Why an “Hourly” Intune Remediation Doesn’t Run Within the First Hour
An hourly remediation sounds straightforward: assign it, and it should run sometime within the next hour. But when looking closer at how the Intune...
Read Article →Microsoft Intune Security Posts
Discover the latest insights, best practices, and security research related to Microsoft Intune endpoint management.
Search Intune Posts
Filter Posts
Posts
Unattended Remote Help for Windows
While digging through the Intune Management Extension, I noticed a new Sidecar notification action called Unattended Remote Help for Windows, and t...
Read Article →InforcerCommunity: A PowerShell Module for the Inforcer REST API
InforcerCommunity v0.2.0 adds Export-InforcerTenantDocumentation: generate a complete, readable snapshot of your M365 tenant's policy configuration...
Read Article →IC3: From WNS to Real Time Device and IME Actions
In a previous blog, we showed that something new is quietly showing up inside the Intune Management Extension…something called IC3. At first...
Read Article →Maintenance Window Settings for OS, Drivers, and Updates
The Maintenance Window policy for OS, Drivers, and Updates is now showing up in Intune, giving control over when update actions like install and re...
Read Article →Intune Timing Demystified: What Actually Happens Behind the Scenes
In this blog, we will show why Intune timing often feels inconsistent when we are not aware of the different workload paths inside Windows and Intu...
Read Article →Intel TDT Deprecated: Defender CSP Error 0x86000002
After installing the February 2026 Windows update, the Defender setting IntelTDTEnabled suddenly stops working. Intune reports the familiar 65000 e...
Read Article →Intune Device Actions: Microsoft brings back instant Remote Actions
This deep dive builds on earlier research in which we observed that Intune remote actions feel instant on day one but begin to show a delay the nex...
Read Article →Intune Win32App PowerShell Script Installer 64 Bit Switch Not Working
Microsoft recently added support for PowerShell Script Installer inside Win32 apps in Intune, including a 32-bit and 64-bit execution switch. On pa...
Read Article →Disable MDM Enrollment When Adding a Work or School Account on Windows
You have probably seen the new option in the Intune portal that lets you disable MDM enrollment when a user adds a work or school account. It looks...
Read Article →Intune PowerShell Script Delay? Here Is What Really Causes It
You create a new PowerShell platform script in Intune to fix something and expect it to run immediately. That sounds pretty reasonable. Well…...
Read Article →RKSolutions PowerShell Module
If you manage Microsoft 365 tenants, you already know the value of a single view for enrollment flows, anomalies, admin roles, and license assignme...
Read Article →Microsoft Introduces Entra Hybrid Join using Entra Kerberos
Microsoft has introduce a new hybrid join for Windows devices using Entra Kerberos for instant device registration in Microsoft Entra. The post Mic...
Read Article →ADMX Ingestion and Access is Denied 0x80070005
When an Intune policy fails with 0x80070005 Access Denied, the explanation usually sounds obvious. Something tried to write to the registry, but Wi...
Read Article →Intune MDM Certificate Renewal Failure: The Hidden UPN Issue
In this blog, we take a closer look at what really happens when the Intune MDM device certificate fails to renew. While investigating a strange cer...
Read Article →Forgotten Features Series, Part 5: The Defender Tag Bridge You’re Not Using – Custom MDE Tags via Intune
This is the fifth post in a series spotlighting forgotten features (policy) in Microsoft Intune and the broader Microsoft 365 ecosystem. Today, we’...
Read Article →Forgotten Features Series, Part 5: The Defender Tag Bridge You’re Not Using – Custom MDE Tags via Intune
This is the fifth post in a series spotlighting forgotten features (policy) in Microsoft Intune and the broader Microsoft 365 ecosystem. Today, we’...
Read Article →Forgotten Features Series, Part 4: Beyond Built-In Checks – Intune Custom Compliance Policies
As a Managed Service Provider (MSP), you enforce device compliance with Intune's built-in policies: antivirus running, encryption enabled, OS versi...
Read Article →Forgotten Features Series, Part 4: Beyond Built-In Checks – Intune Custom Compliance Policies
As a Managed Service Provider (MSP), you enforce device compliance with Intune’s built-in policies: antivirus running, encryption enabled, OS...
Read Article →Intune Device Certificate Renewal Flow Has Shifted from Pull to Push
This blog will show you how the Intune Device Certificate Renewal Flow Has Shifted from Pull (Scheduled Task) to Push (ErollmentService) Please not...
Read Article →The Secure Boot Status Report: Who Actually Sends the Secure Boot Info
The new Secure Boot Status report in Intune finally provides visibility into Secure Boot state across all of your devices. This new Secure Boot Sta...
Read Article →The Secure Boot Status Report: Coming soon to Intune
Most admins already found the Secure Boot policy in Intune. That’s not the problem. The problem is what happens after you assign it… ...
Read Article →Agent Identity demystified
This blog series aims to demystify Microsoft Entra Agent Identity Security.An agent is an application that attempts to achieve a goal by understand...
Read Article →Policy is rejected by licensing: Error Code 0x82B00006
This blog dives into what “Policy is rejected by licensing” actually means inside Windows, why that decision is not based on what Int...
Read Article →KQL Sources: 2026 Update
What started as a single blog in 2023 is now becoming a yearly tradition. Each year, the KQL community expands with new repositories and queries. T...
Read Article →What Really Happens When You Press Remote Sync in Intune
Pressing the Sync button in Intune looks simple, but it is not a command sent straight to the device. It sends a signal, and then Windows decides i...
Read Article →The Edge LocalNetworkAccessAllowedForUrls policy you never deployed
This blog examines why LocalNetworkAccessAllowedForUrls appeared on managed devices without being deployed from Intune. It also explains why Edge a...
Read Article →How Intune Syncs Work: PowerShell and Win32 App Delivery vs Policy Delivery
This blog is about why Intune behaviour often feels inconsistent, even when everything is configured correctly. The answer isn’t timing. It’s the a...
Read Article →Discover and Restrict access to GenAI Apps in the Microsoft Security ecosystem
The GenAI (Generative Artificial Intelligence) Security Policy outlines the security controls needed to protect sensitive corporate assets.GenAI Ap...
Read Article →New Intune/Autopatch Feature: CVE and KB reporting – Better visibility, smarter patching – General Availability
Last Updated on December 15, 2025 by Michael Morten Sonne Introduction Microsoft has now begun the rollout of… The post New Intune/Autopatch ...
Read Article →PowerShell Script Installer Support for Win32 apps in Intune
This blog is about a new Intune feature that briefly appeared in Microsoft documentation: PowerShell script installer support for Win32 apps. The f...
Read Article →Major updates in Microsoft 365 and Microsoft Intune (December 2025)
Last Updated on December 4, 2025 by Michael Morten Sonne Introduction On December 4, 2025, Microsoft released major… The post Major updates i...
Read Article →Microsoft 365: The Essential 10 Security Considerations
When we talk about Microsoft 365 security, we are talking about two things: The latter can be used to achieve the former, as well as other (non-Mic...
Read Article →Intune Policy Tattooing Issue: Removed Settings Stay Enforced
In this blog, we’ll walk through a strange case of the Intune Policy Tattooing Issue (Yes, a new tattooing issue), where every deleted setting refu...
Read Article →Autopilot Device Association
Autopilot Device Association finally gives Windows the tenant context it was missing during OOBE. With that link in place, Windows can apply OOBE s...
Read Article →Microsoft Intune Multi Admin Approval: Securing Device Actions such as Wipe, Retire and Delete
Multi Admin Approval (MAA) in Microsoft Intune is a security feature that requires a second user’s approval before critical changes can be executed...
Read Article →PowerShell Script Support Added for Win32 Intune App Deployment
PowerShell script support has been added directly to the Intune app deployment Wizard. Learn why this is a great improvement. The post PowerShell S...
Read Article →Why “User” Install Behavior Doesn’t Mean a User Install
This blog dives into how Intune handles MSI app deployments when you choose App Install Context: User, and why that setting doesn’t always do what ...
Read Article →Bringing Order to Microsoft’s Fast‑Moving Copilot Rollout in Microsoft 365
The rapid and widespread rollout of Microsoft 365 Copilot has created a governance challenge for organizations. Features are often enabled before c...
Read Article →Configure Browser Policy to Preserve OneDrive and SharePoint Web Performance and Offline Capability needed for upcoming Chromium versions
Introduction Modern collaboration tools such as OneDrive and SharePoint depend on efficient browser communication to deliver both online and offlin...
Read Article →MMP-C: The Future of Windows Device Management with Intune
For years, Intune has managed Windows devices through OMA-DM (Open Mobile Alliance Device Management). It worked, but as explained in our previous ...
Read Article →Remotely Intune wipe devices in Defender for Endpoint isolation mode!
Intro Microsoft recently announced that device isolation exclusions in Defender for Endpoint are now generally available. This made me think about ...
