\n   ├─ SCEP/PKCS device certificate\n   │\n   ▼\nWPA2-Enterprise / EAP-TLS\n   │\n   ▼\nRADIUS / network policy service\n   │\n   ▼\nEnterprise wireless network\n</code></pre>\n<p>The Intune tenant exposed WPA-Enterprise, WPA2-Enterprise, EAP-FAST, EAP-SIM, EAP-TLS, EAP-TTLS, LEAP, and PEAP. EAP-TLS is the documented design because it supports certificate-based device authentication without depending on user passwords for Wi-Fi access.</p>\n<h2>Security design principles</h2>\n<ul>\n<li>Require FileVault encryption.</li>\n<li>Prevent users from disabling FileVault after policy enforcement.</li>\n<li>Escrow the personal recovery key to the management service when a managed Mac exists.</li>\n<li>Require System Integrity Protection.</li>\n<li>Require password-protected unlock.</li>\n<li>Enable firewall and Stealth Mode.</li>\n<li>Preserve Gatekeeper restrictions.</li>\n<li>Prefer certificate-based enterprise Wi-Fi.</li>\n<li>Keep APNs renewal ownership documented.</li>\n<li>Separate destructive lifecycle operations from routine sync/restart actions.</li>\n<li>Never publish recovery keys, token contents, credentials, or certificate private material.</li>\n</ul></div></details><details><summary>macOS Device Lifecycle Runbook <small> / device-lifecycle.md</small></summary><div class=\"document\"><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/macos-abm-intune-runbook/device-lifecycle.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original source <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation/092c22682705\" data-route=\"documentation/092c22682705\" class=\"\">Open document page</a></div><h2>macOS Device Lifecycle Runbook</h2>\n<h2>1. Procurement and assignment</h2>\n<p><strong>SIMULATED / DOCUMENTED</strong></p>\n<p>Preferred enterprise path:</p>\n<ol>\n<li>Purchase through Apple or an authorized reseller linked to the ABM organization.</li>\n<li>Verify the device appears in Apple Business Manager.</li>\n<li>Assign the device to the Microsoft Intune MDM server.</li>\n<li>Synchronize the Enrollment Program Token in Intune.</li>\n<li>Assign the correct ADE profile.</li>\n</ol>\n<h2>2. Enrollment</h2>\n<p><strong>SIMULATED / DOCUMENTED</strong></p>\n<ol>\n<li>User powers on or resets the Mac.</li>\n<li>Apple activation identifies the device as organization-owned.</li>\n<li>ADE directs the device to Intune.</li>\n<li>Setup Assistant applies the configured enrollment experience.</li>\n<li>User authenticates where required.</li>\n<li>Intune enrollment completes.</li>\n<li>Company Portal / Platform SSO registration follows the organization design.</li>\n</ol>\n<h2>3. Configuration and security</h2>\n<p>Microsoft-side configuration demonstrated in the real tenant includes:</p>\n<ul>\n<li>compliance baseline;</li>\n<li>FileVault baseline;</li>\n<li>Platform SSO capability;</li>\n<li>enterprise Wi-Fi capability;</li>\n<li>certificate profile capability;</li>\n<li>app deployment capability.</li>\n</ul>\n<p>Endpoint enforcement remains unvalidated without an enrolled Mac.</p>\n<h2>4. Inventory and ownership</h2>\n<p>The Intune macOS inventory surface exposes:</p>\n<ul>\n<li>device name;</li>\n<li>management authority;</li>\n<li>ownership;</li>\n<li>compliance;</li>\n<li>OS and version;</li>\n<li>primary user;</li>\n<li>last check-in.</li>\n</ul>\n<p>Current lab inventory: <strong>0 macOS devices</strong>.</p>\n<h2>5. Routine operations</h2>\n<p>Available real Intune actions include:</p>\n<ul>\n<li>Sync — request management check-in.</li>\n<li>Restart — restart the managed device.</li>\n<li>Rename — change device display/name where supported.</li>\n</ul>\n<h2>6. Retirement</h2>\n<p><strong>SIMULATED / DOCUMENTED</strong></p>\n<p>Use when management should be removed without treating the device as stolen or requiring a factory reset. Confirm ownership and data-handling requirements before choosing Retire.</p>\n<h2>7. Wipe</h2>\n<p><strong>SIMULATED / DOCUMENTED</strong></p>\n<p>Use only after validating:</p>\n<ul>\n<li>device identity;</li>\n<li>ownership;</li>\n<li>authorization;</li>\n<li>data-retention requirements;</li>\n<li>reassignment or disposal plan.</li>\n</ul>\n<p>A wipe is destructive and should be treated as a controlled administrative action.</p>\n<h2>8. Delete</h2>\n<p>Deleting the Intune object is not equivalent to securely wiping the device. Confirm the device has already been retired/wiped or otherwise handled appropriately before deleting the management record.</p>\n<h2>9. Reassignment</h2>\n<p><strong>SIMULATED / DOCUMENTED</strong></p>\n<p>For corporate devices:</p>\n<ol>\n<li>Capture required asset state.</li>\n<li>Retire/wipe according to policy.</li>\n<li>Reassign in ABM if the MDM destination changes.</li>\n<li>Ensure the correct ADE profile is assigned.</li>\n<li>Reset the Mac.</li>\n<li>Enroll the next user through Setup Assistant.</li>\n<li>Validate inventory, compliance, FileVault, apps, and authentication.</li>\n</ol>\n<h2>10. Lost or stolen device</h2>\n<p><strong>SIMULATED / DOCUMENTED</strong></p>\n<ol>\n<li>Verify the asset and user.</li>\n<li>Escalate to security/management.</li>\n<li>Revoke or block identity sessions as policy requires.</li>\n<li>Evaluate remote wipe.</li>\n<li>Revoke device certificates where appropriate.</li>\n<li>Preserve incident records.</li>\n<li>Update asset ownership/status.</li>\n<li>Do not expose recovery keys or credentials during evidence capture.</li>\n</ol></div></details><details><summary>Project 5 Evidence Index <small> / README.md</small></summary><div class=\"document\"><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/macos-abm-intune-runbook/evidence/README.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original source <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation/15569e574dbb\" data-route=\"documentation/15569e574dbb\" class=\"\">Open document page</a></div><h2>Project 5 Evidence Index</h2>\n<p>The public evidence in this folder is deliberately sanitized and narrowly captioned. It proves Microsoft-side configuration and capability without implying that Apple Business Manager, Automated Device Enrollment, or a managed macOS endpoint exists in this lab.</p>\n<h2>Published screenshot evidence</h2>\n<h3>Security and management proof board</h3>\n<p><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/macos-abm-intune-runbook/evidence/evidence-board-security.webp\" rel=\"noopener noreferrer\" target=\"_blank\">Open the screenshot proof board</a></p>\n<p>The board is a derived composite built from four screenshots captured during this Project 5 session:</p>\n<ol>\n<li><strong>Apple Push Certificates Portal confirmation</strong> — proves Apple issued a new Mobile Device Management push certificate for Microsoft Corporation with expiration <strong>September 26, 2027</strong>.</li>\n<li><strong>macOS compliance policy review</strong> — proves the real Intune policy was configured with System Integrity Protection, password, storage encryption, firewall, Stealth Mode, and Gatekeeper requirements before creation.</li>\n<li><strong>macOS FileVault Settings Catalog configuration</strong> — proves FileVault was set to On, users were prevented from disabling it, and recovery-key escrow location guidance was configured.</li>\n<li><strong>Platform SSO settings discovery</strong> — proves the real Intune Settings Catalog exposes the Platform SSO configuration surface.</li>\n</ol>\n<p>The board proves only the states described above. It does <strong>not</strong> prove macOS endpoint enforcement, recovery-key escrow, Platform SSO registration, or ADE enrollment.</p>\n<h2>Additional validated observations</h2>\n<p>The following real Intune capability observations are documented in the project runbook and were captured during the same session:</p>\n<ul>\n<li>macOS app deployment types included Microsoft Edge, Microsoft 365 Apps, Microsoft Defender for Endpoint, web clips, web links, line-of-business apps, DMG, and PKG.</li>\n<li>macOS inventory was available and showed <strong>0 devices</strong>.</li>\n<li>macOS bulk device actions exposed Delete, Retire, Wipe, Restart, Rename, and Sync.</li>\n<li>Enterprise Wi-Fi exposed WPA-Enterprise and WPA2-Enterprise.</li>\n<li>EAP methods included EAP-FAST, EAP-SIM, EAP-TLS, EAP-TTLS, LEAP, and PEAP.</li>\n<li>macOS SCEP configuration exposed certificate type, subject/SAN, validity, key usage, key size, root certificate, and EKU controls.</li>\n</ul>\n<p>These observations are classified as <strong>REAL CAPABILITY VALIDATION</strong>, not endpoint implementation.</p>\n<h2>Why only a sanitized derivative is published</h2>\n<p>Source screenshots from the working session are retained in the conversation/evidence workflow, but only the sanitized composite is published here. This prevents unnecessary exposure of Apple account identifiers, certificate identifiers, or other tenant-specific details while preserving direct visual proof of the configuration work.</p>\n<h2>Evidence handling rules</h2>\n<ul>\n<li>No Apple account identifier is intentionally published.</li>\n<li>No APNs PEM file, certificate private key, recovery key, enrollment token, ABM token, password, bearer token, session cookie, or MFA secret is stored here.</li>\n<li>No simulated ABM/ADE screenshot is used.</li>\n<li>Documentation, not fabricated portal evidence, is used for simulated Apple Business Manager and Automated Device Enrollment workflows.</li>\n</ul></div></details><details><summary>Implementation <small> / implementation.md</small></summary><div class=\"document\"><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/macos-abm-intune-runbook/implementation.