Policies/NSP-INTUNE-ENROLL-01.psd1
|
@{ Id = 'NSP-INTUNE-ENROLL-01' Name = 'Block enrollment except for approved groups' Version = 1 Description = 'Blocks Apple Business Manager and Intune enrollment for everyone except members of the EnableMFA and MFACatchAll groups.' Notes = 'Converted from Legacy/Policies/Intune_DefaultBLOCKEnrollment.ps1 (legacy description: "attempt at setting default of block").' LegacyNames = @('Intune - Default BLOCK Enrollment') DefaultState = 'reportOnly' Users = @{ IncludeUsers = @('All') ExcludeUsers = @('{BreakGlass}', '{ServiceAccounts}') ExcludeGroups = @('{Group:EnableMFA}', '{Group:MFACatchAll}') } Applications = @{ Include = @('{App:Apple Business Manager}', '{App:Microsoft Intune Enrollment}') } Grant = @{ Operator = 'OR' BuiltInControls = @('block') } } |