Forum Discussion
Understanding Automatic Operating system update behaviour
Regarding the last point: How do you enroll your devices? You should be able to enroll using different QR for example. One for BYOD and one for COPE which would mean no need to block something.
BYOD devices enrol using Intune Company Portal and COPE devices are enrolled using KME. We aren't using compliance to block enrolment, it's an enforcement for Conditional access after enrolment.
So, you use Samsung devices using Knox mobile enrollment (KME).
But in KME you can set per IMEI where devices should go (which enrollment config they should get) even via bulk import. I would recommend to give the different enrollments different targets (with different enrollment ID's) so you have a clean setup and only care about the IMEI's routed via KME to the right config instead of taking care of that somehow in the MDM.
