# Planning Deployment and Architecture

> Chapter 2 of the Courseiva MD-102 curriculum — https://courseiva.com/learn/md-102/planning-deployment-architecture

**Official objective:** 1.2 — Plan and design a device management infrastructure

## Introduction

What exact steps do you take to manage 2,000 brand-new company laptops that have never been turned on, and make sure each one is secure, has the right apps, and is assigned to the correct employee, all without visiting a single desk?

That is the problem of 'planning deployment and architecture'. It is the blueprint you create before you manage even one device. For the MD-102 exam, this concept is vital because the exam tests whether you can design a management system that works at scale, not just for one computer, but for an entire organisation.

## The New Office Building Analogy

Have you ever been responsible for fitting out a brand-new office building for your company, where every single future employee will work, but you haven't hired anyone yet and you don't know exactly how many people you'll need desks for?

That is the exact problem of 'planning deployment and architecture' for device management. You start with an empty space. Your job is not just to buy desks and chairs and computers. Your job is to decide the entire layout: where the power outlets go, which walls are for wiring, how the network drops are installed, and how the heating and cooling systems will handle the load. You must decide if you are going to use a central server room for all your computers, or if you will give everyone a laptop and let them connect to the cloud. This is the architecture.

Then, you have to actually bring all the furniture and equipment in and set it up. But you cannot just drop everything at the front door and tell people to grab what they need. You need a plan for how delivery trucks arrive, how boxes get unpacked, how each desk gets its specific chair, monitor, and keyboard, how serial numbers are logged, and how each device is configured with the correct software before it is ever used. That is the deployment plan. In the IT world, this is exactly what you do when you plan how to manage thousands of company-issued phones, laptops, and desktops using Microsoft Intune and Microsoft Entra ID. You design the system before you ever touch a single device.

## Core explanation

Planning deployment and architecture is the foundational stage of device management. It is the process of designing how your organisation will manage, secure, and configure all of its devices (laptops, desktops, tablets, phones) before you ever actually enrol a single one. Think of it as creating a master plan for a city before you build the first house.

In Microsoft's ecosystem, the tool you use for this is **Microsoft Intune**. Intune is a cloud-based service that lets you manage devices and applications remotely. Instead of a technician physically touching each computer to install software or change settings, Intune allows you to push configurations from the cloud. The identity backbone that ties every user and device together is **Microsoft Entra ID** (formerly known as Azure Active Directory). Microsoft Entra ID is a cloud directory service; it is like a master list of every employee and every device, and it controls who can access what.

Let's break down what 'architecture' means here. Architecture refers to the high-level design choices you make. These choices include:

- **Management authority**: Who owns the devices? Are they company-owned (Corporate Owned, Personally Enabled or COPE) or are they personal devices that employees use for work (Bring Your Own Device or BYOD)? This choice dramatically changes how you manage them.
- **Identity source**: Where do users exist? If you already have employees in an on-premises **Active Directory** (a traditional directory service running on your own servers running Windows Server), you need to plan how to synchronise that to Microsoft Entra ID using a tool like **Microsoft Entra Connect**. If you have no on-premises servers, you can start purely in the cloud.
- **Enrolment method**: How will devices join the management system? A Windows device can join Microsoft Entra ID directly, or it can be enrolled via **Autopilot**. **Windows Autopilot** is a collection of technologies that lets you pre-configure a new device and then ship it directly from a manufacturer like Dell or HP to the employee. When the employee turns it on, the device automatically connects to your organisation, downloads the correct settings, and is ready to work.
- **Compliance policies**: What rules must a device follow to be considered healthy? For example, a device must have a password longer than 8 characters, encryption turned on, and antivirus software running. If a device breaks these rules, you can block it from accessing company email or data.
- **Configuration profiles**: What settings do you want to push automatically? This can include Wi-Fi network passwords, VPN configurations, email account settings, or specific browser bookmarks.
- **Application management**: How do you get software onto the devices? You can use Intune to force-install critical business apps, or you can make a company portal where employees can install optional apps themselves.