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original source <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation/8381f00c7c09\" data-route=\"documentation/8381f00c7c09\" class=\"\">Open document page</a></div><h2>Implementation</h2>\n<h2>1. Apple MDM Push certificate — REAL CONFIGURATION</h2>\n<p>The Intune Apple enrollment page initially showed the Apple MDM Push Certificate as <strong>Not set up</strong>.</p>\n<p>Implementation sequence:</p>\n<ol>\n<li>Accepted Microsoft's Apple data-sharing permission prompt in Intune.</li>\n<li>Downloaded the Intune certificate signing request (CSR).</li>\n<li>Opened Apple's Push Certificates Portal.</li>\n<li>Accepted Apple's MDM certificate terms.</li>\n<li>Uploaded the Intune-generated CSR.</li>\n<li>Apple issued a new Mobile Device Management push certificate for Microsoft Corporation.</li>\n<li>Downloaded the resulting PEM certificate.</li>\n<li>Returned to Intune.</li>\n<li>Entered the Apple account used to create the certificate.</li>\n<li>Uploaded the PEM certificate.</li>\n<li>Intune reported successful MDM push certificate creation.</li>\n<li>Final Intune state showed the certificate as active.</li>\n</ol>\n<p>Validated expiration: <strong>2027-09-26</strong>.</p>\n<p>No Apple credentials, PEM file, private key material, certificate serial number, or Apple account identifier are published.</p>\n<h2>2. Enrollment Program Token / ADE — SIMULATED / DOCUMENTED</h2>\n<p>The real Intune tenant was used to inspect the Enrollment Program Token workflow.</p>\n<p>Intune exposes the expected sequence:</p>\n<ol>\n<li>Grant Microsoft permission to exchange device/user information with Apple.</li>\n<li>Download the Intune public-key certificate.</li>\n<li>Open Apple Business Manager.</li>\n<li>Create the ABM MDM server relationship.</li>\n<li>Upload the Intune public key in ABM.</li>\n<li>Download the ABM server token.</li>\n<li>Enter the Apple ID used for token ownership.</li>\n<li>Upload the token to Intune.</li>\n<li>Sync assigned devices.</li>\n<li>Create and assign ADE profiles.</li>\n</ol>\n<p>The lab has no Apple Business Manager organization, so no token was created and no device was synchronized.</p>\n<h2>3. macOS compliance baseline — REAL CONFIGURATION</h2>\n<p>Policy:</p>\n<p><code>Project 5 - macOS Enterprise Compliance</code></p>\n<p>Configured settings:</p>\n<ul>\n<li>Require System Integrity Protection.</li>\n<li>Require a password to unlock devices.</li>\n<li>Require encryption of data storage.</li>\n<li>Enable Firewall.</li>\n<li>Enable Stealth Mode.</li>\n<li>Gatekeeper: allow apps from the Mac App Store and identified developers.</li>\n<li>Mark device noncompliant immediately.</li>\n</ul>\n<p>Assignment:</p>\n<ul>\n<li>intentionally unassigned because there is no managed macOS test endpoint.</li>\n</ul>\n<p>Result:</p>\n<ul>\n<li>policy object created successfully in the real Intune tenant;</li>\n<li>monitoring showed 0 devices, which matches the known lab inventory.</li>\n</ul>\n<h2>4. FileVault baseline — REAL CONFIGURATION</h2>\n<p>Policy:</p>\n<p><code>Project 5 - macOS FileVault Baseline</code></p>\n<p>Profile type:</p>\n<ul>\n<li>macOS Settings Catalog.</li>\n</ul>\n<p>Configured controls:</p>\n<ul>\n<li><code>FileVault &gt; Enable = On</code></li>\n<li><code>FileVault Options &gt; Prevent FileVault From Being Disabled = True</code></li>\n<li>recovery-key escrow <code>Location</code> guidance configured.</li>\n</ul>\n<p>The profile was intentionally left unassigned because there is no managed macOS endpoint.</p>\n<p>What is proven:</p>\n<ul>\n<li>the policy exists;</li>\n<li>the configured settings are visible in the real Intune tenant.</li>\n</ul>\n<p>What is not proven:</p>\n<ul>\n<li>FileVault was enabled on a Mac;</li>\n<li>a recovery key was successfully escrowed;</li>\n<li>the recovery key was rotated or recovered.</li>\n</ul>\n<h2>5. Platform SSO — REAL CAPABILITY, DOCUMENTED DEPLOYMENT</h2>\n<p>A macOS Settings Catalog review confirmed:</p>\n<p><code>Authentication &gt; Extensible Single Sign On (SSO) &gt; Platform SSO</code></p>\n<p>The review profile was canceled after capability inspection to avoid leaving a nonfunctional placeholder policy.</p>\n<p>A production deployment would also require a managed macOS endpoint, Company Portal / Microsoft Enterprise SSO plug-in prerequisites, supported macOS version, and actual registration validation.</p>\n<h2>6. Enterprise Wi-Fi — REAL CAPABILITY, DOCUMENTED DEPLOYMENT</h2>\n<p>The macOS Wi-Fi template exposes:</p>\n<ul>\n<li>Device Channel deployment;</li>\n<li>Basic and Enterprise profile types;</li>\n<li>WPA-Enterprise;</li>\n<li>WPA2-Enterprise;</li>\n<li>EAP-FAST;</li>\n<li>EAP-SIM;</li>\n<li>EAP-TLS;</li>\n<li>EAP-TTLS;</li>\n<li>LEAP;</li>\n<li>PEAP;</li>\n<li>proxy options;</li>\n<li>MAC address randomization controls.</li>\n</ul>\n<p>The portfolio design uses <strong>WPA2-Enterprise + EAP-TLS</strong> with trusted-root and client-certificate deployment.</p>\n<p>No fake SSID, RADIUS server, or certificate authority was created.</p>\n<h2>7. Certificate deployment — REAL CAPABILITY, DOCUMENTED ISSUANCE</h2>\n<p>The macOS SCEP certificate template exposes:</p>\n<ul>\n<li>deployment channel;</li>\n<li>certificate type;</li>\n<li>subject name format;</li>\n<li>subject alternative names;</li>\n<li>validity period;</li>\n<li>key usage;</li>\n<li>key size;</li>\n<li>trusted root certificate;</li>\n<li>extended key usage.</li>\n</ul>\n<p>No certificate was issued because the lab does not have a configured enterprise SCEP/PKI path for macOS.</p>\n<h2>8. Application deployment — REAL CAPABILITY</h2>\n<p>The real Intune macOS app surface exposes:</p>\n<ul>\n<li>Microsoft Edge for macOS;</li>\n<li>Microsoft 365 Apps for macOS;</li>\n<li>Microsoft Defender for Endpoint (macOS);</li>\n<li>macOS web clip;</li>\n<li>web link;</li>\n<li>line-of-business app;</li>\n<li>macOS app (DMG);</li>\n<li>macOS app (PKG).</li>\n</ul>\n<p>No placeholder application was created because there is no managed Mac on which to validate installation.</p>\n<h2>9. Enrollment restrictions — REAL VALIDATION</h2>\n<p>Default macOS enrollment restrictions were reviewed.</p>\n<p>Observed state:</p>\n<ul>\n<li>macOS enrollment: Allow.</li>\n<li>personally owned macOS devices: Allow.</li>\n<li>minimum OS: not configured.</li>\n<li>maximum OS: not configured.</li>\n</ul>\n<p>The default tenant-wide restriction was not modified merely for portfolio appearance.</p>\n<h2>10. Inventory and lifecycle — REAL CAPABILITY</h2>\n<p>The macOS inventory page showed <strong>0 devices</strong>.</p>\n<p>The bulk action workflow exposed these macOS actions:</p>\n<ul>\n<li>Delete</li>\n<li>Retire</li>\n<li>Wipe</li>\n<li>Restart</li>\n<li>Rename</li>\n<li>Sync</li>\n</ul>\n<p>No destructive action was executed.</p></div></details><details><summary>Lessons Learned <small> / lessons-learned.md</small></summary><div class=\"document\"><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/macos-abm-intune-runbook/lessons-learned.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original source <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation/8b539b065334\" data-route=\"documentation/8b539b065334\" class=\"\">Open document page</a></div><h2>Lessons Learned</h2>\n<h2>1. Apple management has two control planes</h2>\n<p>Intune can expose Apple enrollment, configuration, compliance, application, and lifecycle administration even when Apple Business Manager is not available. ABM is a separate Apple control plane for organization ownership, device assignment, and ADE.</p>\n<p>Treating these as one system would overstate what was actually implemented.</p>\n<h2>2. APNs is foundational and operationally sensitive</h2>\n<p>The Apple MDM Push certificate is not a one-time setup artifact. It is an annual operational dependency. The same Apple account must remain available for renewal, and the existing certificate relationship should be renewed rather than casually replaced.</p>\n<h2>3. Policy creation is not endpoint validation</h2>\n<p>Creating a macOS compliance policy or FileVault profile in Intune proves administrative configuration capability. It does not prove that a Mac received, enforced, or reported the setting.</p>\n<p>This project intentionally keeps those claims separate.</p>\n<h2>4. Portfolio accuracy is stronger than fabricated completeness</h2>\n<p>ABM, ADE, Platform SSO registration, EAP-TLS authentication, FileVault escrow, and lifecycle execution are valuable concepts, but inventing screenshots or pretending a managed Mac exists would weaken the portfolio.</p>\n<p>A clearly bounded simulation demonstrates sound administration judgment.</p>\n<h2>5. Current Intune design should avoid deprecated templates</h2>\n<p>The deprecated macOS Endpoint Protection template was visible, but FileVault was configured through the current Settings Catalog instead.</p>\n<h2>6. Enterprise Wi-Fi is a dependency chain</h2>\n<p>A Wi-Fi profile alone is not enterprise authentication. EAP-TLS depends on:</p>\n<ul>\n<li>trusted root certificate;</li>\n<li>device/user certificate issuance;</li>\n<li>certificate identity/EKU design;</li>\n<li>RADIUS trust;</li>\n<li>network policy;</li>\n<li>managed endpoint delivery.</li>\n</ul>\n<p>Documenting that dependency chain is more meaningful than creating a fake SSID.</p>\n<h2>7. Lifecycle administration requires ownership context</h2>\n<p>Retire, wipe, delete, restart, rename, and sync are exposed in Intune, but the correct action depends on ownership, incident type, reassignment plan, and data-retention requirements.