Month 3: The Suite life

Where the Suite features come from

The advanced Intune capabilities are Remote Help, Advanced Analytics, Endpoint Privilege Management (EPM), Enterprise App Management, Microsoft Cloud PKI, Microsoft Tunnel for MAM, firmware over-the-air and specialty devices. Since July 2026, Microsoft 365 E3 includes Intune Plan 2, Remote Help and Advanced Analytics. E5 adds EPM, Cloud PKI and Enterprise App Management. Other plans buy the Intune Suite or single add-ons.

Exam tip Licensing details move fast. The exam tests what each capability does, not price lists.

Why EPM exists

Users who are local admins can install anything, including malware. Endpoint Privilege Management lets everyone run as a standard user and elevates only approved files when needed. Users right-click a file and choose Run with elevated access. Every elevation is logged.

Dev: Standard user every day, admin for one approved app for one moment. That's least privilege.

Elevation settings policy

Endpoint security > Endpoint Privilege Management, Windows elevation settings policy: turn EPM on, set reporting, and choose the default elevation response for files with no rule: Deny all requests, Require support approval or Require user confirmation (optionally with business justification and Windows authentication). Not configured behaves as deny.

Exam tip Microsoft recommends Deny or Require support approval as the default. User confirmation as the default lets users elevate any file.

Elevation rules policy

A Windows elevation rules policy names a file by file name, path, hash or publisher certificate, then sets an elevation type: Automatic (silent), User confirmed, Support approved (an admin approves each request), Elevate as current user or Deny. Child processes can be denied or required to have their own rule. Deny beats every other rule. Monitor in the Elevation report and approve requests under Support approvals.

Rule: Label printer setup
 File   labelsetup.exe
 Path   C:\Program Files\Kibble\
 Hash   9F2C...A41B
 Type   User confirmed
        + business justification

Exam tip Use a path users can't write to, plus a hash or certificate, so nobody can swap in a fake file with the same name.

Enterprise App Catalog

Enterprise App Management gives you the Enterprise App Catalog: common Win32 apps that Microsoft has prepackaged and hosts. Add one under Apps > Windows > Add > Enterprise App Catalog app, and Intune fills in the install command, requirements and detection rules. You can edit them and assign like any Win32 app. When a newer version appears, add it and supersede the old one.

Exam tip "Deploy a common third-party app without packaging it yourself" = Enterprise App Catalog.

Remote Help basics

Remote Help is cloud-based screen sharing for the help desk. Turn it on in Tenant administration > Remote Help (it's off by default). Both helper and user sign in with organization accounts, so each sees the other's verified identity. The helper asks for view only or full control, and the user must allow it. On Windows, elevation lets the helper answer UAC prompts.

Exam tip Allowing help to unenrolled devices is a separate setting, off by default. Helpers see a warning when the user's device isn't compliant.

Who can do what in Remote Help

Permissions come from Intune roles: View screen, Take full control, Elevation and unattended control, plus Remote tasks Offer remote assistance. The built-in Help Desk Operator role includes the main ones. Conditional Access can require MFA or a compliant device for helpers on Windows and macOS. Sessions are logged and reported in the admin center.

Exam tip Least privilege: tier 1 gets view only, tier 2 gets full control and elevation. Build custom roles for that split.

Microsoft Cloud PKI

Microsoft Cloud PKI runs your certificate authority in Intune. Option 1: a root CA and issuing CA both in the cloud (a two-tier hierarchy). Option 2: bring your own CA (BYOCA): a cloud issuing CA whose CSR is signed by your private CA, such as ADCS. Devices get certificates through a SCEP profile pointing at the issuing CA's SCEP URI. No NDES server or certificate connector needed.

Tenant administration > Cloud PKI
 KC Root CA       Root     10 years
 KC Issuing CA    Issuing  6 years
Profiles per platform:
 1 Trusted cert: root CA
 2 Trusted cert: issuing CA
 3 SCEP: issuing CA SCEP URI

Exam tip Monitor certificate health in the CA's issued certificates list (revoke there) and in the SCEP profile reports. Intune hosts the CRL.

Microsoft Tunnel for MAM

Microsoft Tunnel is a VPN gateway that runs in a container on a Linux server. Tunnel for MAM extends it to Android and iOS devices that aren't enrolled. On Android, users install Microsoft Defender (the tunnel client), Edge and Company Portal without enrolling. You add app configuration policies for Defender and Edge plus an app protection policy. iOS apps use the Tunnel for MAM SDK.

Exam tip Watch the gateway in Tenant administration > Microsoft Tunnel Gateway > Health status: last check-in, CPU, memory and connections.

Advanced Analytics

Advanced Analytics builds on Endpoint analytics: anomaly detection after updates or changes, the device timeline, battery health, resource performance, custom device scopes, and device query with KQL. Use it to spot problems before users call, then confirm the cause and adjust policies.

Exam tip A spike in app crashes right after a driver rollout? Anomalies point at it, and the device timeline shows the order of events.

What it is

Advanced Analytics is part of the Intune Suite (a paid add-on). It builds on Endpoint analytics data from enrolled Windows devices to find problems across the fleet instead of one device at a time.

• Anomaly detection: flags unusual spikes, such as many app crashes or stop errors (blue screens) after an update, and groups the affected devices by what they share (model, OS build, driver)
• Device timeline: a device's history of crashes, restarts and boot events
• Battery health: scores capacity and runtime to find batteries that need replacing
• Resource performance: CPU and RAM scores (for example for Cloud PCs) with resize suggestions
• Enhanced device inventory and device query: look up hardware and software details on demand

Using the insights

Anomaly detection and scores turn into actions: pause an update ring that's causing crashes, replace a driver, fix the model with poor batteries, right-size Cloud PCs. Recommendations point you at the setting or policy to change; an admin still decides and makes the change.

Exam tip Reading the reports needs a role such as Intune Administrator, Endpoint Security Manager or a read-only operator; the data needs devices enrolled and sending Endpoint analytics data.

What Remote Help is

Remote Help lets a help desk worker view or control a user's screen. Unlike Quick Assist it's tied to your tenant: both people sign in with their work accounts, the helper sees whether the device is enrolled and compliant, and sessions are logged.

• Licensed through the Intune Suite or the Remote Help add-on
• Turn it on: Tenant administration > Remote Help > Settings > Enable
• Choose whether unenrolled devices are allowed
• Deploy the Remote Help app to devices (Windows Win32 app; also available for macOS and Android Enterprise dedicated devices)

Permissions and sessions

Give helpers an RBAC role with Remote Help permissions: View screen, Take full control, Elevation (run as admin on the user's PC) and Unattended control (some Android scenarios). The user must accept the session (except where unattended control is allowed). Session reports show who helped whom and when.

Exam tip Need the helper to approve an admin prompt on the user's PC: the role needs the Elevation permission. Need view-only: give View screen only.