Now, 'deployment' is the actual execution of this architecture plan. Deployment covers the lifecycle of a device: from the moment it arrives in a box, through its first setup, its daily use, and finally its retirement. The key concepts in deployment are **bulk enrolment** and **zero-touch provisioning**. Bulk enrolment means you can enrol many devices at once using a special token or a file provided by the device manufacturer. Zero-touch provisioning, which is the goal of Autopilot, means a user can take a brand new device out of the box, turn it on, sign in with their work Microsoft Entra ID credentials, and the device automatically becomes a fully managed corporate device without any manual intervention from an IT technician.

Why does all this matter? In the past, IT professionals had to physically image each computer – plugging in a USB drive or DVD, running a custom script, and spending 30-60 minutes per device. For 500 new hires, that meant days of work. With a well-planned architecture and deployment strategy using Intune and Windows Autopilot, the same task happens automatically in the cloud. The exam tests your ability to choose the right deployment method for a given scenario. You might be asked: 'A company has 1,000 new laptops arriving from a manufacturer next week. Management wants them to be configured with specific security settings and handed directly to employees without IT involvement. What should you plan?' The answer involves Windows Autopilot, a deployment profile, and Microsoft Entra ID join. Understanding how these pieces fit together is the core of this exam objective.

## Real-world context

Imagine you are the sole IT administrator for a growing marketing agency called 'Creative Spark'. The company has 50 employees today, but just signed a contract to triple its workforce over the next six months. The CEO tells you they want to hire 100 new people, and each one needs a new laptop. The CEO also wants these laptops to be secure from day one and does not want you to spend your entire day setting them up.

Here is what you actually do, step by step, to plan the deployment and architecture.

First, you assess the current state. You currently have 30 company-owned Windows laptops and 20 MacBooks. You manage them manually – you physically touch each device to install software. With 100 new devices, that approach is impossible. You decide to move to a cloud-managed model using Microsoft Intune. Before you order the laptops, you create an architecture plan:

1. You decide that all new devices will be company-owned and joined directly to Microsoft Entra ID. This means they are purely cloud-managed and will not connect to any on-premises server.
2. You create a Microsoft Entra ID tenant (your organisation's instance of the directory) and synchronise your existing employee list.
3. You create a Windows Autopilot deployment profile in Intune. This profile specifies that the device name will start with 'CS' (for Creative Spark), the device will automatically install Microsoft 365 Apps, and it will enforce BitLocker encryption (which encrypts the entire hard drive so data is safe if the laptop is stolen).
4. You contact the laptop manufacturer and request that they register the serial numbers of the 100 new laptops into your Autopilot service. This is done by uploading a CSV file containing the device hardware hashes (a unique identifier).
5. You define compliance policies in Intune. For example, you require that every device have a device password of at least 8 characters, that it is encrypted, and that it gets security updates within 24 hours of release.
6. You create a conditional access policy in Microsoft Entra ID. This policy states that a user can only access company email and Teams if their device is marked as compliant by Intune. If the device is not compliant, access is blocked.

Now, the deployment phase begins. The laptops arrive at the office. Instead of unboxing and configuring each one, you give them directly to the new hires. When a new employee named Sarah turns on her laptop for the first time, she sees the standard Windows setup screen. She enters her work email address (which is her Microsoft Entra ID username). The laptop then contacts Microsoft's cloud service. It recognises the hardware hash, which matches the device you uploaded. The Autopilot profile kicks in. A screen appears that says 'Welcome to Creative Spark!' The laptop automatically joins the Microsoft Entra ID tenant, downloads all the configuration policies you set, installs Microsoft 365, and enforces encryption. Sarah then reaches her desktop. She is logged in and can access her email. She never needed your help.

Your ongoing tasks include monitoring the Intune console to see if any devices are non-compliant, updating your configuration profiles when you need to push a new app, and retiring devices when they are no longer used by removing them from Microsoft Entra ID and Intune. This real-world scenario shows that planning deployment and architecture is not a one-time event; it is a continuous strategy for managing devices at scale.

## Exam focus

The MD-102 exam will test 'Plan and design a device management infrastructure' (objective 1.2) heavily. You will see scenario-based multiple-choice questions where you must choose the correct architecture or deployment strategy based on a business requirement. These questions are designed to test your decision-making, not just your memory.

