The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Short answer: Microsoft Intune can manage documented Windows client, Android, iOS/iPadOS, macOS, selected Linux, ChromeOS integrations, Windows Holographic and Surface Hub scenarios. It does not offer one universal “custom baseline” that changes Microsoft’s support matrix. Instead, use enrollment device platform restrictions to control who and what may enroll, then use compliance policies, configuration profiles, endpoint security policies, security baselines and Conditional Access for controls after enrollment.
Platform support and minimum versions change. The July 3, 2023 HTMD walkthrough is useful for understanding the workflow, but its version table and screenshots are historical. Check Microsoft’s live support documentation before setting production thresholds.
What “supported” means in Intune
Support is not a single yes/no property. A platform can be supported for enrollment but have narrower support for configuration, applications, scripts, endpoint security or remote actions. Evaluate each requirement separately:
- Enrollment: Can the device join Intune management?
- Management: Can Intune apply configuration and security settings?
- Compliance: Can the device report health for access decisions?
- Applications: Can Intune deploy software or apply app protection?
- Feature support: Are Autopilot, scripts, remediations, security baselines or remote actions available for this platform and enrollment type?
Use Microsoft’s current support matrix for operating-system, browser and feature qualifications: Supported devices and browsers.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errors#1 Best Overall
- [This is a Copilot+ PC] — The fastest, most intelligent Windows PC ever, with built-in AI tools that help you write, summarize, and multitask — all while keeping your data and privacy secure.
- [The Power of a Laptop, the Flexibility of a Tablet] — Surface Pro 12” is a 2-in-1 device that adapts to you. Use it as a tablet for on-the-go tasks, prop it up with the built-in kickstand, or attach the Surface Pro Keyboard (sold separately) to turn it into a full laptop.
- [Incredibly Fast and Intelligent] — Powered by the latest Snapdragon X Plus processor and an AI engine that delivers up to 45 trillion operations per second — for smooth, responsive, and smarter performance.
- [All Day Battery Life] — Up to 16 hours of battery life[1] means you can work, stream, and create wherever the day takes you — without reaching for a charger.
- [Brilliant 12” Touchscreen Display] — The PixelSense display delivers vibrant color and crisp detail in a sleek design — perfect for work, entertainment, or both.
Which platforms Intune can manage
| Platform | Typical use | Important qualification |
|---|---|---|
| Windows client | MDM, Autopilot, configuration, compliance, applications and endpoint security | Edition and feature support differ. Windows Home is not an enterprise-management equivalent to Pro, Enterprise or Education. |
| Android | Android Enterprise work profile, corporate-owned, fully managed, dedicated and AOSP devices | Enrollment mode determines capabilities. Android Device Administrator is a legacy or limited path where still documented. |
| iOS/iPadOS | User or device enrollment, Automated Device Enrollment, compliance and applications | Supervision, Apple enrollment method and ownership affect available controls. |
| macOS | Configuration profiles, compliance, applications, Platform SSO and device security | Version and enrollment method are significant; macOS policy coverage is not identical to Windows. |
| Linux | Selected desktop management and compliance scenarios | Distribution, desktop environment and supported versions are narrow. |
| ChromeOS | Selected management or compliance integrations | Do not assume native, full-featured Intune MDM parity with Windows or Apple devices. |
| Windows Holographic and Surface Hub | Specialized Windows device management | Feature availability is narrower than for standard Windows clients. |
| Windows Server | Server-specific management through other Microsoft tools | Server is not managed like a Windows client through ordinary Intune enrollment. |
“Supported” does not mean that every Intune workload works on every row. For example, Windows Autopilot is a Windows provisioning workflow, while Apple supervision and Android Enterprise enrollment modes expose platform-specific controls.
Intune, Configuration Manager and server management
Intune is a cloud MDM and endpoint-management service. Configuration Manager (formerly SCCM) is a traditional management platform with deep Windows client and server capabilities, software-distribution controls and on-premises infrastructure. Co-management lets an organization share selected Windows workloads between Configuration Manager and Intune; it does not make Intune a universal replacement for Configuration Manager.
- Choose Intune for cloud-native policy, Microsoft Entra integration, Conditional Access and mixed Windows, Apple, Android and selected Linux management.