Read Article →Balancing Control and Convenience: Preventing Edge Password Sync on Unmanaged Devices
Introduction Password managers have become a default convenience in modern browsers, including Microsoft Edge. Microsoft now recommends enabling th...
Read Article →The History of Intune: From OMA DM to Modern Windows Management
In this blog, we go back in time and look at how Windows device management really started.How Microsoft built the first framework for managing devi...
Read Article →The Truth About the 8-Hour Intune Sync (and Why It’s a Myth)
This blog will address one of the biggest misunderstandings I hear regarding Intune: the misconception that Windows devices ONLY receive new polici...
Read Article →Microsoft Defender for Endpoint: Getting Started with Deployment Using Intune
Devices today are diverse, mobile and therefore exposed to a wide range of threats. Traditional antivirus solutions detect known patterns but leave...
Read Article →Autopilot Device Preparation and the Return of OOBE Controls
Hidden Device Preparation template enables OOBE controls in AP DP. Naming at OOBE, skip EULA, skip keyboard, hide privacy. Works through device ass...
Read Article →Understanding the Default Compliance Policy: What’s Changed and Why Devices Stay Compliant
This blog explores the behavior change in Intune’s built-in compliance policy, specifically why devices are still marked as compliant even when the...
Read Article →Windows Autopilot: Installing Windows Updates during setup (OOBE)
Installing Windows Quality Updates during the out-of-the-box (OOBE) experience is now generally available is been pulled back! (Check out this para...
Read Article →Windows Autopilot Stuck on Identifying: The KB5065848 Story
It was a rough week for Intune. First, BitLocker policies suddenly stopped applying without any good reason. The event logs indicated that the BitL...
Read Article →BitLocker Policies Not Getting Applied in Intune (65000)
This blog will discuss a case where BitLocker policies pushed during Windows Autopilot appeared to be applied in the event logs, but they never act...
Read Article →Windows Autopatch Client Broker: What It Is, When to Use It, and Why It Matters
In this post, we’ll break down what it does, when you need it, and how to align it with your organization’s update strategy.
Read Article →Endpoint Privilege Management: Virtual Elevation Acccount Support
EPM has always relied on virtual accounts for elevation, often breaking scenarios where apps need the real user profile. A new ElevationAccount.Use...
Read Article →Multi-Admin Approval Extends to Device Reset Options in Intune
Discover Intune's new Multi-Admin Approval feature for device actions. This guide explains how to set up dual control for Wipe, Retire, and Delete ...
Read Article →Recommended Settings for Windows LAPS with Intune
Deploy the recommended settings for Windows LAPS to your end-user Windows 10 and 11 devices using Microsoft Intune. The post Recommended Settings f...
Read Article →Download IntuneWin Win32 App Files Directly from Intune
This blog explains how to download the original IntuneWin Win32 app package from Intune when you no longer have the original source files. If you f...
Read Article →How to Block Upload to WeTransfer, DropBox & Google Drive (but Allowing Download) – using Microsoft Purview Data Loss Prevention (DLP)
This blog was created in response to recent policy changes related to the WeTransfer cloud storage service. These changes raised ... Read more
Read Article →Intune Remote Wipe ending up in “Something went wrong” (0x800f0991)?
In this blog, we’ll walk through a remote wipe issue that leaves devices in a lingering, unmanaged state, where the Intune object is removed, the d...
Read Article →Intune, vTPM, and MDM Enrollment Version 6.0: What You Need to Know!
This blog will cover the latest features in MDM Enrollment Version 6.0 and explain their significance for device attestation, virtual TPMs, and Int...
Read Article →How the IME Cleans up the IMECache folder
This blog explains how the Intune Management Extension (IME) handles the cleanup of the IMECache folder after it has finished installing a Win32App...
Read Article →Intune Policies showing error code -2016281112
This blog covers a weird issue where Windows Update client policies deployed through Intune began to fail after devices were upgraded to Windows 11...
Read Article →Intune Anomalies Report
Table of Contents Introduction Requirements Features How does it work? Interactive Authentication Client Secret Authentication Certificate Authenti...
Read Article →Data Strategy Breakdown Series - Defender XDR and Intune (4)
In Part 4 of the Data Strategy Breakdown Series, we explore how Defender XDR and Intune in your data strategy can transform security operations. Fr...
Read Article →Troubleshooting Windows Feature Updates not being deploying using Intune/AutoPatch/WUfB
I have been banging my head why some machines wouldn’t deploy Windows 11 Windows Feature Updates (24H2) as part of ... Read more
Read Article →Whats New in Windows Autopatch
Learn how Windows Autopatch lets you orchestrate updates for Windows, Microsoft 365 Apps, Microsoft Edge, and Teams. All from a single automated so...
Read Article →Continue to Sign in Prompt Part 2: Disable the DMA SSO Compliance
In this blog, we will examine how a recent big Windows change was introduced to meet Digital Markets Act (DMA SSO Compliance) requirements. This ch...
Read Article →Implementing Attack Surface Reduction Policies
Start implement Microsoft's Attack Surface Reduction (ASR) policies today!
Read Article →The “Continue to Sign in Prompt” That breaks the SSO
In this blog, we will examine why Windows shows the “Continue to sign in?” prompt when launching apps like Edge or Company Portal for the first time
Read Article →🚀Introducing ASR Rule Inspector V2
Table of Contents Introduction What’s New in the V2? Intune vs Local Comparison – No More Policy Guesswork Detecting Duplicate and Conflictin...
Read Article →How to authenticate with Windows Hello for Business or FIDO security key in RDP session ?
This little guide will show how you can authenticate with Windows Hello for Business and FIDO2 security key in a ... Read more
Read Article →Declarative Device Management with Intune
How Microsoft / Intune is shifting to Declarative Device Management (DDM) by using the declared configuration service
Read Article →Language Packs? I Just Told My Computer to ‘Figure It Out.’ Apparently, It Did.
Do you know that moment? You’ve got your Intune environment perfectly set up, Autopilot profiles configured, and you think, ‘Yes, world...
Read Article →Why Using a DEM Account for Windows Autopilot is a Bad Idea
In this blog (not technical this time…sorry), we’ll explore why Microsoft does NOT support Device Enrollment Manager (DEM) for Autopilot, the...
Read Article →Device Query for Multiple Devices, Device Inventory, and Single Device Query: Connecting the Dots
If you’ve ever tried troubleshooting a single device, you know how useful tools like Single Device Query can be pretty helpful. It’s fast, accurate...
Read Article →MAM vs. MDM: Choosing the Right Mobile Management Approach
With the increasing reliance on mobile devices in the workplace, organizations must choose the right strategy to manage and secure corporate data. ...
Read Article →Operational Collections 2.0
I absolutely love the SCCM Operational collections from System Center Dudes, and while Intune has a different design that negates the need for scop...
Read Article →The ShadowAdminPairs: A Deep Dive into Administrator Protection
Learn how the Administrator Protection feature in Windows 11 uses the ShadowAdminPairs key to map ENTRA user SIDs to local admins
Read Article →Comparing Web Filtering and Security: Microsoft Entra Internet Access (Global Secure Access) vs. Microsoft Defender for Endpoint (MDE)
Organizations face increasing challenges in securing internet traffic and enforcing web access policies in today’s hybrid work environment. Two key...
Read Article →Securing Microsoft Business Premium Part 01: The First Step to an Unbreakable Defense
Today kicks off a comprehensive blog series where I’ll delve into the security features of the Business Premium license SKU, offering...
Read Article →Dual Enrollment / MMP-C Light for Workplace Joined Devices?
Explore WorkplaceJoin_DualEnrollment, dual enrollment for Workplace Join devices, and the role of MMP-C Light in shifting Intune policies
Read Article →Kung Fu MMP-C Onboarding
This blog will show how I onboarded multiple Microsoft 365 Tenants to the new MMP-C infrastructure (Microsoft Management Platform – Cloud) and expl...
Read Article →Seamlessly Migrating from Symantec Endpoint Protection to Microsoft Defender for Business
Discover how to migrate from Symantec Endpoint Protection to Microsoft Defender for Business seamlessly with tips and tools!
Read Article →Governing OS Versions in Microsoft Intune: Best Practices and Configuration
In a modern managed workplace environment, ensuring that devices meet minimum operating system (OS) requirements is a critical aspect of security a...
Read Article →Renewing Apple Enrollment Program, VPP Token, and MDM Push Certificate in Microsoft Intune and SCIM token in Entra.
Introduction Managing Apple devices in Microsoft Intune requires maintaining active integrations with Apple services. To ensure continued functiona...
Read Article →How to check and block “malicious” browser extensions with Microsoft Defender and Intune?
In the past years, malicious browser extensions have been on the rise and are more popular to be used as part of cyberattacks. With the use of mali...
Read Article →KQL Sources - 2025 Update
What started as a single blog is now becoming a yearly trend. More and more KQL related repositories are created, not only with a focus on security...
