New Microsoft Login + Intune FAQs

Here's a list of common questions about the School of Medicine's transition to a new Microsoft login, which includes connecting devices to Intune.

Why is this required, and does it apply to me?

The new Microsoft login (Microsoft Entra ID) and device registration (Microsoft Intune) protect Stanford’s email, Teams, OneDrive, and other Microsoft 365 services. At each sign-in, they confirm that both the account and the device meet a School of Medicine security baseline before access is granted. This is often called conditional access or device trust. 

It applies to everyone with School of Medicine Microsoft 365 access, including faculty, staff, and students. The check protects the access itself. Any account that can reach the School of Medicine email can also reach information that needs protecting, whatever your own work involves, so the same baseline is applied to every account and device. 

The change also brings the School of Medicine onto a current, vendor-supported sign-in and device foundation that replaces older in-house components and matches what many peer institutions now use.

What do we gain from this, and what are the trade-offs?

It is fair to ask what this change buys, and what it costs. Here is the honest version of both. 

What improves 

• Sign-in becomes passwordless and harder to phish. You approve each sign-in with the Microsoft Authenticator app, a passkey, or a security key instead of typing a password, which closes off the most common way university accounts get stolen. 
• You sign in less often. On a computer that is set up, platform credentials (Platform Single Sign-On or Windows Hello for Business) keep you signed in across Microsoft and Stanford services, so there are fewer repeated prompts during the day.
• Access checks the device, not only the password. At each sign-in the system confirms the device is encrypted, patched, on a supported version, and registered with/managed by Stanford before it reaches university data, so a stolen password by itself is no longer enough to get in. 
• The information you and your colleagues rely on is better protected, because only known, healthy devices can reach School of Medicine email and files. 
• The School of Medicine moves onto a current, vendor-supported foundation that replaces older in-house components. 

What it asks of you 

• You set up the new login and register the devices you use for university email, including a personal phone if you use it for email. Setup is one-time and but keeping your devices registered is an ongoing requirement. 
• A device that does not meet the security bar can be blocked from university Microsoft 365 until it is brought up to date. 
• On a Stanford-owned device, Stanford can see configuration and inventory information, as described below, and never your personal content. On a personal phone, the footprint is limited to the work apps.

How is my device set up?

How a device is set up depends on what kind it is: 

• Windows, Android, and Linux devices are enrolled in Intune, which manages them directly. 
• Apple devices (Mac, iPhone, and iPad) are managed through Jamf, Stanford’s established Apple management service, and then registered in Intune so they can meet the access requirement. 

In every case the purpose is to confirm the device meets a security baseline. If you use a personal phone for university email, you will register it so it can pass that check. 

Setting up access does not give Stanford a view into your personal content. The next question covers exactly what is and is not visible.

What can Stanford see, and not see, on my devices?

Some limits are built into Intune itself, so they hold no matter how Stanford configures the service. On any device and any enrollment type, Stanford cannot see your personal email, your text messages or call history, your photos, your web browsing history, the contents of your personal files, or your passwords.

	Stanford-managed device	Personal device
Model, serial, OS version, encryption, and compliance status	Yes	Yes
Installed-app inventory (the list of apps, not their contents)	Names of all installed apps	For personally owned Windows and Linux devices, only the names of the Stanford ("managed") apps that Stanford deploys; your personal apps are not listed
Personal email, texts, photos, browsing, files, passwords	No	No

On Windows and Linux devices classified as personal, Intune reports only the names of the work and school apps that Stanford deploys, not your personal apps. On all other device types, including Stanford-owned Windows and Linux devices, the full list of installed app names is collected. In both cases this is a list of names, not a view into what is inside the apps. Compliance itself is a pass or fail health check (is the disk encrypted, is the operating system patched, is it a supported version), not a view into what you do. Stanford does not monitor how you use your apps, and there is no keystroke or screen monitoring. 

On Apple devices, the configuration is applied through Jamf, and Intune’s role is the registration and security check.

Does Stanford track my location?

No. There is no continuous location tracking, and no setting that streams your whereabouts to Stanford. 

