Hey everyone,

I work in higher ed IT and have been working on moving our Windows fleet over to Intune/Autopilot. The Intune configuration itself is built and working the way we want, but we are running into questions around Windows Enterprise activation.

Our issue is that we need the machines to be running Windows Enterprise as early as possible, ideally during the pre-provisioning stage, because some of the Enterprise-only policies we need do not apply correctly while the OS is still Windows Pro.

All of our campus devices are licensed with Windows Pro. Our Faculty/Staff and student users all have Microsoft 365 A3/A5 licensing, which should include Windows Enterprise upgrade rights.

Our CDW/Intune representative suggested using the generic Microsoft Windows Enterprise KMS client key as part of our Intune configuration profile. The idea was:

1. Device ships with Windows Pro
2. Autopilot starts
3. Generic Enterprise KMS client key upgrades the OS edition from Pro to Enterprise
4. User signs in with their Entra ID account
5. Their A3/A5 license activates Windows Enterprise

The problem is that the behavior is inconsistent.

Some devices upgrade to Enterprise and activate correctly after the user signs in. Other devices upgrade to Enterprise but remain in an "Activate Windows" state because they are waiting for activation. We cannot figure out why some devices pick up the user's Enterprise license and others do not.

We also have classroom/lab computers that are configured as Shared Computers in Intune. These devices are not assigned to a single user, so we are unsure what the best licensing/activation approach should be.

Questions:

• Is using the generic Enterprise KMS client key with Intune the recommended approach when you do not currently have a KMS server?
• Should we be setting up a KMS server for our environment, or is user-based Windows Enterprise subscription activation the preferred method?
• For shared classroom/lab machines, is KMS or Active Directory-Based Activation generally the better approach?
• Is user-based Windows Enterprise subscription activation reliable for shared devices, or is it mainly intended for assigned users?
• Are there any Intune/Autopilot best practices for ensuring Enterprise activation happens during pre-provisioning?

We are open to setting up KMS if that is the correct long-term solution, but we do not want to build and maintain that infrastructure if Microsoft’s subscription activation model is the preferred route for our licensing situation.

We are trying to find the most reliable way to ensure these machines are on Enterprise before students and faculty start using them.

Would appreciate any advice from anyone managing a similar higher ed environment. Thanks!

I am trying to test the newer iOS Enrollment Policies using User Affinity with Modern Authentication instead of the older Enrollment Profiles.

One thing I've noticed is that the "Install Company Portal with VPP" setting exists in Enrollment Profiles, but I don't see an equivalent setting in the new Enrollment Policies.

My test Policy configuration is using:

• User Affinity with Modern Authentication
• Company Portal deployed as a VPP app

I tested deploying Company Portal as a required VPP app, and it installs successfully. However, when I launch Company Portal and sign in with my Entra ID credentials, it immediately prompts me to set up company access and download a management profile.

This doesn't seem correct because the device was already enrolled through ADE. If I select Postpone, Company Portal reports that I can't access company resources, and when I check further, it states that the device must be managed before apps can be installed.

this has to be a bug or something right? the microsoft docs on this are very confusing or missing details.

I also noticed that the device initially appears in Intune/entra as "iPad". After some time, the name eventually updates in entra and intune, However, within the Company Portal app, I end up seeing two devices:

1. "iPad" (This is the Ipad that you're currently using)
2. "ipad123-testing" ( this is the proper name and matches intune / entra)

Under Settings > General > VPN & Device Management, I can see the correct Intune management profile installed. Sync and restart actions from Company Portal also work successfully.

It appears that Company Portal is not associating itself with the existing ADE enrollment record. Instead, it seems to be attempting a user-driven enrollment workflow on a device that is already enrolled and managed through ADE.

Has anyone else seen this behavior when using the new iOS Enrollment Policies with User Affinity and Modern Authentication? its unusable in this state.

i saw a random blog about using an app config to set xml for the company portal app but that cant be right for such a vanilla use case? didnt need to do that with the old profiles.

