Compliance policy, app protection and provisioning designed for crews who work where there is no signal and no patience.
Field device policy that assumes an office breaks in the field, and crews route around it within a fortnight. This guide covers the configuration that survives real conditions, plus the provisioning change that removes most of the skilled hours from every device replacement.
Compliance policy grace periods, Autopilot profiles for remote delivery, app protection for unmanaged devices, cellular considerations, and the update ring structure for a workforce that is rarely on the corporate network.
Field devices fail differently from desk devices. They are used with gloves in sunlight, they spend hours with no connectivity, they are left in vehicles overnight, and they are operated by somebody who wants to be back in the truck.
Policy written for a corporate estate arrives on those devices and quietly stops being followed. The result is not a policy violation you can see — it is a workaround you cannot.
Check these before beginning. Most stalled implementations stall on one of them.
Microsoft Intune Plan 1 at minimum, included in Microsoft 365 Business Premium and the E3/E5 tiers.
Intune Administrator and, for conditional access, a Conditional Access Administrator or Security Administrator.
Device models registered for Autopilot with your supplier. This is a purchasing-process change as much as a technical one.
One real crew including your most sceptical technician. A pilot of office staff proves nothing relevant.
Configuration is straightforward once these are clear. Skipping them is why most first attempts produce something that works and cannot be maintained.
A device that has not checked in is not necessarily non-compliant; it may be in a basement. Grace periods let a device retain compliant status for a defined window after its last successful check-in, which prevents a signal gap from locking a technician out mid-job.
For personal phones, app protection policies control corporate data inside the application — PIN, encryption, copy restrictions, selective wipe — without enrolling the device. This is the difference between a policy technicians accept and one they resist.
A device registered with your supplier ships directly to the technician. They sign in and receive a configured machine. For a distributed field workforce this is usually the single largest operational saving available.
Settings shown are the ones that matter, not every field on the form. Values are starting points to validate against your own environment.
The default grace period is zero, which means a device that misses a check-in loses access immediately. For field work that is wrong.
Set a grace period long enough to cover a realistic connectivity gap. A day is usually sensible; a week is too generous for a lost device.
User-driven mode with Entra join. The critical settings are the ones that reduce the time a technician stares at a screen.
Set the deployment to skip everything skippable and to allow the user to reach the desktop before all applications finish installing, with the essential ones marked as blocking.
Technicians who use their own phone for job updates and photographs should not be asked to enrol it. App protection covers the corporate data without touching anything personal.
Keep the PIN requirement proportionate. A complex PIN required every thirty minutes on a device used with gloves will be worked around.
Field crews start early. Updates that install at nine in the morning cost billable time.
Configure active hours generously and set deadlines rather than forced restarts, with a pilot ring covering a small number of devices a week ahead of the main group.
Deploy to one crew and watch for a fortnight. Time a provisioning end to end. Ask the technician who least wanted this what broke.
Fix what they find before extending. The friction they encounter is the friction that would have killed the wider rollout.
Every one of these is avoidable, and every one of them is common enough that we check for it by default.
The default locks out a technician whose device has been in a basement. This generates a support call at the worst moment and teaches the crew that the system works against them.
A new starter watching a progress bar for forty minutes is a bad first day. Mark only the genuinely essential applications as blocking.
Technicians will refuse, or will comply and resent it. App protection achieves the security outcome without the fight.
It proves the configuration works under ideal conditions, which is not the question. The pilot has to include poor connectivity, gloves and impatience.
Give us one hardware model and your application list and we will build the Autopilot profile, then run the pilot with one of your crews and report what they found.
Describe the situation in your own words.