Here are the specific concepts the exam loves to test and the traps they set:

- **Windows Autopilot vs. traditional imaging**: A common question will describe a company that wants to 'wipe and reload' a device. The exam expects you to know that Windows Autopilot is for provisioning new devices or resetting existing ones to a business-ready state, not for restoring a custom image. If a scenario mentions 'custom master image', the answer is likely NOT Autopilot but traditional imaging (though they want you to recommend moving away from it). The trap is that beginners think Autopilot can deploy custom images; it cannot. Autopilot uses the base Windows OS already on the device and configures it via policies.
- **Enrolment methods for different device types**: You must know which enrolment method is used for iOS, Android, and Windows devices. For example, iOS devices use Apple Business Manager and enrolment profiles, while Android devices use Android Enterprise. The exam will ask: 'A company has 50 iPhones purchased from a reseller. What is the first step to manage them with Intune?' The correct answer is 'Register the devices with Apple Business Manager'. The trap is choosing 'Create an enrolment profile in Intune' first, which is wrong; you must link the Apple service first.
- **Corporate-owned vs. personally-owned**: The exam will test whether you know the management differences. For example, with personally-owned devices (BYOD), you cannot enforce full device encryption or wipe the entire device. You can only remove corporate data using selective wipe. The trap is thinking you can manage BYOD devices the same way as corporate-owned.
- **Device compliance vs. conditional access**: These are two different layers. Compliance checks the device health (e.g., is encryption on?). Conditional access uses that compliance result to grant or block access to apps. A typical question: 'A user reports they cannot access email even though their device is enrolled. You see the device is non-compliant because it lacks a PIN. What is the most likely reason they cannot access email?' The answer: Conditional access is blocking access because the device is non-compliant. The trap is beginners saying 'Intune is broken' or 'the certificate expired'.
- **Microsoft Entra ID join vs. Hybrid Azure AD join**: This is a major distinction. Microsoft Entra ID join is for devices that are purely cloud-based. Hybrid Azure AD join is for devices that are joined to an on-premises Active Directory AND to Microsoft Entra ID. The exam will present a scenario where a company has existing on-premises servers and wants to manage laptops that users take off-premises. The correct choice is often Hybrid Azure AD join because it allows the device to authenticate to on-premises resources (like a file server) and also be managed from the cloud. The trap is always defaulting to Microsoft Entra ID join because it is simpler.

To prepare, create a study table for yourself comparing the features of Autopilot vs. traditional imaging, Microsoft Entra ID join vs. Hybrid join, and compliance vs. conditional access. Practise reading a scenario and identifying which concepts apply. The exam questions will often have two technically correct answers, but only one best fits the specific business requirements, such as cost, user location, or existing infrastructure.

## Step by step

1. **Assess Current Environment** — Identify your existing infrastructure, including on-premises Active Directory, user accounts, and current device management methods. This determines whether you need Hybrid Azure AD join or pure cloud join.
2. **Choose Identity Model** — Decide whether users will authenticate purely via Microsoft Entra ID or if you will synchronise from on-premises AD using Microsoft Entra Connect. This is the foundation of your architecture.
3. **Define Device Ownership Model** — Determine if devices are corporate-owned (COPE) or personally-owned (BYOD). This affects which enrolment method you use and what management controls (like remote wipe) are available.
4. **Select Enrolment Method per Platform** — For Windows devices, plan for Windows Autopilot or manual Microsoft Entra ID join. For iOS, set up Apple Business Manager. For Android, configure managed Google Play. Each platform has unique prerequisites.
5. **Create Configuration and Compliance Policies** — Build device configuration profiles in Intune to push settings (Wi-Fi, VPN, apps) and compliance policies to define minimum security requirements. These policies are applied automatically during and after enrolment.
6. **Set Up Conditional Access Policies** — In Microsoft Entra ID, configure policies that enforce access rules based on device compliance, user location, or risk level. This is the security gate that ensures only healthy devices can access data.
7. **Test and Validate Deployment Process** — Enrol a small set of test devices using your chosen methods and verify that policies apply correctly. Validate that the user experience is smooth before rolling out to the entire organisation.

## Comparisons

### Microsoft Entra ID Join vs Hybrid Azure AD Join

**Microsoft Entra ID Join:**
- Device is joined only to the cloud directory (Microsoft Entra ID).
- No dependency on on-premises Active Directory or domain controllers.
- Best for cloud-first organisations with no on-premises servers.