- Retain or evaluate Configuration Manager when legacy Windows, detailed software distribution or server management is central.
- Use the documented Microsoft service for the actual workload: Defender, Azure Arc, Configuration Manager or another platform may be more appropriate for servers and specialized devices.
A Windows virtual machine is not automatically supported merely because it runs Windows. Enrollment identity, TPM availability, licensing, virtualization platform and the management scenario matter. Windows 10/11 Enterprise multi-session is a specialized Azure Virtual Desktop scenario, not proof that every virtual machine is supported. See the Windows multi-session FAQ and Windows 365 Enterprise documentation.
What “custom baseline” should mean
Intune has several policy types. Pick the control that matches the requirement rather than trying to force every rule into an enrollment profile.
| Requirement | Correct control |
|---|---|
| Block unsupported platforms or enrollment modes | Enrollment device platform restrictions |
| Require a minimum OS version | Enrollment restriction and, after enrollment, a compliance policy |
| Require encryption, firewall, antivirus or password settings | Compliance and endpoint security policies |
| Apply a standard security configuration | Security baselines and configuration profiles |
| Target changing device properties | Assignment filters |
| Block access from a noncompliant enrolled device | Compliance policy plus Conditional Access |
| Protect corporate data in personal apps | App protection policies and Conditional Access |
| Remediate a missing setting | Configuration profiles, scripts or remediations |
Security baselines are curated collections of recommended settings; they are not admission allowlists. Read Microsoft’s guidance for security baselines, compliance policies and Conditional Access.
Rank #2
- Laptop Size: This renewed Microsoft Surface Pro 7+ Tablet, has a screen size of 12.3 " and touch display. The 2736 X 1824 Pixel anti-glare screen, mostly reduces fatigue when using it, allowing you to focus on work. With a light weight, this Microsoft Surface refurbished laptop is a great choice for your Business and entertainment.
- Processor: This Renewed Surface Pro 7 Plus Tablet is installed with Intel Core i5-1135 G7 (2.4GHz-4.2GHz, 4Cores, 8Threads, 8 MB Intel Smart Cache), meeting the fast and stable operation of most programs.
- Powerful Memory: This refurbished Tablet has installed 8GB of RAM running memory and 256GB of Solid State Drive for you, allowing you to run multiple software and browsers at the same time with confidence, the Microsoft Surface powerful hard drive gives you enough space to download files!
- Multiple Ports:USB 3.0, microSD card reader(Optional), Headphone jact, Mini DisplayPort, Cover port, Charging port, this Microsoft SurfaceTablet allows you to fully enjoy the pleasure brought by technology.
- System: Windows 11 Pro is recognized as the most stable operating system, which is mostly for both commercial and professional users. Windows 11 Pro provides more security and management features for this used Surface Pro 7 (+) Tablet, as well as supporting virtualization and remote access. Meanwhile, it supports multiple languages, including English, French, Spanish, German, etc.
Configure enrollment device platform restrictions
Enrollment restrictions control platform, OS-version, enrollment-type and ownership admission for assigned users. Portal labels can change, so use the current Intune navigation if it differs from this path.
- Open the Intune admin center and select Devices.
- Open Enroll devices, then Enrollment device platform restrictions.
- Create a restriction or edit an existing one.
- In Platform settings, allow or block platforms, set minimum or maximum versions, and choose ownership or enrollment-type options where available.
- Add Scope tags for delegated administration.
- Assign included groups and add exclusions.
- Review the priority, save the policy and test it with a pilot user.
Microsoft documents the current workflow at Set enrollment restrictions.
Priority is an access-control decision
Restrictions are evaluated by priority for the user. A higher-priority policy can override a broad default policy, while a mistaken exclusion can send a user to a permissive policy. Put the intended restrictive policy above the default, verify group membership and test both included and excluded accounts. Changing the default can affect every user without a matching custom policy.
Enrollment restrictions primarily govern new enrollment. They are not an automatic removal mechanism for devices that enrolled earlier. Use compliance, Conditional Access, retire, wipe or other lifecycle actions for existing devices.
