Gah, I forgot to include the hashtags for my blog post... :(
Hey all, I just published an article on using Azure AD's Access Packages to enable end user device enrollment in Microsoft Intune
https://blog.nathanmcnulty.com/intune-using-access-packages-to-enable-user-device-enrollment/
If you have Azure AD P2 licensing and haven't seen Access Packages, welcome to your new obsession :)
There are a ton of other use cases for these, and I'm hoping to have some future posts to showcase great ways to use them from a security standpoint!
Many organizations use device compliance with Conditional Access to provide protection against MFA capable phishing attacks such as Modlishka, evilginx2, or @mrd0x's browser in the browser attack. This protection works well because Conditional Access uses certificate based authentication with the device and pulls compliance data from Intune, and the attacker
Thomas Naunheim 
Nathan McNulty