**Hybrid Azure AD Join:**
- Device is joined to both on-premises Active Directory and Microsoft Entra ID.
- Requires network connectivity to a domain controller for initial join.
- Best for organisations with existing on-premises apps and file servers.

### Windows Autopilot vs Traditional Imaging

**Windows Autopilot:**
- Uses the existing Windows OS on the device; no custom image needed.
- Configuration is applied from the cloud via Intune policies.
- Supports zero-touch provisioning; device can be shipped directly to user.

**Traditional Imaging:**
- Requires creating a custom Windows image with pre-installed apps and settings.
- Configuration is applied locally via a task sequence during imaging.
- Requires physical access to the device or a technician to run the imaging process.

### Compliance Policy vs Conditional Access

**Compliance Policy:**
- Evaluates device health (e.g., encryption, OS version, PIN).
- Marks a device as compliant or non-compliant.
- Does not directly block access; it only reports status.

**Conditional Access:**
- Uses compliance status and other signals (location, risk) to make access decisions.
- Grants or blocks access to apps like Exchange Online and SharePoint.
- Enforces the rule: 'If device is non-compliant, block access to email.'

### Corporate-Owned (COPE) vs Personally-Owned (BYOD)

**Corporate-Owned (COPE):**
- IT has full control; can remote wipe the entire device.
- Device is typically enrolled as a dedicated corporate device.
- All data on the device is considered company property.

**Personally-Owned (BYOD):**
- IT has limited control; can only selectively remove corporate data.
- Device is enrolled with user privacy protections; personal data is untouched.
- User retains ownership; IT cannot monitor personal apps or files.

## Diagram

_Flowchart showing the key decisions in planning deployment and architecture, from business requirements to device enrolment and policy enforcement._

```mermaid
flowchart TD
    A[Define Business Requirements] --> B[Choose Identity Model]
    B --> C[Microsoft Entra ID Join (Cloud Only)]
    B --> D[Hybrid Azure AD Join (Cloud + On-Prem)]
    A --> E[Choose Device Ownership]
    E --> F[Corporate Owned (COPE)]
    E --> G[Personally Owned (BYOD)]
    C --> H[Select Enrolment Method]
    D --> H
    F --> H
    G --> H
    H --> I[Windows: Autopilot or Manual Join]
    H --> J[iOS: Apple Business Manager]
    H --> K[Android: Managed Google Play]
    I --> L[Create Compliance & Config Policies]
    J --> L
    K --> L
    L --> M[Set Conditional Access Policies]
    M --> N[Devices Enrolled and Managed]
```

## Common misconceptions

- **Misconception:** Windows Autopilot can deploy a customised Windows image with pre-installed third-party software. **Reality:** Windows Autopilot uses the base Windows OS that ships with the device and applies settings and apps from Intune policies. It does not deploy custom images; that is the role of Microsoft Configuration Manager or traditional imaging. (People confuse Autopilot with imaging tools because both set up devices, but Autopilot is a configuration service, not an imaging solution.)
- **Misconception:** If a device is enrolled in Intune, it automatically cannot access company data if it is non-compliant. **Reality:** Enrolment alone does not enforce access control. Intune marks the device as compliant or non-compliant, but it is Microsoft Entra ID Conditional Access that actually blocks access to apps based on that compliance status. (This misconception is common because beginners think Intune is the only layer of security, but it only reports health; the gatekeeper is Conditional Access.)
- **Misconception:** Microsoft Entra ID is just a different name for the old on-premises Active Directory, and they work the same way. **Reality:** Microsoft Entra ID is a cloud-based identity service with no direct equivalent to Group Policy or domain controllers. It uses different protocol (OAuth, SAML) and is not a drop-in replacement for on-premises AD. (The name 'Active Directory' is familiar, so beginners assume the cloud version behaves identically, leading to confusion about device join methods and management.)
- **Misconception:** You can manage all device types (Windows, iOS, Android) using the exact same enrolment and configuration process. **Reality:** Each platform has unique enrolment methods, settings, and limitations. iOS requires Apple push certificates and Apple Business Manager; Android requires a managed Google Play account; Windows offers multiple join options. (The simplified view of Intune as a 'one-tool-fits-all' leads beginners to overlook platform-specific prerequisites, which the exam specifically tests.)
- **Misconception:** A device that is non-compliant must immediately be wiped and re-enrolled to become compliant again. **Reality:** Intune can automatically remediate some non-compliance issues, such as forcing a user to set a PIN or update their OS. Only in severe cases is the device blocked or wiped, but remediation policies can fix common issues automatically. (Beginners assume 'non-compliant' is a permanent state, but Intune includes self-remediation actions like sending a notification or prompting the user to fix the issue.)