</p>\n<h2>8. Evidence should prove exactly what the caption claims</h2>\n<p>The evidence gallery pairs each screenshot with a narrow claim. A capability screenshot proves capability. A policy review proves settings. A policy-monitor screenshot proves the policy exists. None are used to imply an enrolled Mac where none exists.</p></div></details><details><summary>Portfolio Summary <small> / portfolio-summary.md</small></summary><div class=\"document\"><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/macos-abm-intune-runbook/portfolio-summary.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original source <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation/45686c1c2a2a\" data-route=\"documentation/45686c1c2a2a\" class=\"\">Open document page</a></div><h2>Portfolio Summary</h2>\n<h2>Recruiter-facing description</h2>\n<p>Designed and documented an enterprise macOS management runbook spanning Apple Business Manager, Microsoft Intune, Automated Device Enrollment, Microsoft Entra authentication, Platform SSO, FileVault, compliance, enterprise Wi-Fi, certificates, application deployment, inventory, and device lifecycle administration. Implemented the Microsoft-side controls that were legitimately available in a real Intune tenant—including APNs, macOS compliance, and a FileVault Settings Catalog profile—while clearly separating ABM/ADE and endpoint-only validation as simulated/documented.</p>\n<h2>Resume bullet</h2>\n<ul>\n<li>Built a portfolio-grade macOS enterprise management runbook integrating Apple Business Manager architecture with Microsoft Intune; configured real APNs, macOS compliance, and FileVault policies, and documented ADE, Platform SSO, EAP-TLS certificate Wi-Fi, application deployment, renewal, and lifecycle operations with explicit validation boundaries.</li>\n</ul>\n<h2>LinkedIn project description</h2>\n<p>Created an enterprise macOS management project focused on accurate operational design rather than fabricated completeness. In a real Microsoft Intune tenant, I configured an Apple MDM Push certificate, created a macOS compliance baseline, built a FileVault Settings Catalog profile, and validated available Platform SSO, enterprise Wi-Fi, certificate, app-deployment, inventory, and lifecycle controls. Because I do not have an Apple Business Manager organization or managed Mac in this lab, ADE, ABM token exchange, endpoint Platform SSO, FileVault escrow, and destructive lifecycle operations are clearly documented as simulated procedures instead of being presented as completed production work.</p>\n<h2>Interview explanation</h2>\n<blockquote>\n<p>I wanted the project to show both technical knowledge and administrative judgment. I used the real Intune tenant for everything I could legitimately configure, including APNs, compliance, and FileVault. I also inspected the real Platform SSO, Wi-Fi, SCEP, app, inventory, and lifecycle surfaces. The Apple Business Manager and ADE portions are documented as simulations because I do not have an ABM organization or enrolled Mac. That boundary matters because creating an Intune policy is not the same as proving endpoint enforcement.</p>\n</blockquote></div></details><details><summary>Renewal Calendar and Operational Ownership <small> / renewal-calendar.md</small></summary><div class=\"document\"><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/macos-abm-intune-runbook/renewal-calendar.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original source <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation/9fab6a424a55\" data-route=\"documentation/9fab6a424a55\" class=\"\">Open document page</a></div><h2>Renewal Calendar and Operational Ownership</h2>\n<h2>Renewal schedule</h2>\n<div class=\"table-scroll\"><table>\n<thead>\n<tr>\n<th>Item</th>\n<th>Cadence</th>\n<th>Current / planned date</th>\n<th>Owner responsibility</th>\n<th>Validation</th>\n</tr>\n</thead>\n<tbody>\n<tr>\n<td>Apple MDM Push certificate (APNs)</td>\n<td>Annual</td>\n<td>Expires <strong>2027-09-26</strong></td>\n<td>Renew with the same Apple account before expiration</td>\n<td>Confirm Intune status and expiration</td>\n</tr>\n<tr>\n<td>ABM / Intune Enrollment Program Token</td>\n<td>Annual</td>\n<td>Not created in this lab</td>\n<td>Renew existing ABM server token before expiration</td>\n<td>Sync devices and confirm token state</td>\n</tr>\n<tr>\n<td>SCEP/PKCS issuing certificate chain</td>\n<td>Based on PKI policy</td>\n<td>SIMULATED / DOCUMENTED</td>\n<td>Track CA and connector certificate expiration</td>\n<td>Test issuance before renewal window</td>\n</tr>\n<tr>\n<td>Wi-Fi/RADIUS server certificates</td>\n<td>Based on PKI policy</td>\n<td>SIMULATED / DOCUMENTED</td>\n<td>Renew before trust expires</td>\n<td>EAP-TLS test from pilot Mac</td>\n</tr>\n<tr>\n<td>Application packages</td>\n<td>Continuous</td>\n<td>N/A</td>\n<td>Review new versions, signing, compatibility</td>\n<td>Pilot deployment</td>\n</tr>\n<tr>\n<td>macOS compliance baseline</td>\n<td>At least quarterly + OS release</td>\n<td>N/A</td>\n<td>Review minimum OS/security requirements</td>\n<td>Test on pilot group</td>\n</tr>\n<tr>\n<td>Platform SSO profile</td>\n<td>At OS/Company Portal changes</td>\n<td>N/A</td>\n<td>Review supported settings and registration behavior</td>\n<td>Pilot sign-in validation</td>\n</tr>\n<tr>\n<td>FileVault policy</td>\n<td>At security baseline review</td>\n<td>N/A</td>\n<td>Confirm policy and recovery workflow</td>\n<td>Escrow + recovery test on pilot Mac</td>\n</tr>\n</tbody>\n</table></div>\n<h2>APNs renewal procedure</h2>\n<ol>\n<li>Start renewal well before expiration.</li>\n<li>Identify the Apple account that owns the existing certificate.</li>\n<li>In Intune, confirm the existing APNs certificate identity.</li>\n<li>Open Apple's Push Certificates Portal using the same owning Apple account.</li>\n<li>Renew the existing certificate.</li>\n<li>Download the renewed certificate.</li>\n<li>Upload it into the existing Intune APNs configuration.</li>\n<li>Confirm status and new expiration.</li>\n<li>Record the renewal date and next renewal deadline.</li>\n<li>Do not publish certificate material or Apple-account identifiers.</li>\n</ol>\n<h2>ABM token renewal procedure</h2>\n<p><strong>SIMULATED / DOCUMENTED</strong></p>\n<ol>\n<li>Confirm the existing Intune Enrollment Program Token and corresponding ABM MDM server.</li>\n<li>Sign in to ABM with an authorized account.</li>\n<li>Download a renewed server token for the same MDM server.</li>\n<li>Upload it to the existing Intune token object.</li>\n<li>Synchronize devices.</li>\n<li>Confirm device count and token expiration.</li>\n<li>Record renewal ownership.</li>\n</ol>\n<h2>Operational rule</h2>\n<p>Renew existing trust relationships whenever continuity is required. Replacing APNs certificates or recreating ABM MDM server relationships without a change reason can break management continuity.</p></div></details><details><summary>Simulated Enterprise Deployment Scenario <small> / simulated-deployment-scenario.md</small></summary><div class=\"document\"><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/macos-abm-intune-runbook/simulated-deployment-scenario.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original source <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation/7aa5e620028b\" data-route=\"documentation/7aa5e620028b\" class=\"\">Open document page</a></div><h2>Simulated Enterprise Deployment Scenario</h2>\n<h2>Scenario</h2>\n<p>A company purchases a batch of corporate Macs from an Apple-authorized reseller. The devices are automatically assigned to the organization's Apple Business Manager tenant and then to Microsoft Intune.</p>\n<p>This scenario is <strong>SIMULATED / DOCUMENTED</strong>. It is used to demonstrate the intended operational sequence without claiming that an ABM tenant or physical managed Mac exists in this lab.</p>\n<h2>Workflow</h2>\n<ol>\n<li><strong>Procurement</strong></li>\n<li>\n<p>Reseller associates devices with the ABM organization.</p>\n</li>\n<li>\n<p><strong>Apple Business Manager</strong></p>\n</li>\n<li>Devices appear in ABM.</li>\n<li>\n<p>Administrator assigns them to the Microsoft Intune MDM server.</p>\n</li>\n<li>\n<p><strong>Enrollment Program Token</strong></p>\n</li>\n<li>\n<p>Intune synchronizes assigned devices from ABM.</p>\n</li>\n<li>\n<p><strong>ADE profile</strong></p>\n</li>\n<li>Corporate enrollment profile is assigned.</li>\n<li>\n<p>Required Setup Assistant panes are shown or skipped according to policy.</p>\n</li>\n<li>\n<p><strong>Setup Assistant</strong></p>\n</li>\n<li>Device connects to the network.</li>\n<li>Apple activation identifies the device as organization-managed.</li>\n<li>\n<p>Remote management begins.</p>\n</li>\n<li>\n<p><strong>Microsoft Entra authentication</strong></p>\n</li>\n<li>\n<p>User authenticates with organizational identity.</p>\n</li>\n<li>\n<p><strong>Intune enrollment</strong></p>\n</li>\n<li>\n<p>Device becomes managed and appears in inventory.</p>\n</li>\n<li>\n<p><strong>Security baseline</strong></p>\n</li>\n<li>Compliance evaluates System Integrity Protection, password state, encryption, firewall, Stealth Mode, and Gatekeeper.</li>\n<li>\n<p>FileVault policy enables encryption and recovery-key escrow.</p>\n</li>\n<li>\n<p><strong>Identity</strong></p>\n</li>\n<li>\n<p>Platform SSO registration links the local macOS sign-in experience with Microsoft Entra according to the chosen authentication method.