Android design
Start with the enrollment model, not just the Android version. Android Enterprise supports personally owned work profiles, corporate-owned work profiles, fully managed devices and dedicated devices. AOSP is available for documented corporate scenarios. The relevant Microsoft guides are Android enrollment, fully managed enrollment, dedicated devices and AOSP enrollment.
Rank #3
- A PREMIUM PERFORMANCE 2-IN-1 LAPTOP & TABLET — Ready for work, school, and creativity. Built for busy days, big projects, and nonstop multitasking. Run video calls, school and work apps, 20+ browser tabs, and AI tools at the same time without slowing down.
- WITH AI BUILT IN — With a dedicated AI chip (Qualcomm Snapdragon X2 Plus), this Copilot+ PC[5] on Windows 11 helps you work smarter and faster. Prompt, create, and automate with ease — ready for even your most demanding tasks.
- A STUNNING 13" OLED TOUCHSCREEN — Sharp colors, real detail, and smooth 120Hz scrolling on the PixelSense touchscreen[1] with LCD display[2]. Tap, scroll, draw, or pinch to zoom — whichever feels right for streaming, sketching, or daily work.
- 15.5 HOURS OF BATTERY (LEAVE THE CHARGER) — Up to 15.5 hours of video playback[3] on a single charge. Work from a coffee shop, take it to class/work, or binge a season on a long flight — it'll keep up.
- THE PORTS YOU NEED — Two USB-C / USB4[4] ports for fast charging, big file transfers, or hooking up to three 4K monitors when you want a full desktop. Wi-Fi 7 keeps you online and fast wherever you are.
- Prefer Android Enterprise where the hardware and scenario support it.
- Use manufacturer restrictions for a controlled rugged fleet only when replacement and rebranding risks are understood.
- Set OS thresholds with vendor patch behavior in mind; a major-version check does not guarantee a current security patch.
- Treat Android Device Administrator as legacy or limited unless Microsoft’s current documentation explicitly supports your scenario.
Windows design
The Windows 10 and later selector is a platform category, not a promise that every edition, build or workflow is identical. Separate ordinary MDM enrollment from Windows Autopilot, automatic enrollment, bulk provisioning and co-management. Microsoft’s references are Windows enrollment methods, Windows Autopilot and Windows compliance policies.
Pair minimum-version restrictions with update rings, grace periods and an exception process. Otherwise, a threshold change can strand a legitimate user without an enrollment or access recovery path. Do not silently include Windows Server.
Recommended Free Tools
macOS design
Corporate Macs generally receive the strongest control through Automated Device Enrollment with Apple Business Manager or Apple School Manager. BYOD and user-approved enrollment expose different capabilities and privacy expectations. Review macOS enrollment, Automated Device Enrollment for macOS and the Apple MDM Push certificate requirements.
Enrollment restrictions alone do not configure Platform SSO, applications, compliance or endpoint security. Each workload has its own prerequisites and profile.
iOS and iPadOS design
Choose between user enrollment, device enrollment and Automated Device Enrollment based on whether the organization needs app/data protection, full device control or supervised corporate hardware. Apple MDM Push certification, Apple Business Manager or Apple School Manager integration and correct device assignment are prerequisites where applicable. See iOS/iPadOS enrollment and Automated Device Enrollment for iOS/iPadOS.
Rank #4
- Intel Core i5-1035G4 3.70GHz processor, 128GB SSD Drive
- 8GB RAM, Wireless: 802.11a/b/g/n/ac Wi-Fi, Bluetooth 4.0
- Ports: Full-size USB 3.0; microSD card reader; Headphone jack; Mini DisplayPort; Cover port; Charging port, Camera: 5MP front-facing and 8MP rear-facing cameras with 1080p HD video recording
- Display: 12.3-inch PixelSense touchscreen display; 2736 x 1824 resolution, Stereo speakers with Dolby Audio-enhanced sound
- Operating System: Windows 10 Home, Intel Iris Plus Graphics
Linux, ChromeOS and IoT qualifications
Linux support is limited to documented distributions, desktop environments and scenarios. ChromeOS integrations should not be described as equivalent to native Windows or Apple MDM. “IoT” is not one operating system: Windows IoT, Android-based kiosks, rugged Android, Linux appliances and vendor-managed devices have different support models. Intune does not universally manage arbitrary IoT operating systems; verify the exact device and enrollment scenario in Microsoft’s support matrix.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Enrollment restrictions versus compliance
Think of endpoint control as a lifecycle:
Supported platform → enrollment restriction → configuration → compliance evaluation → Conditional Access
Enrollment asks whether a user and device may enter management. Configuration applies settings. Compliance evaluates health after enrollment. Conditional Access can block access when the device is noncompliant. A device may therefore be allowed to enroll and later lose access, or be rejected before it becomes managed.