Read Article →MDM / Intune policies moving over to MMP-C
This blog will focus on how Wi-Fi and VPN resource access policies are being transferred (Authority change) from the old-school MDM stack to the MM...
Read Article →Troubleshooting the Properties Catalog Error 2147749902:
Troubleshooting error 2147749902 (WBEM_E_INVALID_NAMESPACE) isn’t always straightforward. What started as a simple Intune error turned into a Devic...
Read Article →Life is like a box of Enhanced Device Inventory Properties.
This blog will focus on a new Intune Core Feature called Windows Device Inventory (Resource Explorer). I will show you how this new Intune Feature ...
Read Article →Microsoft Entra Identity Governance Fundamentals: Access Packages
In this blog post, we’ll be covering the fundamentals of Access Packages in Microsoft Entra—it’s all about getting a solid understanding...
Read Article →Under the hoods of the Windows Device Inventory Agent
This blog will show you the inner workings of the Device Inventory Agent
Read Article →The 0x80072F9A We Start From
This blog is a follow-up to the Windows Enrollment Attestation series. I’ll dive into why the AllowRecovery CSP is a game-changer and how it helped...
Read Article →Passkeys 101: How Microsoft Entra Simplifies Passwordless Authentication
Today, we’re exploring passkeys—what they are, how they work, and how Microsoft’s latest GA features make passwordless authentication...
Read Article →Windows – Hotpatching is now possible on clients – rebootless updates is here!
Last Updated on June 2, 2025 by Michael Morten Sonne Introduction In a major step forward for reliability… The post Windows – Hotpatching is ...
Read Article →MSEM | OT Security Initiative
From global tensions on nation-state level to cybercriminals and script-kiddies, cybersecurity for OT (Operational Technology) becomes more and mor...
Read Article →Fixing Time Zone Issues in Windows Autopilot
Deploying Windows devices using Autopilot can be challenging, especially when devices are shipped from a supplier in China to various global locati...
Read Article →Device Compliance: The Tpm-PreAttestationHealthCheck in Windows 24H2
Troubleshooting health attestation just got easier. With the introduction of the Tpm PreAttestationHealthCheck task, Windows now generates a detail...
Read Article →Fix Subscription Activation by automatically Removing Secondary Work or School Accounts.
When subscription activation gets stuck, it could be due to conflicting tenant accounts. This blog dives into how to fix subscription activation by...
Read Article →Autopilot Device Preparation (AVP2/AP-DPP): Hiding the Privacy Settings
In this post, I’ll show you how to streamline the Out-of-Box Experience (OOBE) setup process even if you’re using Autopilot Device Preparation ( AV...
Read Article →Patch My PC Home Updater 5.0: Effortless Updates for Over 500 Apps
On October 23rd, 2024, Patch My PC dropped their brand new Home Updater version 5.0, and it’s a serious game-changer for home users. If you’ve been...
Read Article →The Incredible story of using the Windows Performance Recorder to troubleshoot your Enrollments.
In this blog, I will show you how to set up the Windows Performance Recorder and the Windows Performance Analyzer to troubleshoot Autopilot and Int...
Read Article →Autopilot Error 0x80280009: TPM Attestation. What is going on?
In this blog, we’ll explore why 0x80280009 (aka TPM_E_FAIL) is becoming a more common headache, particularly in virtual machines. We’ll look at wha...
Read Article →Local Administrator Protection vs. EPM: The Differences Explained!
After posting the blog about Administrator Protection, one question kept coming up: What are the key differences between Administrator Protection v...
Read Article →Administrator Protection in Windows 11 Explained: How Microsoft Rebuilt Local Admin Security
This blog will focus on a new Windows 11 insider build feature, Administrator Protection, announced in the latest Windows Insider Canary build (277...
Read Article →How to deploy Enterprise App Catalog updates with PowerShell
Learn how to manage and deploy apps updates in the Intune Enterprise App Catalog using Microsoft Graph PowerShell. The post How to deploy Enterpris...
Read Article →Report Enterprise App Catalog Updates in Intune with PowerShell
Learn how to use PowerShell to report available Enterprise App Catalog updates in Microsoft Intune with Microsoft Graph PowerShell. The post Report...
Read Article →Troubleshooting Intune Enrollment: Solving the 0x80180031 MDM Not Configured Error
In this blog, we’ll dive into the common headache of enrolling existing devices to Intune and hitting the 0x80180031 error, often caused by the fac...
Read Article →SecureChannelFailure Errors, and the Curious Case of the Failing IME
Have you ever struggled with Lenovo T480 or HP Elitedesk 800 G4 devices that refused to cooperate with Intune? In this blog, we unravel the saga of...
Read Article →Speaking at the Workplace Ninja Summit 2024
Next week it’s time again for the annual Workplace Ninja Summit in Lucerne, Switzerland. The summit will start on Monday September 16th till ...
Read Article →The Subscription Activation Journey: Stuck on Pro
The May update broke Windows Subscription Activation, causing devices to drop from Enterprise to Pro. The primary culprit was a breakdown in Multi-...
Read Article →Cloud PCs? Where we’re going we don’t need Device Query and Support Approved?
Are you using a nice Windows 365 Cloud PC and want to use kickass Intune Suite features like Device Query or EPM Support Approved? If you’re ...
Read Article →Detect Impact MFA Enforcement
You may have noticed that Microsoft will enforce MFA requirement per October 15, 2024 for Azure/Entra/Intune. If this is new ... Read more
Read Article →Mrs. Resource Performance, you’re trying to seduce me with your CPU Spike. Aren’t you?
Two powerful features have been introduced in the latest update to Microsoft Intune Advanced Analytics: CPU Spike and Memory Spike monitoring. We c...
Read Article →The Lakehouse of EPM: Easily Create EPM Elevation Rules based on the Elevation Requests
Create EPM Elevation Rules in just a few seconds. It sounds like a dream, right? As IT professionals, we’re always on the lookout for ways to...
Read Article →FooUser@ meets the Cosmic Autopilot@ user
This blog will be about me wrecking a Windows device during Autopilot Pre-Provisioning to see what is happening underneath. While doing so, I stumb...
Read Article →Evolving Subscription Activation: From Workarounds to a Robust Solution
Microsoft has continuously refined how Windows handles Subscription Activation, particularly in environments with strict Conditional Access policie...
Read Article →Keep your Interactive Logons close, but your EPM Virtual Account closer.
In this blog, I will show you why existing GPO policies could potentially break new products like Intune Endpoint Privilege Management (EPM). I wil...
Read Article →MDM vs. MAM | Personal vs. Corporate
In our previous blog, we explored how to register devices with Entra and manage them, despite certain prerequisites for using Intune. In this blog,...
Read Article →IsTPMAttested: The Ultimate Attestation Security Gate
This is the fourth and, for now, last blog post in the Windows Enrollment Attestation series. In it, I will explain how the three previous blogs le...
Read Article →How to find settings in the Setting Catalog by custom OMA-URI
Learn how to use PowerShell to find if the Settings Catalog in Intune contains settings by the custom OMA-URI path. The post How to find settings i...
Read Article →Saving Upgrade Ryan: How KB5040527 fixed the Subscription Activation issue!
Great news! The July Preview KB5040527 update has finally fixed the Windows subscription activation issue that plagued the upgrade from Windows 11 ...
Read Article →InitiateRecovery: The Power of Hardening the Intune Enrollment
This is the third blog in the Windows Enrollment Attestation / MDM Hardening series. In it, I will examine what happens when we combine the amazing...
Read Article →How to rotate BitLocker keys with Microsoft Graph PowerShell
Learn how to rotate BitLocker keys for devices managed with Microsoft Intune using Microsoft Graph PowerShell. The post How to rotate BitLocker key...
Read Article →Microsoft to start blocking custom OMA-URI settings in Intune
Microsoft will soon start blocking the use of custom OMA-URI settings in Microsoft Intune for settings that existing in the settings catalogue. The...
Read Article →All the Intune MDM Certificate Recovery We Cannot See
This blog will be the second one in the Windows Enrollment Attestation Series!! And let me promise you one thing!!! The words rabbit hole will get ...
Read Article →How to delete Cloud PKI CAs in Microsoft Intune
Learn how to delete Microsoft Cloud PKIs in Microsoft Intune using the portal and Microsoft Graph PowerShell. The post How to delete Cloud PKI CAs ...
Read Article →MDM x TPM: The MDM Hardening
This blog will be the first one in the Windows Enrollment Attestation / MDM Hardening series. In it, I will take a closer look at a beautiful funct...
Read Article →Windows Enrollment Attestation 76: MDM Hardening
Welcome to our Windows Enrollment Attestation series overview. This feature is also known as MDM Hardening and MDM Device Attestation. In this blog...
Read Article →Die Hard with a UTC: Fixing Autopilot Device Preparation
Enrolling devices into Windows Autopilot Device Preparation should be straightforward, but sometimes, unexpected issues require a deeper dive into ...
