隨著組織和業(yè)務(wù)的發(fā)展，越來越多的設(shè)備（如筆記本電腦、平板電腦和顯示面板）不可避免地用于日常工作和課堂。如此大量的設(shè)備給 IT 部門帶來了沉重的維護(hù)負(fù)擔(dān)。此外，自 2020 年以來，由于遠(yuǎn)程工作的需求不斷增加，從內(nèi)網(wǎng)向設(shè)備分發(fā)更新的傳統(tǒng)方式已變得效率低下。企業(yè)需要一種更有效的方式來確保設(shè)備的安全性和功能的及時更新。

Microsoft Intune 是微軟推出的基于云的統(tǒng)一端點管理服務(wù)，其中包括管理端點設(shè)備的 MDM 服務(wù)。作為 Microsoft 365 許可證功能的一部分，Intune 完全符合 EiM 管理組織設(shè)備的要求。

要將該解決方案付諸實踐，需要考慮幾個條件，包括但不限于：

• 管理員和資源的角色和范圍分配，因為每個學(xué)校擁有不同級別的權(quán)限來管理目錄中的對象。
• 針對不同操作系統(tǒng)和情況的設(shè)備的注冊方式。在部署前應(yīng)考慮各種條件，如是否由本地目錄管理、設(shè)備是否允許出廠重置、由員工還是學(xué)生使用等。
• 可能阻礙注冊進(jìn)度的因素，如加入域的設(shè)備不在辦公室、由其他系統(tǒng)管理的設(shè)備造成沖突等。

此外，為員工和管理員提供通知和指導(dǎo)也是使系統(tǒng)在足夠負(fù)荷的情況下正常使用的關(guān)鍵部分。

Intune 的啟用成功減輕了 IT 部門重復(fù)性工作的負(fù)擔(dān)，使他們能夠把時間花在更高級的功能上。設(shè)備用戶也可以更及時地獲得應(yīng)用程序和更新，所有這些都是自動或自助服務(wù)。此外，作為一個先決條件，這也為將來加入其他最新安全功能鋪平了道路。

With the growth of the organization and business, it becomes inevitable that more and more devices like laptops, tablets and display panels have been used in daily work and classes. Such a large scale number of devices has made the maintenance for IT department a heavy burden. Besides, due to the increasing need for remote work since 2020, the traditional way of distribute update to devices from intranet has become less efficient. The organization will need a more effective way to ensure the security of devices and features being up-to-date.

Microsoft Intune is a cloud-based unified endpoint management service brought out by Microsoft, which including MDM service for managing endpoint devices. Being included as part of the Microsoft 365 licenses features, Intune fits EiM’s requirement of managing organization devices perfectly.

To bring the solution into practice, several conditions need to be take into consideration, including but not limited to:

• The role and scope assignment for administrators and resources as each school holds different levels of permissions for managing the objects in directory.
• The way of enrollment for devices with different OSs and situation. Conditions, like being managed by local directory or not, devices allowed to be factory reset, used by a staff or students, should all be considered before deployment.
• Factors that may block the progress of enrollment, like domain joined devices being absent from office, conflict caused by devices being managed by other system.

In addition, notification and tutorial for staff and administrators is also the key part to make the system being used properly with adequate load.

The on boarding of Intune has successfully downgrade the load of repetitive works for IT department and allows them to spend time on more advanced features. Devices users can also get applications and updates more timely, all automatic or self-serviced. Besides, working as a prerequisite, this has pave the road for on boarding other latest security feature from Microsoft in the future.