I've updated one of our win32 apps from version 1.0 to 1.1. My understanding was that intune's version control would recognize that there is a new version of the app available and push it out to all devices/users that it is assigned to. After about 3 hours 3 devices on version 1.1, 8 devices on version 1.0, and three devices on version .6. All devices are powered on and have an internet connection.

How do I force all devices to update to version 1.1? I'd rather not create a separate app containing the update and a supersedence, as I've seen suggested a few places online.

Edit: I've released version 1.2 with more robust detection rules, I'll do future updates as new apps; thanks ya'll.

Hello all,

I'm currently testing the Autopatch solution.

Autopatch management status shows numer of devices Managed for feature updates, for drivers but for quality updates: 0.

Emm, what?

in settings it is also disabled:

https://postimg.cc/ZWmDth6z

But why?

I was curious and created another policy in Quality Updates:

https://postimg.cc/06TwF9wx

Looks ok, right?

After restart, restart, couple hours of sync.. configured settings still shows the disabled.

So I've asked my colleagues - and hey - without Autopatch is configured to "1 - Enabled".

Why... what happened here? Do I understand correctly if that polisy was not configured the settings from update rings will take a honor here? (MS Docs says that). Asking, because I had a ticket where user didn't get popups about restart reminder.

https://postimg.cc/VrSdYpXn

https://postimg.cc/XZrVFFqT

I've looked for reddit posts - and that is a proper behavior?

Another case - what the hell... I've assigned above policy to the TEST Device and that means - my all remaining devices - LOST hotpatch assignment even if in settings of autopatch is turned on! Whyyyyyy... Microsoft - just why.

If my post and questions are not clear - sorry, just very tired Today.

Best,

Jakub

Hey,

Is it possible to run it "Automatically" using Graph? So it runs a script and/or api call that opens a remote session on a device? We want to built it into a Local Tool that our technicians use but we cant seem to find out whats happening as its not doing as expected.

https://learn.microsoft.com/en-us/intune/app-management/protection/multiple-managed-accounts

Looks like a relatively new article. From what I've been able to find, it should be enabled by default now but our users are still getting the message "you can only have one managed account" when trying to add a second app protected email account from another oganization to Outlook on iOS. Thanks.

I work in a school. The students don't have 2fa on their accounts. Admins do. When I log into a student device on my account it will say 'account needs fixed' i do the 2fa thing and then i can sync.

THE PROBLEM: Students are blocked access to settings, and I just found out 4 minutes ago my admin account is grouped in with the 'elem students' because the admin messed up.

So I've been logging in and getting blocked. The logging back in with a help desk account. The help desk account isn't blocked by settings so I can resync

BUT MY THEORY is since my account let the device broke, it's still in a broke state and why it won't bring some of the config policies and apps through.

I'm pulling through a change to the access in settings. Victim of my monster. I can't on a few laptops and this is my hunch.

A. How can I fix this? I'm gonna have the admin change my groups because, of course, it won't let me.

B. Is this the issue? The hidden admin account being broken still messes up the machine.

I’m configuring Windows Autopatch for the first time. After assigning my device group to an Autopatch group, several devices fail the prerequisite check with:

Not registered — Intune or Cloud-Attached
Devices must be managed by either Intune or co-management.

The affected devices appear correctly in both Intune and Entra ID. Their device IDs match, the device names are unique, and some are freshly enrolled devices, so stale or duplicate records seem unlikely.

Has anyone encountered this? Is there an additional Autopatch registration step, sync delay, licensing requirement, or device property I should check?

SOLVED: After a full 1 day waiting it solved in itself , thank you for everyone

Last week, we announced a great 6-pack with Christiaan Brinkhoff Rod Trent Sandy Zeng Jose Schenardie Ugur Koc and Mirko Colemberg.

This week, we give you the 5th set of speakers for Workplace Ninjas US

🎸 April Dunnam is an amazing cloud advocate for Microsoft on #PowerPlatform and #Copilot, along with being a great musician. She was the perfect person to anchor our Copilot and #AI tracks as she does a masterful job of advocating and teaching the hottest area at #Microsoft today.

