A configured device is not a hardened device. This part layers Microsoft's pre-built security baselines on top of your configuration profiles, connects Defender for Business, and starts Attack Surface Reduction in Audit mode.

An enrolled device is not a trusted device — not until it meets your compliance baseline. This part builds the compliance policy and Conditional Access rules that enforce it, safely.