Intune (now part of Endpoint Manager) lets you enforce settings on Windows, macOS, iOS, Android.
Compliance policies define 'what makes a device acceptable' (encryption on, OS (Operating System) version current, antivirus running). CA (Conditional Access) uses these to gate access.
Update rings let you pilot Windows updates with IT (Information Technology) first, then rollout to the rest. Never push untested updates company-wide.