</p>\n</li>\n<li>\n<p><strong>Enterprise Wi-Fi</strong></p>\n<ul>\n<li>Trusted root certificate and client certificate are delivered.</li>\n<li>WPA2-Enterprise / EAP-TLS profile connects the device to corporate wireless.</li>\n</ul>\n</li>\n<li>\n<p><strong>Applications</strong></p>\n<ul>\n<li>Required productivity/security applications install from Intune.</li>\n</ul>\n</li>\n<li>\n<p><strong>Operations</strong></p>\n<ul>\n<li>Help desk/admin teams use inventory, sync, restart, rename, retire, wipe, and reassignment workflows according to policy.</li>\n</ul>\n</li>\n</ol>\n<h2>Validation checkpoints</h2>\n<p>A real deployment would not be marked complete until the following were observed on an enrolled Mac:</p>\n<ul>\n<li>ADE profile applied during Setup Assistant;</li>\n<li>Entra authentication succeeds;</li>\n<li>device appears in Intune;</li>\n<li>configuration profiles report success;</li>\n<li>FileVault is enabled;</li>\n<li>recovery key is escrowed;</li>\n<li>compliance reports compliant;</li>\n<li>required apps install;</li>\n<li>Platform SSO registration succeeds;</li>\n<li>enterprise Wi-Fi authenticates;</li>\n<li>lifecycle actions behave as expected.</li>\n</ul></div></details><details><summary>Troubleshooting Runbook <small> / troubleshooting.md</small></summary><div class=\"document\"><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/macos-abm-intune-runbook/troubleshooting.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original source <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation/980d98ed3406\" data-route=\"documentation/980d98ed3406\" class=\"\">Open document page</a></div><h2>Troubleshooting Runbook</h2>\n<p>Every troubleshooting scenario below distinguishes between actions that can be performed in Intune now and actions that require Apple Business Manager or an enrolled Mac.</p>\n<h2>Device not appearing in Apple Business Manager</h2>\n<p><strong>Classification:</strong> SIMULATED / DOCUMENTED</p>\n<p>Check:</p>\n<ol>\n<li>Purchase source is an Apple-authorized reseller or Apple direct channel that supports ABM assignment.</li>\n<li>Organization ID and reseller/customer identifiers are correct.</li>\n<li>Device serial is eligible for automated assignment.</li>\n<li>Reseller has assigned the device to the correct ABM organization.</li>\n<li>ABM sync/import has completed.</li>\n</ol>\n<p>Do not troubleshoot Intune until the device exists in ABM.</p>\n<h2>Device not synchronizing from ABM to Intune</h2>\n<p><strong>Classification:</strong> SIMULATED / DOCUMENTED</p>\n<p>Check:</p>\n<ol>\n<li>Enrollment Program Token has not expired.</li>\n<li>Token was created for the correct ABM MDM server.</li>\n<li>Device is assigned to that MDM server in ABM.</li>\n<li>Intune token sync completes without error.</li>\n<li>Device serial appears under the correct token.</li>\n</ol>\n<p>If the token has expired, renew the existing relationship rather than creating an unrelated replacement unless the relationship is intentionally being rebuilt.</p>\n<h2>ADE profile not assigned</h2>\n<p>Check:</p>\n<ul>\n<li>device exists under the Enrollment Program Token;</li>\n<li>device was synchronized after assignment;</li>\n<li>profile assignment scope includes the device;</li>\n<li>no competing assignment exists;</li>\n<li>profile is active.</li>\n</ul>\n<h2>Setup Assistant does not show expected panes</h2>\n<p>Check:</p>\n<ul>\n<li>device is actually using ADE;</li>\n<li>device has been erased/reset after the ADE assignment;</li>\n<li>latest ADE profile has synchronized;</li>\n<li>skipped Setup Assistant panes match the assigned profile;</li>\n<li>network access to Apple activation services is available.</li>\n</ul>\n<h2>APNs communication problems</h2>\n<p><strong>REAL operational dependency</strong></p>\n<p>Check:</p>\n<ul>\n<li>Intune Apple MDM Push Certificate status;</li>\n<li>certificate expiration date;</li>\n<li>same Apple account ownership used for renewal;</li>\n<li>certificate was renewed rather than replaced;</li>\n<li>device can reach Apple Push Notification service.</li>\n</ul>\n<p>Replacing instead of renewing the APNs certificate can sever management continuity and should be treated as a high-risk administrative change.</p>\n<h2>Company Portal / Entra authentication failure</h2>\n<p>Check:</p>\n<ul>\n<li>user can authenticate to Microsoft Entra;</li>\n<li>user is licensed for required Intune services;</li>\n<li>device time is correct;</li>\n<li>Conditional Access does not unintentionally block enrollment;</li>\n<li>Company Portal is supported on the installed macOS version;</li>\n<li>browser/web authentication completes successfully.</li>\n</ul>\n<h2>Platform SSO registration failure</h2>\n<p><strong>Classification:</strong> SIMULATED / DOCUMENTED endpoint procedure</p>\n<p>Check:</p>\n<ul>\n<li>supported macOS version;</li>\n<li>Company Portal / Enterprise SSO plug-in prerequisites;</li>\n<li>Platform SSO profile is assigned;</li>\n<li>extension identifier and team identifier are correct;</li>\n<li>user completed required registration;</li>\n<li>Entra sign-in logs for authentication failures;</li>\n<li>profile conflicts or duplicate SSO payloads.</li>\n</ul>\n<h2>FileVault not enabling</h2>\n<p>Check:</p>\n<ul>\n<li>FileVault policy assignment;</li>\n<li>device is supervised/managed as required by the chosen workflow;</li>\n<li>user has secure token capability where required;</li>\n<li>no conflicting FileVault payload exists;</li>\n<li>device has checked in after policy assignment;</li>\n<li>Intune per-setting status for policy errors.</li>\n</ul>\n<h2>FileVault recovery key not escrowed</h2>\n<p>Check:</p>\n<ul>\n<li>FileVault is actually enabled;</li>\n<li>recovery-key escrow policy is assigned;</li>\n<li>device has checked in after FileVault activation;</li>\n<li>personal recovery key exists;</li>\n<li>recovery key is visible in the authorized Intune recovery workflow;</li>\n<li>no policy conflict is present.</li>\n</ul>\n<p>Never collect or publish the actual recovery key in portfolio evidence.</p>\n<h2>Compliance failure</h2>\n<p>Check each configured requirement individually:</p>\n<ul>\n<li>System Integrity Protection;</li>\n<li>password requirement;</li>\n<li>storage encryption;</li>\n<li>firewall;</li>\n<li>Stealth Mode;</li>\n<li>Gatekeeper state.</li>\n</ul>\n<p>Use per-setting compliance status rather than guessing from the overall state.</p>\n<h2>Enterprise Wi-Fi failure</h2>\n<p>Check:</p>\n<ul>\n<li>SSID spelling;</li>\n<li>security type;</li>\n<li>EAP type;</li>\n<li>trusted root certificate;</li>\n<li>client certificate availability;</li>\n<li>certificate subject/SAN requirements;</li>\n<li>certificate EKU;</li>\n<li>RADIUS trust chain;</li>\n<li>device time;</li>\n<li>wireless controller/NPS/RADIUS logs.</li>\n</ul>\n<p>For EAP-TLS, troubleshoot certificate trust and identity before user credentials because the design is certificate-based.</p>\n<h2>Application deployment failure</h2>\n<p>Check:</p>\n<ul>\n<li>app type matches packaging format;</li>\n<li>package is signed and compatible with the target macOS version;</li>\n<li>assignment is correct;</li>\n<li>detection logic/version metadata is valid;</li>\n<li>required privacy/system extension settings are deployed;</li>\n<li>device has checked in;</li>\n<li>Intune app install status and local logs.</li>\n</ul>\n<h2>Expired Enrollment Program Token</h2>\n<p>Renew through the existing Apple Business Manager server relationship and upload the renewed token to Intune. Confirm the device count and sync after renewal.</p>\n<h2>Device retirement</h2>\n<p>For user offboarding or BYOD-style management removal, prefer the least destructive action that satisfies the requirement. Preserve corporate data handling policy and confirm whether retire removes managed configuration without factory reset.</p>\n<h2>Lost or stolen device</h2>\n<p>Escalate according to organization policy. Evaluate wipe, lock-related capabilities, identity-session revocation, certificate revocation, and asset reporting. Do not execute destructive actions without identity and ownership verification.</p></div></details><details><summary>Validation <small> / validation.md</small></summary><div class=\"document\"><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/macos-abm-intune-runbook/validation.