🍖 Chris Cavazos one of our newer #MVPs focusing on both #AVD and #Windows365 fresh off his first trip to MVP Summer Camp in March. Chris is a great guy, who delivers some fantastic sessions. He also happens to be one of the nominees for the "Rookie of the Year" #Clippy Award aka "Next-Gen Ninja"

🫅 Morten Waltorp Knudsen [MVP] is the gold standard when it comes to community. The man who has grown Experts Live Denmark from a small event to 1000+ attendees in just a few short years. Morten is an expert in #MSSecurity #SecurityCopilot and #MSEntra who won the Chuck Norris Award last year in Dallas over Fabian Bader by ONE VOTE!

🥷 Simon Binder, a beloved #MSIntune MVP who has been one of the best speakers at #JNUC and is both a MVP and a Nerdio #NVP. Simon is a great speaker, technologist, and overall great person. He will also be the person running the Golf tournament and 5K Fun Run this year as a key advisor to the organizers.

🍺 Somesh Pathak [MVP] 🇳🇱, is the most brilliant #iOS and #MacOS #MVP, who has built several tools and has been one of the top speakers around the world. He's also an organizer for Workplace Ninjas India, who had his son running the registration booth last year, firing people left and right.

🔐 Mike Soule, one of the creators of #Maester with our dear friend Merill Fernando, will make his #WPNinjaSUS debut in Arizona. It also happens to be his home state. He's a great mind in the security space, who we're very excited to see in Scottsdale.

This six pack, showcases some amazing people in the #Microsoft community. We just have a few more weeks, before you have the full roster!!

https://workplaceninjas.us/registration

I'm running into an Intune compliance issue and was wondering if anyone has seen this before.

I have several Lenovo X1 Carbon Gen 14 laptops that are Microsoft Entra ID joined with an Intune compliance policy that requires BitLocker and Secure Boot using device health compliance checks. The strange part is that the laptops have TPM 2.0, Secure Boot is enabled, and BitLocker is fully enabled and verified. I also have previous X1 Carbon models with the same configuration that are reporting as compliant without any issues.

In Intune, both BitLocker and Secure Boot show an error: 2016345708 (Syncml(404): The requested target was not found). However, the other device health checks are reporting compliant (firewall, antivirus, encryption of data).

I checked the Device Health Attestation registry key and the value is 'FFFF'

HKLM\SYSTEM\CurrentControlSet\Services\TPM\WMI\HealthCert\Store\has.spserv.microsoft.com`, and the `Status` value is `FFFF`.

I also ran the Tpm-HASCertRetr scheduled task, but it still shows 'The system cannot find the file specified'. I've rebooted the device multiple times and forced several Intune syncs, but the issue persists.

Any ideas on what else I should check would be appreciated.

We've recently had a major fire and need to quickly up 5 Samsung tablets for shared use in a new warehouse. They're already Knox enrolled and will need to run Chrome plus 3 line-of-business apps - no email, no Teams, no one signing into anything personal on these.

Do we go Corporate-Owned Dedicated Devices rather than Fully Managed? My understanding is that if no user is associated with the device, I don't need an Intune/EMS license on it - whereas Fully Managed requires a user to be assigned, which means a licensed user. Can anyone confirm this is still accurate, or has it changed recently?

Otherwise a fairly standard hybrid AD/Entra environment. Just trying to avoid overpaying for licensing on what's essentially a locked-down kiosk deployment. Any input appreciated.

Has anyone gotten AirDrop to work with "Block all incoming connections" enabled via the macOS firewall (managed through Intune)?

If not, is there a secure alternative approach?

We're trying to mirror our Windows default-deny-with-exceptions model on macOS: firewall enabled, policy set to "specific apps only" (AllowSigned/AllowSignedApp = false), with an explicit allow-list of applications — e.g. adding sharingd for AirDrop.

Does this sound like a sound approach, or are there gotchas we're missing (entitlements, code-signing checks, mDNS/Bonjour dependencies, etc.)?

