Endpoint Jobs
Learning roadmap
Two tracks for endpoint engineers. Check a skill when you can do it without a walkthrough. Progress stays in this browser.
Microsoft Intune
Cloud endpoint management for Windows-first fleets: enroll the device, prove it is compliant, then ship apps and settings without imaging.
Foundations
Know what Intune manages, which identity the device has, and how a Windows PC gets enrolled.
Explain what Intune enrolls when it manages the whole device, and what it can still protect when it manages only the work apps.
Tell Microsoft Entra registered, joined, and hybrid joined apart, and pick the join type for a cloud-native company PC.
Open devices, apps, endpoint security, and tenant administration, and match each blade to the job it does.
Enroll with a user-driven path and with Windows Autopilot, and name what has to exist in the tenant before either one works.
Admin
Run the daily admin center work: compliance, apps, updates, and the access rule that uses them.
Create a Windows compliance policy, set the checks that mark a device noncompliant, and choose the grace period before that mark applies.
Add a store app and a Win32 app, assign each to a group, and choose Required when the device must have it and Available when the person opts in.
Create update rings that defer quality and feature updates, and assign a pilot ring before the production ring.
Block a cloud app until Intune reports the device compliant, exclude a break-glass account, and stay in report-only until the impact is checked.
Engineer
Package software, configure settings precisely, repair drift, and hold Autopilot until the device is ready.
Build an .intunewin file, add a detection rule that leaves a healthy install alone, and supersede the previous version.
Build a configuration profile from the settings catalog, and use a custom OMA-URI only when the catalog does not list the setting.
Write a detection script that exits 1 only when a fix is needed, and a remediation script that leaves the device in the detected-good state.
Register a device, assign a user-driven deployment profile, and keep the Enrollment Status Page up until required apps and policies finish.
Architect
Choose the management plane, the security bar, who can change it, and how a change reaches production.
Name which Windows workloads stay with Configuration Manager, which move to Intune, and what a cloud-native fleet stops using on-premises.
Deploy an Intune security baseline, then onboard Microsoft Defender for Endpoint so device risk is available to access decisions.
Assign a built-in role for the task, then add a scope tag so a regional admin sees and changes only that region's devices and policies.
Pick a group, an assignment filter, or an update ring for the rollout, prove it on a pilot, and repeat the same change through Microsoft Graph when the click-path is the work.
Jamf
Apple endpoint management in Jamf Pro. The vendor courses follow the same foundations-to-architect path.
Foundations
Know how Apple expects organization-owned devices to enroll, and how Jamf Pro records them.
Describe supervision, MDM, Apple Business, and Automated Device Enrollment, and why an organization-owned Mac should enroll that way.
Open a Mac's inventory and separate the facts Jamf Pro collected on check-in from the facts you still have to add yourself.
Put a lab in a static group, build a smart group from inventory criteria, and use the smart group when membership should change on its own.
Connect Jamf Pro to Automated Device Enrollment, assign the Mac to a computer PreStage, and confirm it enrolls during Setup Assistant.
Admin
Ship the everyday Jamf Pro objects: policies, profiles, software, and patches.
Create a policy with a trigger, an execution frequency, and a scope, and make it available in Self Service when a person should run it.
Install a computer-level profile automatically, and predict when a user-level payload waits until that user logs in.
Upload a package for a policy to install, and turn on an App Installers title when Jamf already tracks that vendor's updates.
Enable a patch software title and scope a patch policy to the Macs whose inventory shows they are behind.
Engineer
Extend inventory, script the gaps, call the API, and pick the right install tool.
Add a script extension attribute for something inventory does not store, and use the result as smart group criteria.
Deploy a zsh script in a policy, then use the policy log's exit code and output to see why a Mac failed.
Request a bearer token and call the Jamf Pro API to read or update an object the account is allowed to change.
Install a vendor app with a package policy, or with Installomator when you want Jamf to keep fetching the current pkg, and don't put that install in a configuration profile.
Architect
Design zero-touch enrollment, identity, the security bar, and how a large Jamf Pro tenant is split.
Decide the local account, the Setup Assistant skips, and the remote-management payload so the Mac is managed before anyone reaches the desktop.
Deploy Jamf Connect so the first login creates the account from your identity provider, and scope enrollment-only settings so they leave after setup.
Turn FileVault on and escrow the recovery key during or just after enrollment, then target Jamf Protect plans at the Macs that need them.
Put devices and policies in sites, limit each account to the privileges that site needs, and move ongoing configuration to declarative device management.