Intune does have a one-time Locate device action, and it is limited by design. It works only on supervised or corporate-owned devices (for example, a supervised iPhone in Lost Mode or a corporate-owned Android). An administrator triggers it manually for one specific device, and it is not offered for personally-owned devices. It would be used only as part of responding to a report of a lost or stolen device, and like other administrative actions it is recorded in an audit log. 

What about my files in OneDrive and SharePoint?

Device management does not browse, read, or remotely delete the contents of your OneDrive or SharePoint. Those files live in the Microsoft 365 cloud, and device registration controls access to them, not inspection of them. 

A few related points: 

• Even an app-level removal of Stanford data takes out only the locally synced work data from the app. It does not open or read your files, and your files stay in the cloud. 
• Some automated content scans do run (for example for PHI, and possibly for SSN, PCI, or employee data when something is shared broadly). These send a notification to the data owner and the Information Security Office. No person is reading your files. 
• Microsoft does not use your data for advertising, marketing, or profiling, and does not sell it.

If a device is removed from management or wiped, what happens to my personal data?

There are three different actions, and they are often confused. 

Removing company data (sometimes called Retire) is the normal step when a device leaves management. It takes out Stanford’s apps, profiles, and access, and leaves your personal data in place. 

An app-level removal on a personal phone takes Stanford data out of the work apps only. Your personal apps and data are left alone. 

A full wipe resets the device to factory state and erases everything on it. Device owner consent must be provided or approved by the security and/or privacy offices. Actions like these can be performed only by a limited number of authorized staff, and they are recorded in an audit log.

What specific settings is Stanford using on my devices?

• Apple device settings (Mac, iPhone, iPad) are documented on the Jamf service page. 
• Windows settings are currently documented on the BigFix service page and are moving to Intune as that migration proceeds. 

A combined Intune configurations and retrieved properties page, covering Windows, Android, and Linux, along with the registration checks applied to all devices, is in progress and will be linked here.

Area	Current posture
What we check (compliance)	Disk encryption (BitLocker or FileVault), a supported and patched operating system, and Stanford managed device. These are pass or fail signals used to grant access.
What we configure	Security baselines and the profiles needed for secure access, such as Wi-Fi, and VPN settings, along with required security software.
What we collect (inventory)	Hardware and operating system facts, encryption and compliance state, and managed-app inventory. See complete lists linked above.
Who can act, and accountability	Actions are limited to authorized endpoint staff under role-based access with logging.
What we do not enable	Continuous location tracking.

What are Stanford’s rules for using these tools?

The ability to manage a device is governed by how Stanford chooses to use it. Stanford collects only what it needs to confirm a device is secure enough for access, and not your personal content. Compliance and conditional access decide whether a device may connect; they do not monitor activity. Administrative actions are limited to authorized staff under role-based access, are recorded in an audit log, and are governed by Stanford’s Administrative Guide, which allows administrative access only for a legitimate operational purpose and only to the minimum extent necessary (see Privacy and Access to Electronic Information, 6.1.1, and Computer and Network Usage Policy, 6.2.1). Stanford does not use your data for advertising or profiling.

Who is responsible for this?

This program is run jointly by the School of Medicine, UIT, and the Information Security Office, with sponsorship from university and Stanford Medicine leadership. 

Do I have to do this, and what about exceptions?

Yes. Registering your devices is required to keep using your university Microsoft 365 services, including email, Teams, and OneDrive. Enrollment is being rolled out to the School of Medicine in groups, and each group is notified ahead of its enforcement date. Once your group’s date has passed, access to Microsoft 365 depends on having completed setup, so it is best to finish well before then. Exceptions are limited, time-bound, and handled case by case, for example for certain clinical workflows, and usually by helping you get onto a compliant device rather than removing the requirement. 

What are the source references for this information?

Microsoft Learn

• What your organization can and cannot see 
• Privacy and personal data in Intune 
• Data collection in Intune 
• Data security and sharing in Intune 
• Locate device 
• Discovered apps 
• Retire (remove company data) 
• Wipe (factory reset) 
• Selective wipe 
• MAM and app protection FAQ 
• Device compliance 
• Conditional access 
• Windows update rings 

Stanford UIT

• Jamf configurations and automations 
• BigFix retrieved properties