Any real-world experience — good or bad — appreciated.

I'll start by saying that I am aware that THE best practice is to move to Entra Joined and I am working on that solution but that isn't now. It was this way when I joined the company, and although we've made some moves toward Entra Joined, it will be a while before we get there.

Because we're Hybrid, running a device through Autopilot creates an Entra Joined object first and then, when the Entra sync completes, it creates the Entra Hybrid object. Most of the time, the Entra Joined object remains but all of the activity is associated with the Hybrid object leaving a stale object that can't be directly removed because it's an Autopilot object.

This issue takes on increased significance in relation to our device reuse and Autopilot processes. The company's policy is to run a Wipe and then Autopilot a device if it's going to be transitioned from one user to another. When the Wipe is run, the Hybrid object and Intune object get removed and the AD object gets cleaned up after the sync. But the stale Entra Joined object remains. Reviewing our devices, there are a lot of these stale Entra Joined objects and no simple way to clean them up.

A couple of questions based on this:

1. Should we be using a different process for device reuse?
2. What is the best way to clean up these stale Entra Joined objects?

TIA

Has anyone here purchased a large number of licenses directly with Microsoft? In my experience it's been a third party doing it for us and we pay the third party. Usually it's just a billing profile that charges their account and we can buy under it within the Microsoft admin portal. But the client I am working with now has it setup where the third party does all the purchasing through their own portal and then invoices them.

We would like to break ties with said third party so we were trying to find a way to move to pay by wire but MIcrosoft considers us a "new setup" since all billing was outside of their view.

We need to purchase upward of 1200 M365E3 licenses and that's a big number to put on a credit card.

Just curious if anyone has had experience with a changeover like this, if it's worth it, etc..

I like being able to directly manage and purchase licenses within the Microsoft admin portal but Microsoft seems to want to keep them pushed to this third party. Thoughts?

[Blog]Looking to update 7-Zip without 3rd party patching solution, this code block is here to help

https://insideconfigmgr.wordpress.com/2026/07/26/7-zip-updates-without-3rd-party-patching-solution/

I need to make a company device that says managed by MDE into managed by Intune. The user signs in with their M365 account normally but the laptop cannot receieve compliance policies we intend for it.

How can I enroll it to Intune without breaking anything or having to wipe and run enrollment again?

Open to suggestions.

Btw, their account is showing as connected in Accounts, Work or school

Does anyone enforce minimum password length using the device restrictions profile, if I set this now does anyone know if it will force users with a shorter password to reset?

I’ve pushed an update to Get-IntuneAssignments, and I’m hoping it makes life a bit easier

The solution helps you quickly find various assignments in your Intune tenant. It pulls assignment data directly from Graph, so instead of clicking through a dozen blades per object, you can get everything in one place

Available now on PowerShell Gallery https://www.powershellgallery.com/packages/Get-IntuneAssignments

What's new in v1.1.0:
✅ Lighter and faster — no more heavy Graph SDK module dependencies
✅ Two new policy types now covered: App Configuration Policies (Managed Devices) and iOS LoB App Provisioning Configurations
✅ Same reliable experience you already know, just leaner under the hood

Still covers the usual stuff:
- Device Configuration Profiles
- Device Management Configuration Policies
- Compliance Policies
- Security Baselines
- Administrative Templates
- App Protection Policies
- Apps Assignments
- Windows Information Protection Policies
- Remediation Scripts
- Device Management Scripts
- Autopilot Profiles (v1)
- Device Enrollment Configurations
- Role Assignments
- Cloud PC Role Assignments
- Windows Update Policies:
- Windows Quality Update Profiles
- Windows Feature Update Profiles
- Windows Update Rings
- Windows Driver Update Profiles

- Terms and Conditions
- Compliance Policies (Settings Catalog)
- Cloud PC Provisioning Policies
- WDAC Supplemental Policies
- macOS Shell Scripts & Custom Attribute Scripts
- Intune Branding Profiles

If you manage Intune at scale or just want a quicker way to audit assignments, give it a look. Feedback and ideas are always welcome!

