Glossary¶

Abbreviations also show their meaning when you hover over them anywhere in this handbook.

Apple Business: Apple's portal for organizations, which replaced Apple Business Manager in April 2026. You use it to assign devices to Intune for Automated Device Enrollment and to buy apps through Apps and Books. Schools use Apple School Manager. See Apple devices.
Apple MDM push certificate: The certificate that lets Intune wake Apple devices through the Apple Push Notification service. Valid for 365 days and must be renewed with the same Apple account. See Apple devices.
App configuration policy: A policy that pre-configures an app's settings, delivered through the device's MDM channel or the Intune App SDK. See App configuration.
App protection policy: A policy that protects work data inside apps, with or without device enrollment. Also called MAM. See App protection.
Assignment filter: A rule on device or app properties that narrows an assignment at check-in time, without depending on group membership. See Targeting.
Automated Device Enrollment (ADE): Apple's zero-touch enrollment for devices bought through Apple or authorized resellers. Devices are supervised and enroll during Setup Assistant.
Co-management: Managing a Windows device with both Configuration Manager and Intune, moving workloads to Intune one at a time. See Other Windows enrollment.
Company Portal: The app and website where users enroll devices, install available apps, check compliance and get help.
Compliance policy: The rules a device must meet to be considered compliant. The result feeds Conditional Access. See Compliance policies.
Conditional Access: The Microsoft Entra ID feature that allows, challenges or blocks sign-ins based on signals such as device compliance. See Conditional Access.
Configuration service provider (CSP): The interface Windows exposes for MDM settings. Each Intune Windows setting maps to a CSP node.
Declarative device management (DDM): Apple's newer management model, in which the device enforces declarations on its own and reports status. Now the recommended way to manage Apple software updates.
Device query: An Advanced Analytics feature that runs KQL against live device inventory, for one device or many. See Reporting and monitoring.
Endpoint Privilege Management (EPM): Lets standard users run approved files as administrator, under rules you define. See EPM.
Enrollment Status Page (ESP): The Windows setup screen that shows provisioning progress and can hold users until required apps and policies are installed. See Windows Autopilot.
Enrollment time grouping: Adds a device to a static security group during enrollment, so policies and apps assigned to that group apply at the first check-in.
Hotpatch: Windows security updates that take effect without a restart in most months. Managed through Windows Autopatch quality update policies. See Windows updates.
Intune Management Extension (IME): The Windows agent that installs Win32 apps and runs PowerShell scripts and remediations.
Microsoft Entra hybrid joined: A Windows device joined to on-premises Active Directory and registered in Entra ID. Supported, but not recommended for new devices.
Microsoft Entra joined: A Windows device joined directly to Entra ID. The recommended state for corporate devices.
Microsoft Entra registered: A device with a work account added but owned by the user, typical for personal devices.
Multi Admin Approval (MAA): Requires a second administrator to approve changes to protected resources such as wipes, scripts and roles. See Admin roles and RBAC.
Platform SSO (PSSO): macOS single sign-on with Entra ID at the login window and in apps, using a Secure Enclave key, smart card or password. See Passwordless sign-in.
Remediations: Scheduled detection and remediation PowerShell scripts for Windows, with reporting. Formerly Proactive remediations. See Scripts and remediations.
Retire: Removes company data and management from a device, leaving personal data. Compare wipe, which factory resets the device. See Device actions and lifecycle.
Scope tags: Labels that control which Intune objects an administrator can see and manage. See Admin roles and RBAC.
Security baseline: A Microsoft-recommended group of security settings delivered as a single profile. See Security baselines.
Settings catalog: The searchable list of thousands of device settings used to build configuration profiles. See Configuration profiles.
Supervised: An Apple device mode that unlocks additional management controls. Devices become supervised through Automated Device Enrollment or Apple Configurator.
Tattooing: When a Windows setting stays on the device after the profile that set it is removed.
User affinity: Whether a device is associated with a specific user. Devices without user affinity can only receive device-targeted policies and apps.
Virtual groups: All users and All devices: built-in Intune targets that need no Entra group processing.
Win32 app: The Intune app type for Windows installers packaged as .intunewin files. See Packaging Win32 apps.
Windows Autopatch: The Windows update orchestration service built into Intune, behind update rings, feature, quality and driver update policies. See Windows updates.
Windows Autopilot: Microsoft's service for turning a new Windows device into a managed corporate device without imaging. See Windows Autopilot.
Work profile: A separate container on an Android device for work apps and data, used for personal (BYOD) and corporate-owned work profile devices.