Manage and maintain devices · Topic 5 of 9
Android, iOS, macOS and Specialty Device Profiles
MD-102 other platforms: device profiles for Android Enterprise, iOS and iPadOS, macOS, plus OEMConfig, Zebra, HoloLens 2 and Microsoft Teams Rooms devices.
- 5 min
- Android Enterprise profiles depend on the enrollment mode. Device administrator is deprecated.
- OEMConfig delivers manufacturer settings to Android Enterprise devices. MX profiles are for Zebra devices on device administrator.
- iOS settings such as home screen layout often need supervised devices (ADE).
What it is
Each platform has its own profile types, because each operating system exposes different management features. This page covers Android Enterprise, iOS/iPadOS and macOS, and then specialty devices: Zebra handhelds, HoloLens 2 headsets and Microsoft Teams Rooms systems. The skill is knowing which profile reaches a given setting on a given device.
How it works
Android profiles
Android profiles depend on the enrollment mode. Create them under Devices, Android, Configuration, and pick the platform: Android Enterprise (fully managed, dedicated and corporate owned work profile, or personally owned work profile) or AOSP. Android device administrator is deprecated.
| Profile | Use |
|---|---|
| Device restrictions | Camera, screen capture, system updates, password, Wi-Fi, kiosk apps and many other controls |
| Wi-Fi, VPN, email, certificates | Connectivity and identity (trusted, SCEP and PKCS certificates) |
| Custom | Specific settings by OMA-URI |
| OEMConfig | Manufacturer specific settings delivered by the vendor's OEMConfig app |
| Settings catalog | Newer Android Enterprise settings |
OEMConfig is how you set manufacturer features such as Zebra and Samsung Knox. Intune deploys the vendor's OEMConfig app and shows its schema as a profile, so settings are not limited to Microsoft's own list.
iOS and iPadOS profiles
| Profile | Use |
|---|---|
| Device features | AirPrint, home screen layout, notifications, lock screen message, single sign on |
| Device restrictions | Controls such as App Store, camera, AirDrop and password rules |
| Wi-Fi, VPN, email, certificates | Connectivity and identity |
| Custom | An uploaded .mobileconfig file |
| Settings catalog | A wide range of settings, including declarative device management (DDM) items |
Many settings, such as home screen layout and silent app install, need the device to be supervised, which means enrolled through automated device enrollment or Apple Configurator.
macOS profiles
| Profile | Use |
|---|---|
| Device features | Login window, AirPrint, energy saver, associated domains |
| Device restrictions | Screen lock, Apple services and similar controls |
| Extensions | Approve system and kernel extensions without a user prompt |
| Settings catalog | Broad coverage of macOS settings |
| Custom | An uploaded .mobileconfig file, or a preference file (plist) |
| Endpoint security | FileVault, firewall, antivirus and Gatekeeper |
If a setting is not in the built in templates, a settings catalog profile or a custom .mobileconfig file can deliver it on macOS. The Windows only options (administrative templates, OMA-URI) do not apply.
Specialty devices
| Device | How Intune manages it |
|---|---|
| Zebra handhelds | Android Enterprise devices use OEMConfig with Zebra's OEMConfig app. Older Android device administrator devices use MX profiles (Zebra Mobility Extensions), built in StageNow and uploaded as an XML file |
| HoloLens 2 | Runs Windows Holographic for Business. Enroll with Autopilot (a HoloLens profile type) or manually, then use configuration profiles for kiosk mode, restrictions and updates, and compliance policies for Windows Holographic for Business |
| Microsoft Teams Rooms | Teams Rooms on Windows are Windows devices that you enroll in Intune and manage with Windows profiles, compliance and updates, usually without a user sign in and with device targeted policies. Teams Rooms on Android are managed mainly through the Teams admin center, so check which settings Intune can add |
For shared or room systems, assign policies to device groups, and avoid settings that require a user, such as password expiry or a screen lock that would block an unattended display.
Choosing and targeting
- Create one profile per platform and enrollment type, because a profile for Android work profile does not apply to fully managed devices.
- Use assignment filters to separate device models.
- A setting delivered by two profiles will conflict. Review Per setting status.
- For Apple devices, prefer DDM settings where available, because the device applies them autonomously and reports status back.
A worked scenario
A distribution company manages 500 Zebra scanners enrolled as fully managed Android Enterprise devices. The admin deploys Zebra's OEMConfig app and a profile that locks the scanner to the warehouse app and sets the barcode symbologies. The older units still on device administrator receive an MX policy created in StageNow. Office iPhones get an iOS device features profile that lays out the home screen, and Macs receive a settings catalog profile for screen lock and FileVault.
What to remember for the exam
- Android Enterprise profiles depend on the enrollment mode. Device administrator is deprecated.
- OEMConfig delivers manufacturer settings to Android Enterprise devices. MX profiles are for Zebra devices on device administrator.
- iOS settings such as home screen layout often need supervised devices (ADE).
- macOS can take a settings catalog policy or a custom .mobileconfig, not OMA-URI or administrative templates.
- HoloLens 2 runs Windows Holographic for Business. Teams Rooms on Windows are managed as Windows devices.
When a setting is missing from templates, ask whether the platform supports a custom file (mobileconfig, OMA-URI) or OEMConfig.
How the exam asks about this
- "Set a Zebra specific scanner option on Android Enterprise devices." An OEMConfig profile.
- "Deliver a macOS setting not in the templates." A settings catalog profile or custom .mobileconfig.
- "Lay out the home screen of corporate iPads." A device features profile on supervised devices.
- "A conference room device must not require a user." Device targeted policies on a device group.
Common mistakes
Using a work profile profile on a fully managed device. It will not apply.
Using device administrator. It is deprecated.
Expecting OMA-URI on macOS. Use mobileconfig or the settings catalog.
Assigning user based settings to room devices.
Check yourself
Which profile delivers manufacturer specific settings on Android Enterprise?
OEMConfig.
What can deliver a missing macOS setting?
A settings catalog profile or a custom .mobileconfig file.
Which Zebra profile type is used with Android device administrator?
MX policy.
Topic 5 of 9 in Manage and maintain devices
Test yourself on Manage and maintain devices
The full Microsoft MD-102 question bank has 658 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Microsoft. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.