Users on these devices authenticate by signing in to the device using their Azure AD work account.

Azure AD joined is the device identity option available for corporate-owned Windows 10/11 devices utilizing co-management options.

Users on these devices authenticate by signing in to work resources, like apps and web browsers, using their Azure AD work account.

Azure AD registration is the device identity option available for personal and corporate-owned mobile devices.

It's important to know which identity option you're utilizing because it determines the enrollment methods you can use, and also determines the sign-in experience for the device user. This step grants the user single sign-on access to cloud-based work apps and other resources. Before a device can enroll in Intune, the user of the device must authenticate and establish a device identity in your org's Azure AD.

Registration in Azure AD is a required step for Intune management. For more information and suggestions, see the Planning guide: Step 5 - Create a rollout plan. If everything is going well, assign the enrollment profile to more pilot groups. After initial testing, add more users to the pilot group. Assign the enrollment profile to a pilot or test group. If this is your first time deploying enrollment profiles with Intune, or you're trying a new configuration, start small and use a staged approach. Post-enrollment monitoring, troubleshooting, and resources.Enrollment options for each OS platform.How-to prepare enrollment in Microsoft Intune for corporate-owned and user-owned devices.

During enrollment, Microsoft Intune installs a mobile device management (MDM) certificate on the device, which enables Intune to enforce enrollment profiles, enrollment restrictions, and the policies and profiles you created earlier in this guide. In the final phase of deployment, devices are registered or joined in Azure Active Directory (Azure AD), enrolled in Microsoft Intune, and checked for compliance.

Install microsoft teams on windows 10