Policies/NSP-INTUNE-ENROLL-02.psd1
|
@{ Id = 'NSP-INTUNE-ENROLL-02' Name = 'Only approved enrollment (needs review)' Version = 1 Description = 'Intended as the other half of NSP-INTUNE-ENROLL-01.' Notes = 'Converted from Legacy/Policies/Intune_OnlyApprovedEnrollment.ps1 (legacy description: "other half at attempt"). NEEDS REVIEW BEFORE ENFORCING: as written it blocks Microsoft Intune and Intune Enrollment for ALL users except breakglass, because IncludeUsers All makes IncludeGroups redundant. It was disabled in the legacy set. Kept identical for parity; fix it as a separate, reviewed change.' LegacyNames = @('Intune - Only Approved Enrollment') DefaultState = 'reportOnly' Users = @{ IncludeUsers = @('All') IncludeGroups = @('{Group:EnableMFA}', '{Group:MFACatchAll}') ExcludeUsers = @('{BreakGlass}', '{ServiceAccounts}') } Applications = @{ Include = @('{App:Microsoft Intune Enrollment}', '{App:Microsoft Intune}') } Grant = @{ Operator = 'OR' BuiltInControls = @('block') } } |