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original source <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation/57955486d8ae\" data-route=\"documentation/57955486d8ae\" class=\"\">Open document page</a></div><h2>Validation</h2>\n<h2>Final validation matrix</h2>\n<div class=\"table-scroll\"><table>\n<thead>\n<tr>\n<th>Capability</th>\n<th>Real / Simulated</th>\n<th>Configured</th>\n<th>Validated</th>\n<th>Evidence</th>\n<th>Status</th>\n</tr>\n</thead>\n<tbody>\n<tr>\n<td>Intune Apple enrollment administration</td>\n<td>Real</td>\n<td>Yes</td>\n<td>Yes</td>\n<td>Apple enrollment baseline</td>\n<td>COMPLETE</td>\n</tr>\n<tr>\n<td>APNs certificate creation</td>\n<td>Real</td>\n<td>Yes</td>\n<td>Yes</td>\n<td>Apple Push Certificates Portal confirmation</td>\n<td>COMPLETE</td>\n</tr>\n<tr>\n<td>APNs upload to Intune</td>\n<td>Real</td>\n<td>Yes</td>\n<td>Yes</td>\n<td>Intune upload confirmation</td>\n<td>COMPLETE</td>\n</tr>\n<tr>\n<td>ABM organization</td>\n<td>Simulated</td>\n<td>No</td>\n<td>No</td>\n<td>Architecture/runbook only</td>\n<td>SIMULATED / DOCUMENTED</td>\n</tr>\n<tr>\n<td>Enrollment Program Token</td>\n<td>Simulated</td>\n<td>No</td>\n<td>Workflow only</td>\n<td>Token creation page reviewed</td>\n<td>SIMULATED / DOCUMENTED</td>\n</tr>\n<tr>\n<td>ADE device synchronization</td>\n<td>Simulated</td>\n<td>No</td>\n<td>No</td>\n<td>Runbook only</td>\n<td>SIMULATED / DOCUMENTED</td>\n</tr>\n<tr>\n<td>ADE profile</td>\n<td>Simulated</td>\n<td>No</td>\n<td>No</td>\n<td>Runbook only</td>\n<td>SIMULATED / DOCUMENTED</td>\n</tr>\n<tr>\n<td>macOS compliance policy</td>\n<td>Real</td>\n<td>Yes</td>\n<td>Policy object yes</td>\n<td>Review + policy monitor</td>\n<td>COMPLETE</td>\n</tr>\n<tr>\n<td>Compliance on enrolled Mac</td>\n<td>Simulated</td>\n<td>No</td>\n<td>No</td>\n<td>No enrolled Mac</td>\n<td>NOT VALIDATED</td>\n</tr>\n<tr>\n<td>FileVault policy</td>\n<td>Real</td>\n<td>Yes</td>\n<td>Policy object yes</td>\n<td>Settings + policy list</td>\n<td>COMPLETE</td>\n</tr>\n<tr>\n<td>FileVault encryption on Mac</td>\n<td>Simulated</td>\n<td>No</td>\n<td>No</td>\n<td>No enrolled Mac</td>\n<td>NOT VALIDATED</td>\n</tr>\n<tr>\n<td>Recovery-key escrow</td>\n<td>Simulated</td>\n<td>Policy intent only</td>\n<td>No</td>\n<td>No enrolled Mac</td>\n<td>NOT VALIDATED</td>\n</tr>\n<tr>\n<td>Platform SSO capability</td>\n<td>Real</td>\n<td>No policy retained</td>\n<td>Yes</td>\n<td>Settings Catalog capability</td>\n<td>VALIDATED</td>\n</tr>\n<tr>\n<td>Platform SSO endpoint registration</td>\n<td>Simulated</td>\n<td>No</td>\n<td>No</td>\n<td>No enrolled Mac</td>\n<td>SIMULATED / DOCUMENTED</td>\n</tr>\n<tr>\n<td>Enterprise Wi-Fi capability</td>\n<td>Real</td>\n<td>No policy retained</td>\n<td>Yes</td>\n<td>Enterprise profile settings</td>\n<td>VALIDATED</td>\n</tr>\n<tr>\n<td>EAP-TLS availability</td>\n<td>Real</td>\n<td>No policy retained</td>\n<td>Yes</td>\n<td>EAP dropdown</td>\n<td>VALIDATED</td>\n</tr>\n<tr>\n<td>SCEP profile capability</td>\n<td>Real</td>\n<td>No policy retained</td>\n<td>Yes</td>\n<td>SCEP configuration surface</td>\n<td>VALIDATED</td>\n</tr>\n<tr>\n<td>Certificate issuance</td>\n<td>Simulated</td>\n<td>No</td>\n<td>No</td>\n<td>No enterprise PKI/SCEP path</td>\n<td>SIMULATED / DOCUMENTED</td>\n</tr>\n<tr>\n<td>macOS app deployment capability</td>\n<td>Real</td>\n<td>No app retained</td>\n<td>Yes</td>\n<td>App type selector</td>\n<td>VALIDATED</td>\n</tr>\n<tr>\n<td>App install on Mac</td>\n<td>Simulated</td>\n<td>No</td>\n<td>No</td>\n<td>No enrolled Mac</td>\n<td>NOT VALIDATED</td>\n</tr>\n<tr>\n<td>macOS enrollment restrictions</td>\n<td>Real</td>\n<td>Existing default</td>\n<td>Yes</td>\n<td>Restriction properties</td>\n<td>VALIDATED</td>\n</tr>\n<tr>\n<td>macOS device inventory</td>\n<td>Real</td>\n<td>N/A</td>\n<td>Yes</td>\n<td>0-device inventory page</td>\n<td>VALIDATED</td>\n</tr>\n<tr>\n<td>Bulk device actions</td>\n<td>Real capability</td>\n<td>N/A</td>\n<td>Yes</td>\n<td>Action list</td>\n<td>VALIDATED</td>\n</tr>\n<tr>\n<td>Retire / wipe execution</td>\n<td>Simulated</td>\n<td>No</td>\n<td>No</td>\n<td>No enrolled Mac</td>\n<td>SIMULATED / DOCUMENTED</td>\n</tr>\n<tr>\n<td>Device reassignment</td>\n<td>Simulated</td>\n<td>No</td>\n<td>No</td>\n<td>Lifecycle runbook</td>\n<td>SIMULATED / DOCUMENTED</td>\n</tr>\n</tbody>\n</table></div>\n<h2>Evidence interpretation</h2>\n<p>A screenshot proving that an Intune configuration surface exists is classified as <strong>capability validation</strong>, not endpoint implementation.</p>\n<p>A policy object created in Intune is classified as <strong>REAL CONFIGURATION</strong>.</p>\n<p>A result that requires an enrolled Mac is not marked validated unless an actual device reports the state.</p>\n<h2>Evidence index</h2>\n<p>See <a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/macos-abm-intune-runbook/evidence/README.md\" rel=\"noopener noreferrer\" target=\"_blank\">evidence/README.md</a> and the live <a href=\"https://jeremyfontenot.online/projects/macos-abm-intune-runbook/evidence/\" rel=\"noopener noreferrer\" target=\"_blank\">evidence gallery</a>.</p></div></details></section><section class=\"content-block\" id=\"troubleshooting\"><h2>Troubleshooting</h2><p>Troubleshooting procedures distinguish actual Intune configuration from hypothetical ABM/ADE and managed-Mac failures. No endpoint remediation is presented as executed without an enrolled Mac.</p><div class=\"doc-grid\"><a href=\"#documentation/980d98ed3406\" data-route=\"documentation/980d98ed3406\" class=\"\">Troubleshooting Runbook<small>projects/macos-abm-intune-runbook/troubleshooting.md</small></a></div></section><section class=\"content-block\" id=\"validation\"><h2>Validation & results</h2><p>APNs, compliance, FileVault Settings Catalog, and capability review are documented. ABM/ADE and managed-Mac enforcement remain simulation/documentation.</p><div class=\"doc-grid\"><a href=\"#documentation/57955486d8ae\" data-route=\"documentation/57955486d8ae\" class=\"\">Validation<small>projects/macos-abm-intune-runbook/validation.md</small></a></div></section><section class=\"content-block\" id=\"evidence\"><h2>Evidence</h2><p>STRONG for Microsoft/Apple-side configuration actually performed; appropriately documentary for simulated portions.</p><div class=\"doc-grid\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/macos-abm-intune-runbook/README.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">README.md<small>Retained documentation supporting macOS ABM to Intune Enterprise Runbook.</small> <span aria-hidden=\"true\">↗</span></a><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/macos-abm-intune-runbook/architecture.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">architecture.md<small>Retained documentation supporting macOS ABM to Intune Enterprise Runbook.</small> <span aria-hidden=\"true\">↗</span></a><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/macos-abm-intune-runbook/device-lifecycle.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">device-lifecycle.md<small>Retained documentation supporting macOS ABM to Intune Enterprise Runbook.</small> <span aria-hidden=\"true\">↗</span></a><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/macos-abm-intune-runbook/evidence/README.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">README.md<small>Retained documentation supporting macOS ABM to Intune Enterprise Runbook.</small> <span aria-hidden=\"true\">↗</span></a><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/macos-abm-intune-runbook/evidence/index.html\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">index.html<small>Retained documentation supporting macOS ABM to Intune Enterprise Runbook.</small> <span aria-hidden=\"true\">↗</span></a><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/macos-abm-intune-runbook/implementation.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">implementation.md<small>Retained documentation supporting macOS ABM to Intune Enterprise Runbook.</small> <span aria-hidden=\"true\">↗</span></a><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/macos-abm-intune-runbook/lessons-learned.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">lessons-learned.md<small>Retained documentation supporting macOS ABM to Intune Enterprise Runbook.</small> <span aria-hidden=\"true\">↗</span></a><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/macos-abm-intune-runbook/portfolio-summary.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">portfolio-summary.md<small>Retained documentation supporting macOS ABM to Intune Enterprise Runbook.</small> <span aria-hidden=\"true\">↗</span></a><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/macos-abm-intune-runbook/renewal-calendar.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">renewal-calendar.md<small>Retained documentation supporting macOS ABM to Intune Enterprise Runbook.</small> <span aria-hidden=\"true\">↗</span></a><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/macos-abm-intune-runbook/simulated-deployment-scenario.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">simulated-deployment-scenario.md<small>Retained documentation supporting macOS ABM to Intune Enterprise Runbook.</small> <span aria-hidden=\"true\">↗</span></a></div><div class=\"source-links\"><a href=\"#evidence\" data-route=\"evidence\" class=\"\">Browse and filter the complete evidence library</a><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/tree/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/macos-abm-intune-runbook/\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">GitHub project source <span aria-hidden=\"true\">↗</span></a></div></section><section class=\"content-block\" id=\"skills\"><h2>Skills demonstrated</h2><div class=\"tags\"><span class=\"tag\">Intune</span><span class=\"tag\">APNs</span><span class=\"tag\">FileVault</span><span class=\"tag\">ABM / ADE simulation</span></div><a href=\"#skills\" data-route=\"skills\" class=\"\">View the complete capability map →</a></section><section class=\"content-block\" id=\"limitations\"><h2>Limitations & claim boundaries</h2><div class=\"note\">Real configuration includes APNs, macOS compliance, FileVault Settings Catalog, enrollment restriction review, and capability review. ABM organization, ADE assignment/enrollment, managed-Mac Platform SSO, live PKI/SCEP issuance, RADIUS auth, FileVault escrow from a managed Mac, managed-Mac compliance evaluation, app installation, and destructive lifecycle actions were not performed and must not be claimed as implemented.</div></section><section class=\"content-block\" id=\"next\"><h2>Next milestones</h2><p>Maintain/renew the APNs certificate before 2027-09-26 and preserve the simulated boundary unless a legitimate ABM/ADE/managed-Mac environment becomes available.</p></section></article></div><section class=\"section\"><p class=\"eyebrow\">Continue exploring</p><h2>Related projects</h2><div class=\"grid grid-2\"><article class=\"project-card\" data-project data-category=\"Endpoint management\" data-search=\"windows autopilot &amp; intune mdm provisioning physical-device provisioning through branded oobe, esp, entra join, security policy, and final intune compliance. autopilot intune entra join bitlocker\"><div class=\"card-head\"><span class=\"project-number\">PROJECT 11</span><span class=\"status\">COMPLETE</span></div><h3><a href=\"#projects/windows-autopilot-intune\" data-route=\"projects/windows-autopilot-intune\" class=\"\">Windows Autopilot &amp; Intune MDM Provisioning</a></h3><p>Physical-device provisioning through branded OOBE, ESP, Entra join, security policy, and final Intune compliance.</p><div class=\"tags\"><span class=\"tag\">Autopilot</span><span class=\"tag\">Intune</span><span class=\"tag\">Entra join</span><span class=\"tag\">BitLocker</span></div><div class=\"card-footer\"><a href=\"#projects/windows-autopilot-intune\" data-route=\"projects/windows-autopilot-intune\" class=\"\">Read case study <span class=arrow>↗</span></a><a href=\"#evidence\" data-route=\"evidence\" class=\"text-link\">Evidence</a></div></article></div></section>",
