Field notes on enterprise endpoint management — Jamf Pro, Microsoft Intune, Windows Autopilot, Apple Business Manager, zero-touch deployment, Conditional Access and compliance. Written from work on real 1,000+ device fleets in regulated environments, not lab setups.
The admin center restriction and a Conditional Access block stop portal access -- they do not stop the search bar from returning group names and device records.
Cleanup rules hide stale device records, not delete them. The parts that matter: the 30-270 day range, the certificate-expiry recovery window, and why Jamf-managed devices are skipped entirely.
Apple is warning iPhone users about mercenary spyware again. The part the headlines miss: Lockdown Mode cannot be managed by MDM, and it blocks MDM while active.
This Intune setting does not let MDM win a conflict with Group Policy for Windows Update — it skips the Group Policy reader entirely. How it works and when to use it.