So the question really stems from when a user configures an Outlook profile and gets this prompt (see bellow screenshot) at the end with:

1. Checkbox that is ticked by default and says "Allow my organization to manage my device"
2. Button which OKs the prompt
3. Button in text that says "No, sign in to this app only"

So here are some scenarios you can get out of this prompt:

1. So if the user leaves the checkbox and clicks "OK" they will - from what I understand - get their machine "Azure AD Registered" AND it will be managed by Intune MDM
2. If the untick the box (1) and click OK they will get their machine "Azure AD Registered" and NOT be managed by an MDM
3. If they click "No, sign in to this app only" they will NOT be "Azure AD Registered" and NOT be managed by an MDM - rather MAM policies will apply to them

So here are a few questions and clarifications of the various scenarios:

Scenario 1:

1. What does this provide? From what I have gathered - only compliance checks in Intune. It will not apply any MDM policies.
2. Do MAM policies apply?

Scenario 2:

1. What the heck is the point of this scenario? Just to know which machine was used?

Scenario 3:

1. I assume there is no compliance checking from MAM of any kind? Hence whatever I have configured in MAM is the only thing that will be applied, but there is no way to check if it was enforced

​

https://preview.redd.it/eehdkia8dwg91.png?width=587&format=png&auto=webp&s=641ee0ec79b8bf74f027aa3e6ad52304976e94d9