    "active": "Projects"
  },
  "projects/m365-graph-administration-lab": {
    "title": "Microsoft 365 Graph Administration Lab",
    "description": "Seven validated read-only scripts for tenant, user, group, license, role, stale-account, and Intune reporting.",
    "body": "<div class=\"page-heading\"><p class=\"eyebrow\">Project 13 / Automation</p><h1>Microsoft 365 Graph Administration Lab</h1><p class=\"lead\">Seven validated read-only scripts for tenant, user, group, license, role, stale-account, and Intune reporting.</p><div class=\"tags\"><span class=\"status\">COMPLETE</span><span class=\"tag\">Developer environment</span></div><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/tree/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/m365-graph-administration-lab/\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">GitHub documentation <span aria-hidden=\"true\">↗</span></a><a href=\"https://jeremyfontenot.online/m365-graph-administration-lab.html\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original portfolio <span aria-hidden=\"true\">↗</span></a><a href=\"#evidence\" data-route=\"evidence\" class=\"\">Evidence library</a></div></div><div class=\"case-layout\"><aside class=\"case-toc\"><p class=\"eyebrow\">Inside this case study</p><a href=\"#overview\" data-anchor=\"overview\">Overview</a><a href=\"#scenario\" data-anchor=\"scenario\">Operational scenario & objectives</a><a href=\"#environment\" data-anchor=\"environment\">Environment & technologies</a><a href=\"#architecture\" data-anchor=\"architecture\">Architecture</a><a href=\"#implementation\" data-anchor=\"implementation\">Implementation & administration</a><a href=\"#troubleshooting\" data-anchor=\"troubleshooting\">Troubleshooting</a><a href=\"#validation\" data-anchor=\"validation\">Validation & results</a><a href=\"#evidence\" data-anchor=\"evidence\">Evidence</a><a href=\"#skills\" data-anchor=\"skills\">Skills demonstrated</a><a href=\"#limitations\" data-anchor=\"limitations\">Limitations & claim boundaries</a><a href=\"#next\" data-anchor=\"next\">Next milestones</a></aside><article><section class=\"content-block\" id=\"overview\"><h2>Overview</h2><p>Seven validated read-only scripts for tenant, user, group, license, role, stale-account, and Intune reporting.</p><p><strong>Classification:</strong> Developer environment.</p></section><section class=\"content-block\" id=\"scenario\"><h2>Operational scenario & objectives</h2><p>Create reusable read-only administrative reporting with appropriate delegated scopes, pagination, CSV output, and evidence of troubleshooting.</p></section><section class=\"content-block\" id=\"environment\"><h2>Environment & technologies</h2><p>Microsoft 365 E5 Developer tenant; Microsoft.Graph.Authentication, delegated Device Code authentication, Graph v1.0 GET requests, and local CSV reports.</p><div class=\"tags\"><span class=\"tag\">Microsoft Graph</span><span class=\"tag\">PowerShell</span><span class=\"tag\">REST API</span><span class=\"tag\">CSV</span></div></section><section class=\"content-block\" id=\"architecture\"><h2>Architecture</h2><p>Microsoft 365 E5 Developer tenant; Microsoft.Graph.Authentication, delegated Device Code authentication, Graph v1.0 GET requests, and local CSV reports.</p><div class=\"doc-grid\"></div></section><section class=\"content-block\" id=\"implementation\"><h2>Implementation & administration</h2><div class=\"imported\"><section class=\"page-hero\"><div class=\"wrap\"><p class=\"eyebrow\">Project 13 · COMPLETE</p><h2>Microsoft 365 Graph Administration Lab</h2><p class=\"lead\">Validated read-only Microsoft Graph administration and reporting automation across Microsoft 365, Entra ID, and Intune, with least-privilege delegated access and evidence-backed troubleshooting.</p><div class=\"actions\"><a class=\"button primary\" data-route=\"projects\" href=\"#projects\">Back to projects</a><a class=\"button\" data-route=\"evidence\" href=\"#evidence\">Review proof index</a></div></div></section><section class=\"section\"><div class=\"wrap\"><div class=\"metric-strip\"><div class=\"metric\"><strong>7 scripts</strong><span>Validated</span></div><div class=\"metric\"><strong>Microsoft Graph</strong><span>REST + PowerShell</span></div><div class=\"metric\"><strong>Read-only</strong><span>Current scope</span></div><div class=\"metric\"><strong>Intune</strong><span>Integrated</span></div></div></div></section><section class=\"section\"><div class=\"wrap case-layout\"><article><section class=\"content-block\" id=\"source-1388e3fc-scope\"><p class=\"eyebrow\">Scope</p><h2>Reusable read-only Microsoft 365 administration tooling</h2><p>The lab uses a Microsoft 365 E5 Developer tenant to build reusable administration and reporting scripts without creating meaningless tenant activity. Current work is intentionally read-only and focuses on tenant inventory, identity, licensing, directory roles, sign-in activity, and Intune managed-device reporting.</p></section><section class=\"content-block\" id=\"source-1388e3fc-authentication\"><p class=\"eyebrow\">Authentication</p><h2>Delegated Device Code with required-scope validation</h2><p>Scripts use the Microsoft Graph PowerShell authentication module with delegated permissions. The stale-account and Intune scripts validate the active Graph context before reuse and reconnect when required scopes are missing.</p></section><section class=\"content-block\" id=\"source-1388e3fc-graph\"><p class=\"eyebrow\">Microsoft Graph</p><h2>REST endpoints, pagination, and PowerShell 5.1 compatibility</h2><p>The lab exercises organization, users, groups, group membership, subscribed SKUs, directory roles, directory-role members, devices, and Intune managed-device endpoints. Collection helpers follow <strong>@odata.nextLink</strong>, and hashtable-style response handling is used for Windows PowerShell 5.1 compatibility.</p></section><section class=\"content-block\" id=\"source-1388e3fc-validation\"><p class=\"eyebrow\">Validated results</p><h2>Point-in-time tenant and device reporting</h2><p>Validated results currently include 3 domains, 22 users, 12 groups, 1 subscribed SKU, 4 activated directory roles, 2 Entra devices, 19 licensed users, 3 unlicensed users, and 1 compliant encrypted Intune managed device. These values are documented as a point-in-time lab snapshot rather than permanent tenant state.</p></section><section class=\"content-block\" id=\"source-1388e3fc-troubleshooting\"><p class=\"eyebrow\">Troubleshooting</p><h2>Permission and query failures preserved as evidence</h2><p>A directory-role membership query returned 400 Bad Request until an unsupported <strong>$top</strong> parameter was removed. A stale-account query returned 403 Forbidden until <strong>AuditLog.Read.All</strong> was added and the Graph session was reauthenticated. These failures and corrections are documented instead of hidden.</p></section><section class=\"content-block\" id=\"source-1388e3fc-security\"><p class=\"eyebrow\">Publication boundary</p><h2>Reusable code public; live tenant exports withheld</h2><p>The GitHub project publishes reusable scripts and sanitized validation notes. Live CSV exports are intentionally excluded because they can contain user principal names, object IDs, device identifiers, serial numbers, and other tenant-specific data.