Read Article →EPM Error 0x8007010B: The Debugging Game
In this blog, I will examine a funny 0x8007010B error that Endpoint Privilege Management (EPM) could give you when you try to elevate the CMD using...
Read Article →I was MSI and PS1. Nothing but Endpoint Privilege Management and a couple of file extensions
With all the new features added to Microsoft Endpoint Privilege Management (EPM), we must not forget another new and long-awaited feature. This blo...
Read Article →Autopilot Device Preparation and the Enrollment Time Grouping
This blog will focus on the importance of the Enrollment Time Group (JustIntTimeConfiguration), which is currently only used with Autopilot Device ...
Read Article →Microsoft Intune to require iOS 16 and macOS 13
Microsoft Intune will soon require a higher version of MacOS and iOS later this year. Learn how to identify the impact in your tenant. The post Mic...
Read Article →Platform-level device cleanup rules added to Microsoft Intune
Learn how to configure device clean-up rules at a platform level in Microsoft Intune to target Windows, IOS, Android, Mac or Linux devices. The pos...
Read Article →The Battle Of The Local Administrator And Autopilot Device Preparation
In this blog, I will discuss how I found out a specific entra setting was interfering, AKA breaking my Windows Autopilot device preparation deploym...
Read Article →Autopilot and the Sundance Device Preparation
In this blog, I will explore the wonders of Autopilot Device Preparation (AP-DP), from the first step of signing in to the last step in the Autopil...
Read Article →How to deploy Autopilot Device Preparation Policies with PowerShell
Learn how to deploy Device Preparation Policies in Microsoft Intune programmatically using Microsoft Graph PowerShell. The post How to deploy Autop...
Read Article →Entra Private Access/GSA – Automatic Network Detection
This blog covers a custom script solution for Intune, that can be used to automatically detect, if the Entra Private ... Read more
Read Article →Guided application upgrades announced for Microsoft Intune
Enterprise Application Management has announced Guided application upgrades later this year in Microsoft Intune. The post Guided application upgrad...
Read Article →Autopilot Device Preparation: First Contact
Are you anxiously waiting for the Autopilot V2 Announcement? APv2 has just been officially announced and has a nice new shiny name: Autopilot Devic...
Read Article →New granular security policy permissions in Microsoft Intune
Microsoft are to release new granular security permissions relating to security baselines in Microsoft Intune. The post New granular security polic...
Read Article →Nobody makes me Config Refresh my own Provider. Nobody!
Welcome to the Config Refresh Blog! Today, I’ll be diving into the fascinating world of Config Refresh. Specifically, we’ll explore how...
Read Article →Thoughts on Copilot for Security’s Early Days
April 1, 2024, seen the release of Microsoft Copilot for Security to general availability (GA). It is a generative AI solution integrating with Def...
Read Article →Remember, remember, the Hybrid Device, the MDM only enrollment Treason and The EPM Agent
Are you dealing with Hybrid joined, Intune enrolled devices and wondering why the EPM agent isn’t showing up on your device after activating ...
Read Article →KB5036980 breaks the Windows 11 Enterprise Subscription Activation.
Are you experiencing problems with the automatic upgrade from Windows 11 Pro to Windows 11 Enterprise during Autopilot on the latest Windows build?...
Read Article →Report assigned Autopilot profiles with Microsoft Graph PowerShell
Use Microsoft Graph PowerShell to report which Autopilot profile is assigned to each device in Microsoft Intune. The post Report assigned Autopilot...
Read Article →Microsoft Defender for Endpoint -Security Settings Management Internals 0x1
In this blog post we take a closer look at how Microsoft Defender for Endpoint Security Settings Management operates under the hood when managing W...
Read Article →How to auto-update apps assigned as Available in Microsoft Intune
Learn how to auto-update applications using supersedence in Microsoft Intune for apps assigned as available. The post How to auto-update apps assig...
Read Article →May the Intune Suite be with You!
This blog will show you something you need to be aware of when you purchase the Intune Suite and use the Cisco DUO desktop app. When activating the...
Read Article →Microsoft Fix Intune Personal Device Enrollment Restriction Bypass
Microsoft fix a bypass technique where you can register personal Windows devices in Intune even while they are blocked. The post Microsoft Fix Intu...
Read Article →I can only show you the Programs Entity, you’re the one that has to Device Query it!
This small blog will examine how the Program entity in the Intune suite feature Device Query is a work in progress. I will update this blog every t...
Read Article →I have the 2024-03 update! Microsoft, Could you Config Refresh me?
Did Microsoft fix the Config Refresh bug with the March update? However, that doesn’t mean it also works. In this blog, I will examine how Config R...
Read Article →Use Certificate-Based Authentication in Entra with Cloud PKI
Learn how to configure Certificate-based authentication in Microsoft Entra using certificates issues from your Intune Cloud PKI. The post Use Certi...
Read Article →Keeping up with the EmmDeviceID And Config Refresh Bug
This blog will supplement my previous one, in which I explored the new DMClient LinkedEnrollment DiscoveryEndpoint Node. I will guide you through t...
Read Article →LAPS Unleashed: Navigating the Future of Windows Admin Security
Dive into LAPS for Windows: a game-changer in admin account security. Discovery of the new CSP settings and configurations.
Read Article →When and how does a device sync with MMP-C (Next Gen Intune)”
In this blog, I will examine the same things as Niehaus but this time the next-generation Intune, MMP-C. I will also examine the sync scheme and sh...
Read Article →Limit local administrators on Microsoft Entra joined devices
Prevent the global administrators in Microsoft Entra from being added to the local administrators group on Microsoft Entra joined devices. The post...
Read Article →Local Administrator, and Autopilot Settings, and Entra Settings! Oh, my!
In this blog, I will examine the new Entra local administrator settings, which prevent users from becoming local administrators on their devices du...
Read Article →Restrict Windows Registry Access with Intune Policy
The Windows Registry serves as a repository for critical system configurations and preferences, essential for the smooth operation of the Windows O...
Read Article →Houston, we have a TPM Attestation problem
This blog will be an additional blog to the TPM attestation series I wrote some time ago. In this one, I am going to take a closer look at why [...
Read Article →Setup cloud-based RADIUS for Entra Joined Devices using Cloud PKI
Learn how to setup RADIUS wireless network authentication in a completely cloud environment using Microsoft Entra, Cloud PKI and RADIUSaaS. The pos...
Read Article →Autopilot: Escape the Administrator
Did you ever run into an issue in which the user was still in the local administrator group after the device was enrolled with Windows Autopilot (a...
Read Article →Entra Private Access & Windows Hello for Business Kerberos Trust – Network Drive Fails for 10 min. after restart and user login
If you are using Entra Private Access (or other SSE solutions) – together with Windows Hello for Business Kerberos Trust, ... Read more
Read Article →Under the hood: Preparing your device for mobile device management
This blog will investigate what happens under the hood when our device is enrolled with Windows Autopilot during the “preparing your device f...
Read Article →Autopilot: Only fail selected blocking apps in technician phase.
This blog will explain everything you want to know about this new ESP function called “Only fail selected blocking apps in technician phase (preview).
Read Article →How to Setup Cloud PKI in Microsoft Intune Step by Step
Learn how to configure you own Certificate Authority in Microsoft Intune Step by Step using Cloud PKI feature of Intune Suite. The post How to Setu...
Read Article →Speaking at the February 2024 Azure APE Meetup
Today (Tuesday February 27th) I have the pleasure to speak at the February 2024 Azure APE Meetup organized by the Azure Platform Engineering (APE) ...
Read Article →The Lord of Compliance: The War of the Check Access Button
In this updated blog, I will take a closer look at what exactly happens when you press the “Check Access” button in the Company Portal and why it t...
Read Article →Windows LAPS Under the Hood Part 2: Defuncted!
This blog will show you how the new Automatic Account Management feature in Windows LAPS, in combination with another new “hidden defunctR...
Read Article →I’m Gonna Config Refresh You So Hard!
This blog introduces a new Intune feature: ConfigRefresh, also known as Config Refresh, designed to enhance device security without the need for re...
Read Article →List All Available Apps in the Intune Enterprise App Catalog
How to quickly list all applications in the Microsoft Intune Enterprise App Catalog using Microsoft Graph PowerShell. The post List All Available A...
Read Article →Device Query: Dead of 64-bit
This blog will show you why the new Device Query Intune Suite feature could give you the wrong information when you are using the WindowsRegistry e...
Read Article →Five Push Notifications at Device Query
In this blog, I am going to take a closer look at how we can troubleshoot a new feature in Intune called Device Query, also known as Intune Pivot. ...
Read Article →Device Query: A Mad Max Intune Suite Feature
This blog will show you how Microsoft is stepping up the real-time reporting game by introducing a new wonderful feature called: Intune Pivot Devic...
Read Article →How to Deploy Apps from the Enterprise App Catalog In Intune
Learn how to deploy applications from the Enterprise App Catalog in Microsoft Intune using the web portal and PowerShell. The post How to Deploy Ap...
