HomeLessons Learned

Technical source document

Lessons Learned

Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.

Original GitHub document All documentation

Lessons Learned

1. Apple management has two control planes

Intune can expose Apple enrollment, configuration, compliance, application, and lifecycle administration even when Apple Business Manager is not available. ABM is a separate Apple control plane for organization ownership, device assignment, and ADE.

Treating these as one system would overstate what was actually implemented.

2. APNs is foundational and operationally sensitive

The Apple MDM Push certificate is not a one-time setup artifact. It is an annual operational dependency. The same Apple account must remain available for renewal, and the existing certificate relationship should be renewed rather than casually replaced.

3. Policy creation is not endpoint validation

Creating a macOS compliance policy or FileVault profile in Intune proves administrative configuration capability. It does not prove that a Mac received, enforced, or reported the setting.

This project intentionally keeps those claims separate.

4. Portfolio accuracy is stronger than fabricated completeness

ABM, ADE, Platform SSO registration, EAP-TLS authentication, FileVault escrow, and lifecycle execution are valuable concepts, but inventing screenshots or pretending a managed Mac exists would weaken the portfolio.

A clearly bounded simulation demonstrates sound administration judgment.

5. Current Intune design should avoid deprecated templates

The deprecated macOS Endpoint Protection template was visible, but FileVault was configured through the current Settings Catalog instead.

6. Enterprise Wi-Fi is a dependency chain

A Wi-Fi profile alone is not enterprise authentication. EAP-TLS depends on:

  • trusted root certificate;
  • device/user certificate issuance;
  • certificate identity/EKU design;
  • RADIUS trust;
  • network policy;
  • managed endpoint delivery.

Documenting that dependency chain is more meaningful than creating a fake SSID.

7. Lifecycle administration requires ownership context

Retire, wipe, delete, restart, rename, and sync are exposed in Intune, but the correct action depends on ownership, incident type, reassignment plan, and data-retention requirements.

8. Evidence should prove exactly what the caption claims

The evidence gallery pairs each screenshot with a narrow claim. A capability screenshot proves capability. A policy review proves settings. A policy-monitor screenshot proves the policy exists. None are used to imply an enrolled Mac where none exists.