</p></section><section class=\"content-block\" id=\"source-1388e3fc-evidence\"><p class=\"eyebrow\">Evidence</p><h2>Sanitized validation</h2><ul class=\"evidence-list\"><li><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/tree/main/projects/m365-graph-administration-lab\" rel=\"noopener noreferrer\" target=\"_blank\">GitHub lab<span>Scripts, README, and troubleshooting documentation</span></a></li><li><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/main/projects/m365-graph-administration-lab/scripts/Get-M365TenantInventory.ps1\" rel=\"noopener noreferrer\" target=\"_blank\">Tenant inventory script<span>Organization, users, groups, SKUs, roles, and Entra devices</span></a></li><li><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/main/projects/m365-graph-administration-lab/scripts/Get-M365UserInventory.ps1\" rel=\"noopener noreferrer\" target=\"_blank\">User inventory script<span>User state, sync state, and license mapping</span></a></li><li><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/main/projects/m365-graph-administration-lab/scripts/Get-M365GroupMembership.ps1\" rel=\"noopener noreferrer\" target=\"_blank\">Group membership script<span>Group inventory and direct member reporting</span></a></li><li><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/main/projects/m365-graph-administration-lab/scripts/Get-M365LicenseAssignment.ps1\" rel=\"noopener noreferrer\" target=\"_blank\">License reporting script<span>SKU capacity and user assignment reporting</span></a></li><li><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/main/projects/m365-graph-administration-lab/scripts/Get-EntraRoleInventory.ps1\" rel=\"noopener noreferrer\" target=\"_blank\">Entra role script<span>Activated directory roles and membership reporting</span></a></li><li><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/main/projects/m365-graph-administration-lab/scripts/Get-EntraStaleAccounts.ps1\" rel=\"noopener noreferrer\" target=\"_blank\">Stale-account script<span>Sign-in activity and stale-account analysis</span></a></li><li><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/main/projects/m365-graph-administration-lab/scripts/Get-IntuneManagedDeviceInventory.ps1\" rel=\"noopener noreferrer\" target=\"_blank\">Intune device script<span>Managed-device compliance and encryption inventory</span></a></li></ul></section></article><aside class=\"case-nav panel\"><p class=\"eyebrow\">Case study</p><a data-route=\"projects/m365-graph-administration-lab\" href=\"#projects/m365-graph-administration-lab\">Reusable read-only Microsoft 365 administration tooling</a><a data-route=\"projects/m365-graph-administration-lab\" href=\"#projects/m365-graph-administration-lab\">Delegated Device Code with required-scope validation</a><a data-route=\"projects/m365-graph-administration-lab\" href=\"#projects/m365-graph-administration-lab\">REST endpoints, pagination, and PowerShell 5.1 compatibility</a><a data-route=\"projects/m365-graph-administration-lab\" href=\"#projects/m365-graph-administration-lab\">Point-in-time tenant and device reporting</a><a data-route=\"projects/m365-graph-administration-lab\" href=\"#projects/m365-graph-administration-lab\">Permission and query failures preserved as evidence</a><a data-route=\"projects/m365-graph-administration-lab\" href=\"#projects/m365-graph-administration-lab\">Reusable code public; live tenant exports withheld</a><a data-route=\"projects/m365-graph-administration-lab\" href=\"#projects/m365-graph-administration-lab\">Validation links</a></aside></div></section></div><details><summary>Microsoft 365 Graph Administration Lab <small> / README.md</small></summary><div class=\"document\"><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/m365-graph-administration-lab/README.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original source <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation/0a6bca1f3ed6\" data-route=\"documentation/0a6bca1f3ed6\" class=\"\">Open document page</a></div><h2>Microsoft 365 Graph Administration Lab</h2>\n<p><strong>Status:</strong> COMPLETE — validated read-only Microsoft Graph administration and reporting automation.</p>\n<p>Portfolio case study: https://jeremyfontenot.online/m365-graph-administration-lab.html</p>\n<p>This lab demonstrates Microsoft 365, Microsoft Entra ID, Microsoft Intune, Microsoft Graph, and PowerShell administration using a Microsoft 365 E5 Developer tenant.</p>\n<h2>Objectives</h2>\n<ul>\n<li>Build reusable Microsoft Graph administration tooling.</li>\n<li>Prefer read-only validation before configuration changes.</li>\n<li>Use delegated permissions with least-privilege scope selection.</li>\n<li>Exercise both Graph REST endpoints and PowerShell automation.</li>\n<li>Document authentication, permissions, API behavior, troubleshooting, and validation.</li>\n<li>Produce portfolio-quality evidence without creating meaningless tenant activity.</li>\n</ul>\n<h2>Validated scripts</h2>\n<div class=\"table-scroll\"><table>\n<thead>\n<tr>\n<th>Script</th>\n<th>Purpose</th>\n<th>Status</th>\n</tr>\n</thead>\n<tbody>\n<tr>\n<td><code>Get-M365TenantInventory.ps1</code></td>\n<td>Tenant, domain, user, group, SKU, role, and Entra-device inventory</td>\n<td>Validated</td>\n</tr>\n<tr>\n<td><code>Get-M365UserInventory.ps1</code></td>\n<td>Detailed Entra/M365 user and licensing inventory</td>\n<td>Validated</td>\n</tr>\n<tr>\n<td><code>Get-M365GroupMembership.ps1</code></td>\n<td>Group and direct-membership reporting</td>\n<td>Validated</td>\n</tr>\n<tr>\n<td><code>Get-M365LicenseAssignment.ps1</code></td>\n<td>License capacity and assignment reporting</td>\n<td>Validated</td>\n</tr>\n<tr>\n<td><code>Get-EntraRoleInventory.ps1</code></td>\n<td>Activated Entra directory roles and membership</td>\n<td>Validated</td>\n</tr>\n<tr>\n<td><code>Get-EntraStaleAccounts.ps1</code></td>\n<td>Potentially stale account analysis using sign-in activity</td>\n<td>Validated</td>\n</tr>\n<tr>\n<td><code>Get-IntuneManagedDeviceInventory.ps1</code></td>\n<td>Intune managed-device inventory</td>\n<td>Validated</td>\n</tr>\n</tbody>\n</table></div>\n<h2>Validated environment snapshot</h2>\n<ul>\n<li>Verified domains: 3</li>\n<li>Users: 22</li>\n<li>Groups: 12</li>\n<li>Subscribed SKUs: 1</li>\n<li>Activated directory roles: 4</li>\n<li>Entra devices: 2</li>\n<li>Licensed users: 19</li>\n<li>Unlicensed users: 3</li>\n<li>Intune managed devices: 1</li>\n</ul>\n<p>These values are a point-in-time lab snapshot and will change as the environment evolves.</p>\n<h2>Graph permissions exercised</h2>\n<ul>\n<li><code>Organization.Read.All</code></li>\n<li><code>User.Read.All</code></li>\n<li><code>Group.Read.All</code></li>\n<li><code>Directory.Read.All</code></li>\n<li><code>AuditLog.Read.All</code></li>\n<li><code>DeviceManagementManagedDevices.Read.All</code></li>\n</ul>\n<h2>Graph endpoints exercised</h2>\n<pre><code class=\"language-text\">GET /v1.0/organization\nGET /v1.0/users\nGET /v1.0/groups\nGET /v1.0/groups/{id}/members\nGET /v1.0/subscribedSkus\nGET /v1.0/directoryRoles\nGET /v1.0/directoryRoles/{id}/members\nGET /v1.0/devices\nGET /v1.0/deviceManagement/managedDevices\n</code></pre>\n<h2>Validation highlights</h2>\n<ul>\n<li>Device Code delegated authentication validated.</li>\n<li>Existing Graph sessions are checked for required scopes before reuse.</li>\n<li>Graph collection pagination is handled where supported.</li>\n<li>Windows PowerShell 5.1 hashtable behavior is handled explicitly.</li>\n<li>CSV reporting was validated for tenant, user, group, licensing, role, stale-account, and Intune inventory.</li>\n<li>A <code>400 Bad Request</code> on directory-role membership was traced to an unsupported <code>$top</code> query parameter and corrected.</li>\n<li>A <code>403 Forbidden</code> on <code>signInActivity</code> was traced to a missing <code>AuditLog.Read.All</code> scope and corrected.</li>\n</ul>\n<h2>Repository layout</h2>\n<pre><code class=\"language-text\">m365-graph-administration-lab/\n├── README.md\n├── scripts/\n│   ├── Get-M365TenantInventory.ps1\n│   ├── Get-M365UserInventory.ps1\n│   ├── Get-M365GroupMembership.ps1\n│   ├── Get-M365LicenseAssignment.ps1\n│   ├── Get-EntraRoleInventory.ps1\n│   ├── Get-EntraStaleAccounts.ps1\n│   └── Get-IntuneManagedDeviceInventory.ps1\n└── docs/\n    └── Troubleshooting.md\n</code></pre>\n<h2>Completion and claim boundary</h2>\n<p>The intended portfolio scope is complete: seven read-only administration/reporting scripts were validated across Microsoft 365, Entra ID, and Intune. The project demonstrates delegated Microsoft Graph authentication, required-scope handling, read-only administration/reporting, CSV output, pagination, and documented troubleshooting. It does not claim Graph write automation or broader administrative coverage that was not validated.</p>\n<h2>Security and publication notes</h2>\n<p>Live CSV exports are intentionally not published because they can contain user principal names, object IDs, device identifiers, and other tenant-specific information. The public repository contains the reusable code and sanitized validation documentation only.</p></div></details><details><summary>Troubleshooting Notes <small> / Troubleshooting.md</small></summary><div class=\"document\"><div class=\"source-links\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/m365-graph-administration-lab/docs/Troubleshooting.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Original source <span aria-hidden=\"true\">↗</span></a><a href=\"#documentation/cc19df30f995\" data-route=\"documentation/cc19df30f995\" class=\"\">Open document page</a></div><h2>Troubleshooting Notes</h2>\n<h2>Microsoft.Graph.Authentication missing</h2>\n<p>Installed the authentication module:</p>\n<pre><code class=\"language-powershell\">Install-Module Microsoft.Graph.Authentication -Scope CurrentUser -Force\n</code></pre>\n<p>Validated module version during the lab: <code>2.41.0</code>.</p>\n<h2>PowerShell execution policy blocked module loading</h2>\n<p>Corrected the current-user policy:</p>\n<pre><code class=\"language-powershell\">Set-ExecutionPolicy -Scope CurrentUser -ExecutionPolicy RemoteSigned\n</code></pre>\n<h2>Windows PowerShell 5.1 Graph response behavior</h2>\n<p><code>Invoke-MgGraphRequest</code> responses behaved as hashtables in this environment, so key indexing was used where appropriate:</p>\n<pre><code class=\"language-powershell\">$Org[\"displayName\"]\n</code></pre>\n<h2>Single-object count behavior</h2>\n<p>Graph collections were explicitly wrapped with <code>@(...)</code> so <code>.Count</code> remained reliable when only one object was returned.