Read Article →Windows LAPS Under the Hood: Automatic Account Management
This blog is going to show you some magical things that are happening in the background when you have enabled and configured Windows LAPS Automatic...
Read Article →How to Enable Automatic Account Creation for LAPS in Intune
Learn how to Automatically create new accounts using Windows LAPS configuration settings in Microsoft Intune The post How to Enable Automatic Accou...
Read Article →Windows LAPS: The Desolation of PAA Reboots
While playing around with Windows LAPS with an insider Windows canary build, I noticed that some improvements were made to Post Authentication Acti...
Read Article →Configure LAPS in Intune using Microsoft Graph PowerShell
Quickly configure baseline settings for Windows LAPS in Microsoft Intune using Microsoft Graph PowerShell. The post Configure LAPS in Intune using ...
Read Article →Microsoft Encourages More Performant Membership Rules for Dynamic Groups
MC705357 (9 Jan 2024) says that the dynamic group rule builder in the Entra ID and Intune admin centers no longer supports the contains and notCont...
Read Article →A winget match made in heaven
Learn how to package and auto-update apps in Intune using community-driven tools, WinTuner and Winget-AutoUpdate-Intune, for an efficient, l
Read Article →How to Deploy Microsoft 365 Apps With Intune
Learn how to deploy the Microsoft 365 applications to Windows 10 and 11 devices using Microsoft Intune. The post How to Deploy Microsoft 365 Apps W...
Read Article →Race for Experiments: EPM vs. Ecs
In this blog, I am going to take a closer look at another EPM “flight” (AKA new feature) that Microsoft seems to be working on in Endpoint Privileg...
Read Article →Speaking at the MCT Summit Europe 2024
This year, the annual Microsoft Certified Trainer (MCT) summit will be held in the Netherlands. The event which takes place between 14-17 January w...
Read Article →How to Install and Use WinGet During AutoPilot
Learn how to install WinGet on Windows 10 and 11 devices using Microsoft Intune to help with installing and updating applications during the AutoPi...
Read Article →EPM: And the “Flights” of Support Approved
This is the first unofficial blog about a nice new Endpoint Privilege Management feature called Support Approved. I will show you what it looks lik...
Read Article →How to Enable Defender for Endpoint in Microsoft Intune
Learn how to enable and deploy Microsoft Defender for Endpoint to Windows 10 and 11 devices using Microsoft Intune. The post How to Enable Defender...
Read Article →Perform Bulk On-demand Remediation with Microsoft Intune
Learn how to initiate bulk on-demand remediation packages on multiple machines at once using Microsoft Intune. The post Perform Bulk On-demand Reme...
Read Article →How to Create a Local Admin Account on Windows Devices with Intune
Lean how to create a local administrator account on your Windows devices really simple with Microsoft Intune. The post How to Create a Local Admin ...
Read Article →The 0xd000000d Job 2: Nutty by Intune
In this blog post, a fellow Dutchman (Jos Lieben) asked me if I could assist him with a weird error that occurred during the Intune/MDM enrollment....
Read Article →The Day that the Microsoft Teams Group Chats stood still.
This time not a deep dive blog but a simple little blog about fixing the missing Microsoft Teams group chats and the “Unknown User” in the mobile T...
Read Article →Configuring even better Windows Update for Business settings for your Microsoft Intune managed Modern Workplace
In March 2021, I published the blogpost “Configuring Windows Update for Business settings for your Microsoft Endpoint Manager managed Modern ...
Read Article →How to Deploy the Global Secure Access Client with Intune
Learn how to mass-install the Global Secure Access Client using Microsoft Intune. The post How to Deploy the Global Secure Access Client with Intun...
Read Article →The Wonderful Story of APV2 Device Preparation
In one of my last blog posts, I described how I noticed that Autopilot Version 2, AKA APV2, was coming. This blog is the second in the Autopilot v2...
Read Article →Microsoft Error Codes
Here’s a comprehensive overview of all Microsoft error codes. For deeper insights, I’ve linked to the detailed write-ups I’ve created for specific ...
Read Article →Microsoft Intune Application Deployment Best Practices
In December 2012, I blogged about best practices for deploying applications using System Center Configuration Manager, and while many of those reco...
Read Article →SslClientCertReference Without a Cause
This blog will focus on the 0x80190190 Bad Request (400) we could get because the SslClientCertReference is not configured and maybe a couple of ot...
Read Article →You can now finally upgrade to Windows 11 23H2!
Last Updated on November 2, 2023 by Michael Morten Sonne Intoduction The next Windows 11 version is here!… The post You can now finally upgra...
Read Article →In the Shadow of the DiscoveryEndpoint
This blog will discuss my attempt to enroll my device with the latest 25977.1000 insider preview using Autopilot. I will show you how I stumbled up...
Read Article →There will be…..Autopilot Version 2 (APv2)
This blog will be about my first encounter with APv2. Yeah!! APv2 As in Autopilot version 2. Did I get your attention??? I am going to assume I do....
Read Article →The Positively True Adventures of the Alleged MigrateRefreshTask
This blog will be the 7th one in the Windows Declared Configuration series (WinDc). In this WinDc series I am focusing on what the “Refresh Schedul...
Read Article →Lenovo Bios: Dead of Autopilot Marker
After “finishing” (or maybe not yet) my WinDc blog series I am going to start looking at other stuff. One of the things that I am always interested...
Read Article →Declared Configurations and the MI Provider
This blog will zoom in on, the MOF file and how the MI provider is being used when the declared configuration policies are being set
Read Article →Along With the Gods: The Two PushLaunch Tasks
This blog will be about a big underestimated schedule!! I am going to dive into the PushLaunch scheduled task once again. This Task is responsible ...
Read Article →ReconstructQueueAndExecute: The Last Crusade for Declared Configuration Recovery
This blog post will be the fifth in the WinDC Refresh Schedule series. In it, I will zoom into what happens when we run into corrupted Declarative ...
Read Article →Deploying MDE to macOS
This guide will get you up and running with MDE for macOS in no time.
Read Article →Easily import, export and document Intune configurations!
Need to bulk import, export or document your Intune configurations, this guide has you covered.
Read Article →Speaking at the Workplace Ninja Summit, September 27-29 2023
Starting on Wednesday September 27, till Friday September 29 the Workplace Ninja Summit which is an in-person event will take place in Baden, Swits...
Read Article →Close Encounters of the Microsoft Azure Attestation
This blog will be about my first and second encounters with Microsoft Azure Attestation(MAA) and how this new kind of attestation will be dropped d...
Read Article →Entra Registered Devices in Intune: What You Need to Know
This blog is an addition to my previous blog, which showed you the difference between Entra Registered devices and Entra Joined devices. In this bl...
Read Article →Refreshing the Declared Configuration Policies
This blog post will be the second one in my journey to discover what the “refresh schedule created by Declared Configuration to refresh any setting...
Read Article →0x80072f8f : A BitLocker Odyssey
This time, a simple blog about a BitLocker escrow error (0x80072f8f )that started happening (all of a sudden) on multiple devices when you were try...
Read Article →The Treasure of the MMP-C Madre
This time, a simple blog without technical details. It will be just me showing you why I am so enthusiastic about a specific service called MMP-C a...
Read Article →Under the Hood of: MDE Attach V2 / Security settings management
I will guide you through my MDE Attach V2 (Security Management) journey and explain which "service" delivers the Intune policies to your NOT AADJ (...
Read Article →The WinDC Refresh Schedule and the Dudes
In this series, I will try to explain more about a wonderful "refresh schedule" I noticed in the task scheduler after EPM was deployed. This first ...
Read Article →The 0x800705B4 error in our stars
In this blog, I am going to scuba dive a bit into the wonders of SyncML and how all devices ended up with sync errors and all new Autopilot enrollm...
Read Article →A Guide to Recognizing Your Post Authentication Actions
LAPS everywhere!!!! This time I am deep-diving into the wonders of the Post Authentication Actions (PAA) and what is actually happening (or maybe n...
Read Article →The Infernal MMP-C Discovery
This blog will be an additional blog post to the MMP-C one. In this blog, I am deep-diving into the first MDE / MMP-C / Declared Configuration enro...
Read Article →The Password Rotation: The Ballad of Windows LAPS and Threadpools
In this blog post, I will explore the wonders of Windows LAPS and what happens when you remotely perform a password rotation from Intune—nothing mo...
Read Article →The Virtual Account that rocks the EPM!
Are you using Intune Endpoint Privilege Management (EPM) and wondering what is “needed” when you launch a process with elevated access?...
Read Article →Easy Riders, Intune Bulls: How the Defender for Endpoint, Live Response, and Rock ‘N’ Roll PowerShell Script Recovered the Intune Certificate
We talked about this in our MMSMOA session, but I still needed to write something about it…..so here we go! This blog will be “again...
Read Article →Block gTLD (.zip)/ FQDN domains with Windows Firewall and Defender for Endpoint
Recently there was some news with new gTLD domains. Google Registry launched eight new top-level domains: .dad, .phd, .prof, .esq,&#...
