Device and Endpoint Management
The Device and Endpoint Management domain tests how you enroll, configure, secure, and retire endpoints at scale. Expect questions on MDM and MAM, corporate versus BYOD ownership, enrollment types, configuration profiles, compliance policies, OS update rings, certificates, Wi-Fi/VPN payloads, inventory, and remote actions. The exam distinguishes configuration (what you set) from compliance (what you verify) and from conditional access (what you enforce at the app or service).
Core rules
- Choose ownership first. Corporate devices can be supervised, wiped, and locked down; BYOD usually uses user enrollment, MAM app protection, and privacy boundaries.
- Deliver settings through profiles or payloads: passcode, encryption, Wi-Fi, VPN, email, certificates, restrictions. Use groups for assignment and exclusions.
- Make compliance measurable: minimum OS, encryption, passcode, jailbreak/root detection, threat status. Noncompliance should trigger a defined action, not just a report.
- Patch with rings: pilot, broad, critical. Track check-in and last-seen time; a policy is not applied until the device syncs.
Worked example
A company issues iPhones to field staff. Requirement: six-digit passcode, encryption, minimum OS, and no jailbreak. The admin creates a configuration profile for passcode and restrictions, a compliance policy for OS and jailbreak, and a conditional access rule that blocks corporate email for noncompliant devices. A user disables the passcode; the device fails compliance at next check-in and email is blocked until fixed. The key reasoning is that the profile enforces the setting, the compliance rule evaluates it, and conditional access acts on the result.
Traps
Do not treat a configuration profile as proof of compliance. Do not assume instant enforcement; check-in intervals matter. Do not apply a supervised-only command to unsupervised BYOD. Do not overlook certificate expiry or Wi-Fi payload conflicts.