</p>\n<h2>Session-scoped project root</h2>\n<p>Reusable scripts determine the project root from their own location:</p>\n<pre><code class=\"language-powershell\">$ProjectRoot = Split-Path $PSScriptRoot -Parent\n</code></pre>\n<h2>Directory-role members returned 400 Bad Request</h2>\n<p>The role list succeeded, but calls shaped like:</p>\n<pre><code class=\"language-text\">GET /v1.0/directoryRoles/{id}/members?$top=999\n</code></pre>\n<p>returned <code>400 Bad Request</code>.</p>\n<p>Removing <code>$top</code> corrected the query:</p>\n<pre><code class=\"language-text\">GET /v1.0/directoryRoles/{id}/members\n</code></pre>\n<p>All activated roles were then processed successfully.</p>\n<h2>signInActivity returned 403 Forbidden</h2>\n<p>An existing Graph session lacked <code>AuditLog.Read.All</code>. The stale-account script was changed to compare the required scopes with <code>Get-MgContext.Scopes</code> and reconnect when a required scope was missing.</p>\n<p>After reauthentication with:</p>\n<pre><code class=\"language-text\">User.Read.All\nAuditLog.Read.All\n</code></pre>\n<p>the user sign-in activity query completed successfully.</p>\n<h2>Disconnect-MgGraph MSAL cache warning</h2>\n<p><code>Disconnect-MgGraph</code> displayed an authority-format warning while clearing the persisted MSAL token cache. The warning did not prevent a successful new Device Code authentication session.</p>\n<h2>Intune managed-device permission</h2>\n<p>The Intune inventory required:</p>\n<pre><code class=\"language-text\">DeviceManagementManagedDevices.Read.All\n</code></pre>\n<p>The script detected the missing scope, reauthenticated, and successfully retrieved the managed-device inventory.</p></div></details></section><section class=\"content-block\" id=\"troubleshooting\"><h2>Troubleshooting</h2><p>A directory-role membership request returned 400 because it used an unsupported $top parameter. A signInActivity query returned 403 until the missing AuditLog.Read.All delegated scope was addressed.</p><div class=\"doc-grid\"><a href=\"#documentation/cc19df30f995\" data-route=\"documentation/cc19df30f995\" class=\"\">Troubleshooting Notes<small>projects/m365-graph-administration-lab/docs/Troubleshooting.md</small></a></div></section><section class=\"content-block\" id=\"validation\"><h2>Validation & results</h2><p>Seven read-only scripts and CSV reporting are documented as validated. Live exports are deliberately excluded from the public repository.</p><div class=\"doc-grid\"></div></section><section class=\"content-block\" id=\"evidence\"><h2>Evidence</h2><p>STRONG — seven validated read-only scripts, delegated authentication, scope handling, CSV/report output, Intune inventory, and documented Graph troubleshooting are preserved.</p><div class=\"doc-grid\"><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/m365-graph-administration-lab/README.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">README.md<small>Retained documentation supporting Microsoft 365 Graph Administration Lab.</small> <span aria-hidden=\"true\">↗</span></a><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/m365-graph-administration-lab/docs/Troubleshooting.md\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Troubleshooting.md<small>Retained documentation supporting Microsoft 365 Graph Administration Lab.</small> <span aria-hidden=\"true\">↗</span></a><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/m365-graph-administration-lab/scripts/Get-EntraRoleInventory.ps1\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Get-EntraRoleInventory.ps1<small>Retained scripts supporting Microsoft 365 Graph Administration Lab.</small> <span aria-hidden=\"true\">↗</span></a><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/m365-graph-administration-lab/scripts/Get-EntraStaleAccounts.ps1\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Get-EntraStaleAccounts.ps1<small>Retained scripts supporting Microsoft 365 Graph Administration Lab.</small> <span aria-hidden=\"true\">↗</span></a><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/m365-graph-administration-lab/scripts/Get-IntuneManagedDeviceInventory.ps1\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Get-IntuneManagedDeviceInventory.ps1<small>Retained scripts supporting Microsoft 365 Graph Administration Lab.</small> <span aria-hidden=\"true\">↗</span></a><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/m365-graph-administration-lab/scripts/Get-M365GroupMembership.ps1\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Get-M365GroupMembership.ps1<small>Retained scripts supporting Microsoft 365 Graph Administration Lab.</small> <span aria-hidden=\"true\">↗</span></a><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/m365-graph-administration-lab/scripts/Get-M365LicenseAssignment.ps1\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Get-M365LicenseAssignment.ps1<small>Retained scripts supporting Microsoft 365 Graph Administration Lab.</small> <span aria-hidden=\"true\">↗</span></a><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/m365-graph-administration-lab/scripts/Get-M365TenantInventory.ps1\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Get-M365TenantInventory.ps1<small>Retained scripts supporting Microsoft 365 Graph Administration Lab.</small> <span aria-hidden=\"true\">↗</span></a><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/blob/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/m365-graph-administration-lab/scripts/Get-M365UserInventory.ps1\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">Get-M365UserInventory.ps1<small>Retained scripts supporting Microsoft 365 Graph Administration Lab.</small> <span aria-hidden=\"true\">↗</span></a></div><div class=\"source-links\"><a href=\"#evidence\" data-route=\"evidence\" class=\"\">Browse and filter the complete evidence library</a><a href=\"https://github.com/fontenotjeremy71-hub/jeremyfontenot/tree/5c130c816cd22a70f734b2c2ee6d6480732b1dc2/projects/m365-graph-administration-lab/\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"\">GitHub project source <span aria-hidden=\"true\">↗</span></a></div></section><section class=\"content-block\" id=\"skills\"><h2>Skills demonstrated</h2><div class=\"tags\"><span class=\"tag\">Microsoft Graph</span><span class=\"tag\">PowerShell</span><span class=\"tag\">REST API</span><span class=\"tag\">CSV</span></div><a href=\"#skills\" data-route=\"skills\" class=\"\">View the complete capability map →</a></section><section class=\"content-block\" id=\"limitations\"><h2>Limitations & claim boundaries</h2><div class=\"note\">Read-only delegated administration/reporting is currently proven. Live CSV exports are intentionally not public because they may contain UPNs, object IDs, device identifiers, and tenant-specific data. Do not imply write automation or broader Graph coverage that has not been validated.</div></section><section class=\"content-block\" id=\"next\"><h2>Next milestones</h2><p>Maintenance-only. Graph write operations or broader automation are optional future enhancements only when they serve a legitimate administrative requirement.</p></section></article></div><section class=\"section\"><p class=\"eyebrow\">Continue exploring</p><h2>Related projects</h2><div class=\"grid grid-2\"><article class=\"project-card\" data-project data-category=\"Identity &amp; security\" data-search=\"windows laps &amp; advanced group policy encrypted local administrator passwords, scoped group policy, delegated readers, and positive and negative access tests. windows laps active directory group policy powershell\"><div class=\"card-head\"><span class=\"project-number\">PROJECT 01</span><span class=\"status\">COMPLETE</span></div><h3><a href=\"#projects/windows-laps-gpo\" data-route=\"projects/windows-laps-gpo\" class=\"\">Windows LAPS &amp; Advanced Group Policy</a></h3><p>Encrypted local administrator passwords, scoped Group Policy, delegated readers, and positive and negative access tests.</p><div class=\"tags\"><span class=\"tag\">Windows LAPS</span><span class=\"tag\">Active Directory</span><span class=\"tag\">Group Policy</span><span class=\"tag\">PowerShell</span></div><div class=\"card-footer\"><a href=\"#projects/windows-laps-gpo\" data-route=\"projects/windows-laps-gpo\" class=\"\">Read case study <span class=arrow>↗</span></a><a href=\"#evidence\" data-route=\"evidence\" class=\"text-link\">Evidence</a></div></article><article class=\"project-card\" data-project data-category=\"Infrastructure\" data-search=\"windows admin center lab management centralized windows administration backed by connectivity, authentication, and remote-management validation. windows admin center winrm powershell\"><div class=\"card-head\"><span class=\"project-number\">PROJECT 04</span><span class=\"status\">COMPLETE</span></div><h3><a href=\"#projects/windows-admin-center-lab\" data-route=\"projects/windows-admin-center-lab\" class=\"\">Windows Admin Center Lab Management</a></h3><p>Centralized Windows administration backed by connectivity, authentication, and remote-management validation.</p><div class=\"tags\"><span class=\"tag\">Windows Admin Center</span><span class=\"tag\">WinRM</span><span class=\"tag\">PowerShell</span></div><div class=\"card-footer\"><a href=\"#projects/windows-admin-center-lab\" data-route=\"projects/windows-admin-center-lab\" class=\"\">Read case study <span class=arrow>↗</span></a><a href=\"#evidence\" data-route=\"evidence\" class=\"text-link\">Evidence</a></div></article></div></section>",
    "active": "Projects"
  }
}