We have on-prem AD synced to Entra ID, Microsoft 365 passkeys enabled, and Mac users accessing VPN and Windows SMB shares with AD credentials.
We’re planning to enroll Macs in Intune with Platform SSO and standard local accounts. The goal is fewer passwords and simple recovery.
For those with a similar setup:
Did you choose Password sync or Secure Enclave?
How do you handle VPN and SMB authentication?
How do users reset forgotten passwords, especially when locked out of the Mac?

I’m advovatimg or move file server to sharpoint still havmt. Convinced My Boss due to cost . I’m talking about 90Tera of data
I also old My network Guy to ensure vpn authenticates From extra instead of local AD. Pending more convincing.

Would appreciate hearing what works in practice.

We're deploying Yealink MP56 E2 and MP58 E2 Teams phones (Android AOSP 15) and running into an issue with Conditional Access during initial sign-in/enrollment.

Our phones use regular employee M365 accounts, not resource accounts. Some employees don't have MFA configured, which is fine for their normal workstation access, but we have a Conditional Access policy that requires MFA AND a compliant device for anyone accessing M365 from Android/iOS.

Obviously, the Yealink phones get caught by this policy since they're Android devices.

What I'm trying to accomplish:

• Allow employees to sign into new Yealink Teams phones using their M365 username/password without MFA.
• Keep MFA required for personal iOS/Android devices, even for those same employees.
• Keep the Yealink phones enrolled and compliant through Intune AOSP.
• Automatically identify and exempt Yealink phones without manually maintaining device IDs or excluding users every time we deploy one.
• Keep device code flow blocked. We're using direct sign-in on the phones.

The issue:

Once a phone is enrolled, this seems straightforward. Intune/Entra reports the manufacturer as Yealink, model as MP56 E2 or MP58 E2, and enrollment profile as AOSP - Teams Devices.

However, during the very first sign-in on a factory-new phone, none of those device attributes are available yet.

I tested this with a completely new M365 account that had never registered MFA. After entering the username/password on the phone, I immediately got the "Let's keep your account secure" prompt requiring Microsoft Authenticator.

The Entra sign-in logs show:

• Application: Microsoft Teams
• Resource: Device Management Service
• Authentication requirement: Multifactor authentication
• Error: 50079 (MFA registration required)
• Related event: 50097 (device authentication required)
• Device ID: Blank
• Device name: Blank
• Managed: No
• Compliant: No
• OS: Android

The sign-in user agent does identify the hardware:

Dalvik/2.1.0 (Linux; U; Android 15; MP56 E2 Build/AP4A.241205.013.C1) ;MP56 E2

But as far as I can tell, Conditional Access can't filter directly on the user agent.

Microsoft's Teams Android Conditional Access documentation mentions using device.displayName because manufacturer information is supposedly available early in the sign-in process, before Intune enrollment finishes.

However, the device display name is completely blank in my initial sign-in logs. After enrollment, the display name changes to something like Username_AndroidAOSP_Date, which doesn't contain Yealink either.

My questions:

1. How are you excluding Teams Android phones from MFA policies during their very first sign-in, before they have an Entra device identity?
2. Has anyone successfully used device.displayName filtering for initial enrollment on Yealink MP56 E2/MP58 E2 phones? If so, what exact filter are you using, and how did you verify the value?
3. Are you temporarily excluding users/groups from your mobile-device CA policies during enrollment, then removing the exclusions afterward?
4. Is there a better supported way to handle this without disabling MFA for personal mobile devices or enabling device code flow?

I understand I could temporarily exclude the user from the Android policy, enroll the phone, and then use manufacturer/model filters afterward. But I'd really prefer something scalable that doesn't require manual exceptions for every deployment.

Has anyone actually implemented this successfully with Yealink Teams phones and Intune AOSP? What does your Conditional Access configuration look like?

Curious to see if anyone is using the Edge management service to block other browsers. Initial deployment is being met with some intense pushback. Unreasonable as I've asked what Chrome can do that Edge can't and I get no logical responses.

Per MS doc: psso policy must be assigned to static user group and doesn’t work with device or dynamic groups.

Q: will it work with “All users”?

It’s mentioned that we should assign the psso, company portal and enrollment policy to this SAME user group as well otherwise “psso during enrollment fails”

So that makes me think “ all users” wouldn’t work.