Read Article →Set up a free Microsoft Intune lab tenant with Microsoft 365 developer subscription
Last Updated on March 14, 2024 by Michael Morten Sonne Intro Do you want to get started learning… The post Set up a free Microsoft Intune lab...
Read Article →Endpoint Privilege Management and the Device Health Monitoring Reports: Quantumania
This blog will be small and simple, but it will be about me looking at how the Endpoint Privilege Management reports will be delivered to Intune. O...
Read Article →Intune - Microsoft Tunnel VPN Gateway
Note This article was last updated on 01/30/2025 for readability and updated URLs. I am working on updating this for the UI changes that have been ...
Read Article →How to use Windows LAPS – PowerShell
Last Updated on June 19, 2023 by Michael Morten Sonne Intoduction This is in relation to my last… The post How to use Windows LAPS – PowerShe...
Read Article →I Killed My Endpoint Privilege Management Enrollment, Hung Her on a Meathook, and Now I Have a Three Picture Deal at MMP-C
This blog will be just me looking at the delivery of the EPMagent in my own troubleshooting style. While doing so, I got focused on something even ...
Read Article →Windows LAPS and management through Microsoft Intune
Last Updated on June 19, 2023 by Michael Morten Sonne What is Windows LAPS Exciting News! New Built-in LAPS… The post Windows LAPS and m...
Read Article →Are You There Intune? It’s Me, Health Attestation Certificate
A Compliant device, I want myself to have a working Intune enrolled compliant device!!!! Nothing more! Just a compliant device! In this blog, I wil...
Read Article →Deploy Microsoft Teams on Azure Virtual Desktop using Intune
Deploy Microsoft Teams to Azure Virtual Desktop using Intune.
Read Article →Intune - Discover Defender AV exclusions using Proactive Remediation
Note This article was last updated on 01/30/2025 for readability and updated URLs. I am working on updating this for the UI changes that have been ...
Read Article →Intune - Block mounting of ISO files
Note This article was last updated on 01/30/2025 for readability and updated URLs
Read Article →Triangle of TPM Attestation Sadness
This small blog will be about the errors 0x81039001 and 0x80190190 you could get when enrolling your device with Autopilot (Self Deploying or Pre-P...
Read Article →The Yin-Yang Store Apps: VPN of Eternity
This blog will show you how I started troubleshooting an issue in which Microsoft Store Apps failed to install. I will guide you through the PowerS...
Read Article →Deploy Microsoft Defender for Endpoint on iOS using Intune/MEM
Microsoft Defender for Endpoint is available for multiple platforms including Windows, macOS, and Linux. For mobile platforms Defender for Endpoint...
Read Article →Something Went Wrong – Fury of the Gods
This blog will be about me troubleshooting the “Something Went Wrong” error you could get during the Account Enrollment Status Page when enrolling ...
Read Article →December 2022 update of the conditional access demystified whitepaper and workflow cheat sheet.
I’m proud to announce the December 2022 update of my Conditional Access demystified whitepaper. With this release, we have reached the fifth ...
Read Article →Step by Step: How Windows Retrieves the Autopilot Profile
This blog shows how a Windows device retrieves its Autopilot profile from the ztd.dds.microsoft.com service during OOBE. More importantly, we’ll se...
Read Article →Secret Society of Second-Born DesktopAppInstaller CSP’s
This blog will be an additional part of the blog I wrote about my experiences when deploying UWP /Store Apps with the New store App functionality i...
Read Article →Hotel Microsoft Store Apps: Transformania
This blog will show my experiences with Intune’s new Microsoft Store App functionality. I wanted to publish the next part of my Autopilot ser...
Read Article →How to manage your Microsoft Edge Enterprise Cloud Site List like a boss
In this article I describe how to enable IE mode on your Intune enabled devices and how you can easily manage a corporate site list!
Read Article →All quiet on the Intune Detection Rules
This blog will not be a deep dive into a weird issue but will be more like an explanation of when you want to silently install and uninstall a Win3...
Read Article →Microsoft Store the Movie: Hoopa and the Clash of Winget
This blog will show you my first experiences dealing with Winget and installing Store Apps from the Microsoft Store as a regular user. I will try t...
Read Article →Intune - Using Access Packages to Enable User Device Enrollment
Note This article was last updated on 01/27/2025 for readability and updated URLs, but content review and image updates are in process :)
Read Article →The Device With A Clock In Its Service
This blog will be about (yes… again) an Intune sync issue. After we took over management of a Microsoft Tenant from a new customer, we notice...
Read Article →The school for ADMX upload and Evil
In this blog, I will summarize some of the ADMX/ADML upload errors I got while playing around with them. Of course, I will also try to show you wha...
Read Article →ADMX: When Nature Calls
Today, I wrote a simple blog that will be about troubleshooting one of the ADMX upload (file referenced not found) error you could endure when uplo...
Read Article →Intune Sync Debug Tool: The Last Royal Treasure
This blog will be about me showing and explaining the Intune Sync Debug PowerShell tool I wrote to fix those damn Intune MDM device CA certificate ...
Read Article →Fullmetal Certificate: The Intune Revenge of Renewal
This blog will be about me looking at the Intune Device Certificate renewal process and what happens behind the curtains 1. Introduction I guess we...
Read Article →Convert Registry Settings to ADMX
This blog is going to show you how to create custom ADMX templates within a couple of minutes to deploy some HKEY_CURRENT_USER settings to your Int...
Read Article →Speaking about Mobile Application Management at the AppManagEvent 2022 on October 7 in Utrecht
On October 7, 2022 the AppManagEvent will be organized in the Media Plaza, Jaarbeurs Utrecht. The AppManagEvent is an initiative from PDS b.v. in t...
Read Article →The Man Who Knew Autopilot
In this new blog, I will discuss a big Windows Autopilot misunderstanding. I will try to explain and convince you why blaming Autopilot is not alwa...
Read Article →Deploying winget apps with Microsoft Endpoint Manager and auto-update!
A brief overview on how you can deploy applications using winget in Microsoft Intune and even keep them updated!
Read Article →Blocking web push notifications with Endpoint Manager and why you should!
Admit it, we've all fallen foul of that annoying (and scary for some) popup that seems to rear it's ugly head after you've spent the last...
Read Article →Microsoft Defender for Endpoint series – Onboard using Defender for Cloud – Part3B
It is time for part 3B of the ultimate Microsoft Defender for Endpoint (MDE) series. After Part 3A (Onboard Defender for Endpoint using Microsoft I...
Read Article →Microsoft Defender for Endpoint series – Onboard using Microsoft Intune – Part3A
It is time for part 3A of the ultimate Microsoft Defender for Endpoint (MDE) series. After Part 3 (Onboard Defender for Endpoint) it is now time fo...
Read Article →Intune: The Legend of the Certificate
Do you have devices that are missing the Intune Device Certificate or have sync issues? This blog will show you a possible root cause and how to so...
Read Article →Block users from viewing their BitLocker keys
Check out this article via web browser: Block users from viewing their BitLocker keys This post is mainly focused on a new tenant setting, where yo...
Read Article →The Last thing Edge Wanted
After being on a nice vacation for 2 weeks now, I felt the urge to write this simple blog to show you how to deal with a not responding Microsoft [...
Read Article →Autopilot: Delay Win32 App Installation
This blog shows how to hold off required Intune app installs until after Autopilot enrollment, using a practical PowerShell script as a requirement...
Read Article →The Ballad of Buster Exit Code’s
In one of my earlier blogs, I discussed the IME installation flow and the global retry schedule. I showed you how the retry schedule looks at the E...
Read Article →A Babysitter’s Troubleshooting Guide to breaking Autopilot
This blog will be about the 0x800705b4 (Time-Out) error I got during the Autopilot “Preparing your device for mobile management” step. Please note ...
Read Article →Retry Win32 App Lola Retry
When a Win32app fails to install, figuring out the root cause can be frustrating. We often need to trigger the installation repeatedly to get to th...
Read Article →The TenantID from Toronto
After reading a question on Reddit about how Intune knows which device belongs to which organization, I decided to write a dedicated blog post abou...
Read Article →OOBEAADV10: Return of the 502 Autopilot Error
After all of the Autopilot issues and AAD sign-in errors in March 2022, I need to explain this OOBEAADV10 error a little bit better. 1. Introductio...
Read Article →The Incredibly Strange Device Who Stopped Syncing and Became Certificate Zombies!!?
This blog will NOT be about the new Autopatch function! Of course not! This blog will be about multiple weird Intune Device sync errors I was asked...
Read Article →Night of the Autopilot of the Dawn of the Temporary Access Pass of the MFA of the Return of the RebootRequired of the WUFB of the Attack of the Evil, Mutant, Hellbound, Flesh-Eating SSO Zombified Living Conditional Access, Part 2: In Azure 2-D
After a nice talk with Yannick Van Landeghem, who made me aware of a “possible” security gap when using a Temporary Access Pass (TAP), I decided to...