## Key takeaways

- Planning deployment and architecture means designing your device management strategy in Microsoft Intune and Microsoft Entra ID before you enrol a single device.
- Windows Autopilot enables zero-touch provisioning by using hardware hashes to identify devices and push cloud-based configurations without manual imaging.
- The choice between Microsoft Entra ID join and Hybrid Azure AD join depends on whether your organisation has on-premises Active Directory servers that resources still depend on.
- Compliance policies check a device's health, but Conditional Access policies in Microsoft Entra ID are what actually grant or block access to company resources.
- Enrolment methods are platform-specific: iOS devices require Apple Business Manager, Android devices require managed Google Play, and Windows devices use Autopilot or manual Microsoft Entra ID join.
- A well-planned architecture separates the management of corporate-owned and personally-owned devices, using selective wipe for BYOD and full wipe for corporate-owned devices.

## FAQ

**What is the difference between Microsoft Entra ID join and Hybrid Azure AD join?**

Microsoft Entra ID join connects a device only to the cloud directory, while Hybrid Azure AD join connects the device to both an on-premises Active Directory and Microsoft Entra ID. Hybrid join is used when you have on-premises apps or file servers that require traditional domain authentication.

**Do I need to buy new hardware to use Windows Autopilot?**

No, you can use existing hardware. Autopilot works with devices already running Windows 10 or 11. You just need to upload their hardware hashes to Intune. However, the best experience is with devices pre-registered by the manufacturer.

**What happens if I enrol a personal device in Intune? Can the IT person see my private files?**

No, Intune for BYOD devices uses a management profile that only controls the corporate data and apps. IT can see device compliance status and can remove corporate data, but they cannot access personal photos or messages.

**What is a hardware hash and why is it important for Autopilot?**

A hardware hash is a unique identifier generated from a device's components (like the motherboard and storage). It is used to identify a specific device when it contacts Autopilot for the first time, so the correct deployment profile is applied.

**If I already manage devices with Microsoft Configuration Manager, can I switch to Intune?**

Yes, you can run them side-by-side using co-management, which lets you gradually shift workloads like policies and apps from Configuration Manager to Intune. You do not have to migrate everything overnight.

**What does a compliance policy actually do?**

A compliance policy defines rules like 'device must have a PIN' or 'device must be encrypted'. It evaluates the device's state and marks it as compliant or non-compliant. This status is then used by Conditional Access to allow or block access to apps.

## Check your understanding

1. **A company wants to provision 500 new Windows laptops with zero IT intervention. The laptops will be shipped directly from the manufacturer to employees. Which deployment method should you plan for?**

   Answer: Windows Autopilot, because it enables zero-touch provisioning by using hardware hashes to automatically apply configurations from Intune when the user signs in for the first time.

2. **What is the difference between a compliance policy and a Conditional Access policy?**

   Answer: A compliance policy checks whether a device meets security rules (like having a PIN) and marks it compliant or non-compliant. A Conditional Access policy uses that compliance status to grant or block access to apps.

3. **An organisation has an on-premises file server that employees need to access from their laptops. The laptops are taken home and used off-site. Which join type should you plan for the devices?**

   Answer: Hybrid Azure AD join, because it allows the device to authenticate to both the on-premises Active Directory (for file server access) and Microsoft Entra ID (for cloud management via Intune) while off-premises.

4. **A user enrols their personal Android phone in Intune for work email. The IT administrator needs to remove only the corporate data from the phone without affecting personal photos. What type of wipe should be used?**

   Answer: A selective wipe (also called a retire action) that removes only managed corporate apps and data, leaving personal data intact. A full wipe would erase the entire device.

5. **What must an administrator do first before enrolling a batch of new iPhones into Intune?**

   Answer: Establish a connection to Apple Business Manager by uploading an Apple Push Notification certificate, and then create an enrolment profile in Intune that links the devices to the management system.

---

Interactive version with quiz and diagrams: https://courseiva.com/learn/md-102/planning-deployment-architecture