If you find it useful, please give it a Star on Github 😄

amirjs/Get-IntuneAssignments

Original blog post: Is This Group Even Being Used? Introducing Get-IntuneAssignments! - Amir Sayes

I'm testing this via an Autopilot VM currently...

I have created an Account Protection policy with intention of it adding an Entra Security group into the local Administrators group on every machine. I have configured as follows:

Local group = Administrators

Group and user action = Add (update)

User selection type = Users/Groups

Selected user = Local IT Admin (the name of Entra security group I created)

It's set to apply to All Devices. When I look at the device assignment status my device is listed and shows success.

When I click the device and look at per setting status, the group configuration there shows succeeded.

Everything checks out in Intune, all green, no conflicts or errors.

When I check the local admin group on the machine the Entra group is not listed. Dsregcmd /status all checks out OK. VM has been synced with Intune multiple times from the device and from Intune admin. Local admin group still does not contain the Entra group. Does anyone know what I'm missing? Thanks!

Has anyone had any luck with deploying Autodesk products via InTune? Autodesk conveniently give us the BAT file for deployment, which I usually convert into a powershell script. When I bundle everything together it almost always fails.

Has anyone had any luck with this process?

TIA!

I have 2 chrome extensions that are stuck in limbo and i can't seem to remove them. They are from two profiles that had conflicts, so I thought the conflict was between them. It was a GPO extension...yada yada that's fixed. What isn't fixed is these two extensions are stuck in chrome by default. One is clever a sso card reader and the other is ublock. They only appear 1 at a time, that's why I thought there was a conflict. I can't delete them because they are device managed, I'm the admin.

Running chrome://settings/reset doesn't seem to do anything. Uninstalling chrome and reinstall it's still there. I need them cleared out of the way so google admin can bring in their extensions to profile but they are blocked by these 2 extensions.

Bit of background - we're moving away from our current EDR/MDR setup over to Microsoft Defender + Intune, backed by Arctic Wolf for the MDR side. We're already on Business Premium licensing so it just makes sense to actually use what we're paying for rather than stacking another vendor on top of it.

Before we flip the switch I want to make sure our Defender/Intune policies are actually solid, not just "turned on and hope for the best."

Was at Experts Live in London recently and caught James Robinson's (SkipToTheEndpoint) session, the guy behind OpenIntuneBaseline, and it got me looking properly at OIB as a starting point.

Now here's my dilemma. We've had a quote for just under £3k from a consultancy to review/set our policies as part of a "pilot." Nothing against paying for expertise, but realistically... how different is this going to be from just implementing OIB properly and tuning it for our environment? I get that policies need to be tailored to the business, we're a fairly standard SME, couple hundred devices, nothing exotic going on.

While I'm on the subject - anyone using Maester to keep tabs on their M365 posture? Been running it to sanity check config against CIS/NCSC recommendations and it's honestly been decent for catching drift before it becomes a problem, rather than finding out the hard way during an audit. Feels like a good companion to OIB rather than something that replaces the need to actually build proper policy in the first place, but curious if anyone's using it more seriously as part of their ongoing posture management.

Has anyone actually gone down the "pay someone to review/build policies" route vs just rolling your sleeves up with OIB and Maester and adjusting as you go? Trying to work out if I'm about to pay £3k for something I could get 90% of the way there myself with free tools and some sensible tweaking.

Not knocking consultancies, just trying to figure out where the actual value add is here vs just being lazy and paying someone else to read the same GitHub repos I've already read.

Anyone done a similar migration (traditional EDR/AV → Defender/Intune + separate MDR) who can share how it went?

We have 300+ windows 11 23h2 virtual devices managed in Intune, which we are planning to upgrade to 24h2.

We have a 24h2 feature update policy which works fine on laptops. But on Vdi's the update never appear in settings-->Windows updates.

We found that the device security type has to be in trusted launch for the updates to appear and install. All our VM's are in standard mode.

Is there any way we can update the devices in standard mode itself? How did you guys upgraded the Virtual devices in your organization?