Read Article →Office CSP: DNS and the Journey to Autopilot
In this blog, I’ll discuss the unexpected challenges I encountered during an Autopilot deployment, specifically the 0x000008CA error. This er...
Read Article →Troubleshooting Intune MDM Device enrollment errors.
Troubleshooting Windows Device Enrollment errors can be a pain! In this post, we will guide you through resolving issues that may arise when enroll...
Read Article →LOB Apps & Win32 Apps: The Intune Lightning Thief
This blog will show you how to get back your LOB (MSI) apps from Intune. Last week I noticed a question popping up on Reddit asking for the same th...
Read Article →Protocol Nightmare on Elmstreet: The Dream CVE-2022-30190
This blog will be about how I am protecting my Windows 10 Pro devices to ensure they aren’t vulnerable to the nasty CVE-2022-30190 bug, also known ...
Read Article →Intune - Edge in iOS Kiosk Mode
Note This article was last updated on 01/26/2025 for readability and changes to URLs.
Read Article →Managing Microsoft Defender for Endpoint with the new Security Management feature in MEM/Intune
Currently in general availability is the new Security Settings Management in Microsoft Defender for Endpoint. Security Management for Microsoft Def...
Read Article →Speaking about Mobile Application Management at the Techorama Belgium 2022 event
On Wednesday, May 25, 2022, I will be speaking together with Peter Daalmans at the Techorama Belgium event. Techorama 2022 will be an in-person con...
Read Article →The 41-Year-Old Hardware Hash Who Knocked Up Autopilot and Felt Superbad About It
In this blog, I will be talking about a sudden “HardwareMismatchDetected” I got when I was trying to enroll my Windows 10/11 device with Autopilot ...
Read Article →Defender for Endpoint - Removable Storage Access Control
Note This article was last updated on 01/26/2025 for readability and new images due to UI changes made in Intune. I tried to keep the original styl...
Read Article →Download Intune PowerShell scripts with Graph Explorer
Check out this article via web browser: Download Intune PowerShell scripts with Graph Explorer This quick post will show an easy method to fetch yo...
Read Article →Forgive Us Our BitLocker suspension
When deleting the Intune object, I noticed that Bitlocker had somehow been suspended. With Bitlocker suspended, the Protection was off. If the Bitl...
Read Article →Mamma Mia! Here we Wipe Again!
This blog will show you the “other paths” available to ensure that your device is wiped before it is trashed or sent back to the supplier. 1. Intro...
Read Article →Wrath of the 0x81036501 MDM Error
This blog will be about the error 0x81036501 we got during the MDM enrollment while enrolling a device with Autopilot white-glove AKA Pre-Provision...
Read Article →Honest Win32App Thief
This blog will show you an alternative method to download your Win32Apps sources from Intune WITHOUT having the Encryption key information. Besides...
Read Article →The Intune Remote”Wipe” fix!
I guess you have all been reading my blog series. Magical Mi…Ehh Wipe Series – Call4Cloud. It will show you some weird issues with the ...
Read Article →I’ll Always Know What You Did Last Wipe
In this blog, I will try to explain the Technical flow behind the Push Button Reset. I was intrigued to do so after writing my blog about the linge...
Read Article →Apple Business Manager device import options for later use within Microsoft Endpoint Manager
This blogpost is a continuation of two earlier blogposts about integrating Apple Business Manager with Azure Active Directory and Apple Business Ma...
Read Article →ADMX ingestion for Centero Agent and Carillon Client using Intune
Check out this article via web browser: ADMX ingestion for Centero Agent and Carillon Client using Intune This article is about the ADMX templates ...
Read Article →The Dark and the Windows “Remote/Local” Wipe
This blog will be about my experience performing a remote wipe of Windows 10 and 11 devices in Intune. I noticed some weird and awful behavior when...
Read Article →Connecting Microsoft Endpoint Manager to Apple Business Manager
This article will continue where we finished in the article I wrote about setting up Apple Business Manager for use with Azure Active Directory. In...
Read Article →Autopilot: Across the TimeOut-Verse
This blog will discuss the 0x800705b4 error that “could” occur during the “Preparing your device for mobile management” ESP Autopilot phase. ...
Read Article →Setting up Apple Business Manager for use with Azure Active Directory
Apple Business Manager is a service provided by Apple which helps to deploy Apple devices and apps in your organization. By leveraging Apple Busine...
Read Article →Escape from Windows Pro/Business
This blog will explain why an existing Windows Business device isn’t automatically upgraded to Windows Enterprise after assigning the MS365 E5 lice...
Read Article →Proactive Remediatons: The Hidden World
Introduction: Understanding and Utilizing Proactive Remediations in Intune Proactive remediations are a powerful feature in Microsoft Intune that e...
Read Article →Updating Apps: A New Era
Updating Applications can be a real headache, especially when certain apps require administrative permissions that standard users don’t have. This ...
Read Article →How I Fell in Love with App Updates
Today, I was called in to devise a solution to allow some DDS-CAD users (NO LOCAL ADMINS!) to install the necessary DDS-CAD updates themselves. Of ...
Read Article →Microsoft 365 self-service using Power Apps
Check out this article via web browser: Microsoft 365 self-service using Power Apps This article was originally posted on the Microsoft 365 PnP Blo...
Read Article →Deploying Defender for Endpoint on iOS with zero-touch onboarding
Defender for Endpoint is available for multiple platforms. For mobile platforms Defender for Endpoint is supported for iOS en Android. In this blog...
Read Article →Manage Device control with Microsoft Defender for Endpoint and Endpoint Manager
Microsoft Defender for Endpoint contains multiple protections layers like EDR, ASR, Network Protection, and many more. Protecting against unwanted ...
Read Article →Speaking at the Workplace Ninja Virtual Edition 2021 about Designing and building Microsoft Endpoint Manager for Operations
From Tuesday August 31 till Thursday September 2, the 2nd edition of the Workplace Ninja Virtual Edition will take place. The event will be hosted ...
Read Article →Deploying Office 365 with Intune as a Win32 App (and Why You’d Want To)
Office 365, or Microsoft 365 Apps for Enterprise, or whatever it’s called this month, can be deployed by Intune to Windows 10 devices using a...
Read Article →Enroll Android smartphones into Microsoft Defender for Endpoint for blocking FluBot
The Flubot-malware is currently active in the news. The malware with the name FluBot will be sent to mobile endpoints with a text message or WhatsA...
Read Article →Endpoint Manager filters: Use filtering for assigning policies, profiles and apps to specific devices
Microsoft recently announced a new existing feature in Microsoft Endpoint Manager with the name: “filters”. With the new feature, it is...
Read Article →MDM policy processing on Windows 10 with Microsoft Endpoint Manager, a closer look
The goal of this blogpost is to explain more about what happens between the moment that a configurations setting in Microsoft Endpoint Manager (MEM...
Read Article →Troubleshooting Hybrid Azure AD Intune Automatic Enrollment
As I have blogged about a lot, there are a bunch of hoops to be jumped through and prerequisites to be met for a successful hybrid Azure AD join an...
Read Article →Designing and configuring compliance policies for your Windows Modern Workplace using Microsoft Endpoint Manager
Measuring your managed systems against a baseline has been around for a while, in Microsoft Endpoint Configuration Manager(MECM)/ConfigMgr we can a...
Read Article →Announcing #WPNinjasNL Tuesdays Webinar #23, Tuesday April 13, featuring Greg Ramsey
For next week, Tuesday, April 13 we are proud to announce that Greg Ramsey, Enterprise Mobility MVP and Enterprise Tools Strategist at Dell, Inc. w...
Read Article →Update BitLocker Unique Identifiers with Intune
BitLocker unique identifiers are values used to identify the ownership of an encrypted volume. The device that performs the encryption holds the un...
Read Article →Microsoft Defender Network Protection – Not Enabling via Intune – Troubleshooting & Fix
When configuring Defender for Endpoint (MDE) customer recently, I ran into a problem when trying to enable network protection. Network protection i...
Read Article →Get insights into device restart frequency with Endpoint Analytics
A well-running workplace environment is critical to have a great endpoint user-experience. With a not stable configuration/ device the productivity...
Read Article →A first look at the settings catalog in Microsoft Endpoint Manager
With the 2101 Service Release of Microsoft Intune, released this week (February 1, 2021) Microsoft released a lot of new features. One of those fea...
Read Article →Use Intune to Manage Microsoft Defender for Endpoint Tags and Device Groups
In Microsoft Defender for Endpoint (MDE), tags can be attached to a device for reporting, filtering, and as a dynamic attribute for membership of a...
Read Article →Turn Existing Azure AD Devices into Windows Autopilot Devices
To provision Windows 10 PCs using Autopilot and Intune, they must first be registered as Windows Autopilot devices in the Device Directory Service,...