Production rollout and rollback
- Inventory operating system, build, ownership, enrollment method, business role and whether each device is corporate, BYOD, kiosk, rugged, shared or virtual.
- Define allowed platforms, minimum versions, enrollment types, ownership rules and exceptions.
- Assign a restrictive policy to a small pilot group, keeping break-glass accounts outside accidental lockouts.
- Test an allowed corporate device, allowed personal device, excluded user, unsupported OS and each Android or Apple enrollment mode you use.
- Confirm policy priority and inspect the effective assignment before production rollout.
- Create compliance and Conditional Access policies separately from enrollment restrictions.
- Align update policy, grace periods and exception handling with every minimum-version rule.
- Monitor enrollment failures, noncompliance and devices approaching the threshold. If a legitimate device is blocked, use a temporary exception group rather than weakening the global default.
Common failure modes
Supported device is blocked
Check the user’s effective restriction, priority, exclusions, ownership classification, reported OS version, enrollment type and stale enrollment record. Platform support may exist while that particular enrollment mode is unsupported.
Unsupported device enrolled
Confirm enrollment date and effective policy. It may have matched a permissive default, used a different platform category or enrolled before the restriction changed. Apply compliance and Conditional Access, then choose retire, wipe or unenroll only after assessing ownership and data.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchBest Value
- Microsoft Surface Pro 7+ 12.3" Tablet 2-in-1 Laptop, Amazon Renewed, Core i3 with 128GB SSD and 8GB RAM
- More ways to connect, with both USB-C and USB-A ports for connecting to displays, docking stations and more, as well as accessory charging, Platinum Silver Color
- Standout design that won’t weigh you down — ultra-slim and light Surface Pro 7+ starts at just 1.70 pounds. Aspect ratio: 3:2
- Intel Core i3-1114G5 (1.70-3.0Ghz) | 128GB SSD | 8GB RAM | Windows 11 Professional Installed
- Screen: 12.3” PixelSense Display | Resolution: 2736 x 1824 (267 PPI) | Faster than Surface Pro 6, with a 10th Gen Intel Core Processor – redefining what’s possible in a thin and light computer. Wireless : Wi-Fi 6: 802.11ax compatible. Bluetooth Wireless 5.0 technology
Version rule behaves unexpectedly
Windows, Apple, Android and Linux report versions differently. Major, minor and build comparisons are not interchangeable, and OS version does not replace patch-date evaluation.
Apple enrollment fails
Verify the MDM Push certificate, Apple integration, enrollment token, device assignment, enrollment method and supported version.
Final design checklist
- Have you checked Microsoft’s live support matrix rather than relying on the July 2023 table?
- Is each requirement assigned to enrollment restrictions, compliance, configuration, endpoint security, baseline, filter or Conditional Access?
- Are Windows client and Windows Server treated separately?
- Are Android Enterprise, AOSP and Apple enrollment modes explicitly selected?
- Are personal-device privacy and data requirements documented?
- Is the restrictive policy above the default and tested with exclusions?
- Does every OS threshold have an update, grace-period and exception plan?
- Do delegated administrators have scope tags without confusing them with platform support?
Frequently Asked Questions
Does an Intune enrollment restriction change Microsoft’s supported-platform list?
No. It limits which users, devices, versions or enrollment types may enter your tenant; it cannot make an undocumented operating system supported.
Can a security baseline block personal devices from enrolling?
No. Use enrollment device platform restrictions for admission. Use security baselines and compliance policies for settings and health after enrollment.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Will changing a restriction remove devices that are already enrolled?
Not automatically. Evaluate existing devices with compliance and Conditional Access, then use the appropriate retire, wipe or unenrollment action.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