Read Article →Updating your Security baselines in Microsoft Endpoint Manager to a newer version
With the 2101 Service Release of Microsoft Intune, released this week (February 1, 2021) Microsoft released a lot of new features (more on that in ...
Read Article →Understanding Application Guard for Office, Now Generally Available
Application Guard first appeared in Windows 10 1709 (“Fall Creators Update”) to isolate Edge browser activity within a Hyper V containe...
Read Article →Store BitLocker Recovery Keys in Azure AD for Devices Already Encrypted
As you move from on-premises or third-party infrastructure to Microsoft 365 and Azure AD, you will want to keep those BitLocker recovery keys safe....
Read Article →Deploy and configure Microsoft Defender for Endpoint on iOS devices
Het bericht Deploy and configure Microsoft Defender for Endpoint on iOS devices verscheen eerst op Jeffrey Appel - Microsoft Security blog.
Read Article →Designing and building your Microsoft Endpoint Manager/Intune environment for Operations
In my work as a modern workplace consultant, I see a lot of Microsoft Endpoint Manager/Intune environments. Many of these environments have been bu...
Read Article →Mobile Application Management for Mobile Devices with Microsoft Endpoint Manager/Intune deep dive
With Microsoft Intune, there is a lot of focus on the Mobile Device Management (MDM) aspects of the product. This is logical because from a managem...
Read Article →Food for thought – Bring Your Own Disaster.
Check out this article via web browser: Food for thought – Bring Your Own Disaster. Today a slightly different blog post. It’s a common...
Read Article →Edge Chromium; zo configureer je de tracking prevention functionaliteit vanuit Microsoft Endpoint Manager
De nieuwe Microsoft Edge webbrowser is gebaseerd op Chromium en geeft verschillende voordelen welke voor de beheerders interessant zijn. Door de on...
Read Article →Microsoft Defender for Endpoint Web Content Filtering – Administration, Limitations, and User Experience
Historically, one of the big features missing “out of the box” with MDATP was web content filtering. Customers typically look at MDATP ...
Read Article →Automatisch contacten synchroniseren vanaf Microsoft Outlook naar native contact app via Microsoft Endpoint Manager
Met de komst van multifactor en moderne authenticatie stappen steeds meer bedrijven over op de Outlook app voor de mobiele devices. Dit heeft voora...
Read Article →Android Enterprise via Microsoft Endpoint Manager als vervanger van Android device administrator
Met de aflopende support van Android device administrator is het van groot belang om te zoeken naar een passend alternatief. Vanuit Microsoft Endpo...
Read Article →Edge Chromium; zo configureer je beheerde favorieten via Microsoft Endpoint Manager
Edge Chromium is de nieuwe versie van Edge welke is gebaseerd op de opensource Chromium. Vanuit Microsoft Endpoint Manager is het mogelijk om deze ...
Read Article →Set additional clocks to Windows 10 using Intune
Check out this article via web browser: Set additional clocks to Windows 10 using Intune When you work for an international company, or you have to...
Read Article →Hybrid Azure AD Join + Intune Enrollment – Prerequisites Checklist and Process Flow
I’m a simple person, and sometimes it just helps to have a checklist to refer to when you’re troubleshooting rather than navigating the...
Read Article →Install Windows Package Manager (winget) using Intune
Check out this article via web browser: Install Windows Package Manager (winget) using Intune Microsoft released a preview of the Windows Package M...
Read Article →Android Enterprise fully managed beschikbaar in Microsoft Intune voor zakelijke omgevingen
Microsoft heeft vandaag laten weten dat de Intune support voor “Android Enterprise fully managed devices” nu volledig beschikbaar is. Hiermee is he...
Read Article →Intune 2005: Aanpassen van Self service acties in Company Portal
Een verzoek hoog op de wensenlijst van vele beheerders. De mogelijkheid om de self-service acties te wijzigen in de Company Portal. In de praktijk ...
Read Article →Windows 10 co-management: Flexibel naar de cloud
Steeds meer bedrijven maken de overstap richting de cloud. Uiteraard zijn de cloud functionaliteiten enorm, toch zijn bedrijven terughoudend vanweg...
Read Article →Connect a Work or School Account – MDM vs. MAM in Self Enrolment
A Windows 10 user can self-enrol in MDM or MAM from Settings > Accounts > Access work or school > Connect. What happens next depends on...
Read Article →Windows Information Protection (WIP) App Protection Policies: Protected and Exempt; Denied and Allowed – What Do They Mean?
One of things that strikes me as vague in Windows Information Protection (WIP) policies in Intune is configuring targeted apps: what’s the ex...
Read Article →Speaking at Workplace Ninja Virtual Edition 2020
I’m very proud to announce that I will be speaking at the Workplace Ninja Virtual Edition 2020 event. The Workplace Ninja Virtual Edition 202...
Read Article →Manage Teams custom backgrounds using Intune
Check out this article via web browser: Manage Teams custom backgrounds using Intune Update! I got some feedback on this blog. Seems that if your u...
Read Article →License requirements for administering Microsoft 365 services
Microsoft licensing is tough and vague but something we must deal with while implementing our solutions. I’m also aware that some of the feat...
Read Article →A guide to implementing Applocker on your Modern Workplace
At our last Windows Management User Group Netherlands meeting, we had the honor to have Sami Laiho, one of the world’s leading professionals in the...
Read Article →Get started with web content filtering in MDATP
Check out this article via web browser: Get started with web content filtering in MDATP Update 7-7-2020: Microsoft anounced that you no longer need...
Read Article →Windows Update for Business. “Just” a free cloud service.
Check out this article via web browser: Windows Update for Business. “Just” a free cloud service. Since the introduction of the “...
Read Article →Challenges while managing administrative privileges on your Azure AD joined Windows 10 devices
By default, on Windows 10 devices which are Azure AD joined, the user performing the join is added to the Local Administrator group. Besides the us...
Read Article →Using Intune to Deploy the Azure Information Protection (AIP) Unified Labeling Client (Win32 MSI)
Unified labels refer to a movement whereby Azure Information Protection (AIP) labels are now being replaced by sensitivity labels. Sensitivity labe...
Read Article →Deploy Microsoft Store Apps using Intune with Configuration Manager (SCCM) Co-Management (Fix ‘Not Applicable’ Status)
Intune provides an interface to easily deploy apps from the Microsoft Store to your registered users and devices, but even if you have SCCM (Config...
Read Article →Implementing RBAC and Scoping in Microsoft Intune
When you create an Intune tenant within your environment, you execute the creation with an account which is Global Administrator within Azure Activ...
Read Article →Intune: Choosing whether to assign to User or Device Groups
One of the disadvantages of being an experienced consultant in IT is the fact that once in a while you need to re-learn. With re-learn I mean that ...
Read Article →What are Guided Scenarios in Microsoft 365 Device Management/Intune?
While browsing the new Microsoft 365 Device Management portal I noticed the following option: “Guided scenarios (preview)”. From the Wh...
Read Article →iOS restore behaviour when re-enrolling devices with backup data into Intune
While implementing Intune at my customers I rarely encounter green field implementations where computers and mobile devices are newly delivered and...
Read Article →What are Intune Policy Sets?
Starting with the Intune release from October 14th 2019, Microsoft made available a new functionality called “Policy Sets”. ...
Read Article →Conditional Access demystified, part 8: Resources and further references
Now available: May 2020 update of the Conditional Access Demystified Whitepaper, Workflow cheat sheet, Implementation workflow and Documentation sp...
Read Article →Conditional Access demystified, part 6: Troubleshooting Conditional Access
Now available: May 2020 update of the Conditional Access Demystified Whitepaper, Workflow cheat sheet, Implementation workflow and Documentation sp...
Read Article →Conditional Access demystified, part 7: Modifying Conditional Access to suit your special needs
Now available: May 2020 update of the Conditional Access Demystified Whitepaper, Workflow cheat sheet, Implementation workflow and Documentation sp...
Read Article →Conditional Access demystified, part 4: Designing a Conditional Access strategy
Now available: May 2020 update of the Conditional Access Demystified Whitepaper, Workflow cheat sheet, Implementation workflow and Documentation sp...
Read Article →Conditional Access demystified, part 5: Implementing Conditional Access
Now available: May 2020 update of the Conditional Access Demystified Whitepaper, Workflow cheat sheet, Implementation workflow and Documentation sp...
Read Article →Conditional Access demystified, part 2: What is Conditional Access?
Now available: May 2020 update of the Conditional Access Demystified Whitepaper, Workflow cheat sheet, Implementation workflow and Documentation sp...
Read Article →Conditional Access demystified, part 3: How does Conditional Access work?
Now available: May 2020 update of the Conditional Access Demystified Whitepaper, Workflow cheat sheet, Implementation workflow and Documentation sp...
Read Article →Conditional Access demystified, part 1: Introduction
Now available: May 2020 update of the Conditional Access Demystified Whitepaper, Workflow cheat sheet, Implementation workflow and Documentation sp...
Read Article →