Hi everyone,
I have a few devices that, for some reason, are not installing Windows updates.
My organization uses Intune Windows Update rings to manage Windows updates, and the affected devices are already members of the correct Entra ID group.
Has anyone implemented an Intune remediation script to troubleshoot and resolve Windows Update issues on devices in this situation? I would appreciate any suggestions or recommendations.
Thank you.

Sorry for asking here. I just don't have a test unit now and just saw that macOS 27.2 is no longer a beta release.

But for those using Platform SSO (password) on Mac, is it working already on 27.2? There is no mention of it in the Apple Release Notes.

I got ABM and LAPS all working good.

Now I have PSSO in Secure Enclave mode as largely suggested but would like to move to Password mode.

Why? Because I want users to have the same password for everything (it's SSO in the end right?).

1) Why is Secure Enclave suggested over Password mode ? I hear about better passkey management via biometrics access methods, is it true ?

2) I'm struggling to have a matching password complexity rule on both local mac user and azure account. By default mac consider double chars and sequential numbers as weak, while azure does not.
Has anyone shared a 100% working configuration for both ?

Hello everyone, Does anybody have a solution for the following situation?

Our setup:

• Windows 11 Pro shared devices, Entra joined via bulk enrollment (provisioning package, package_ account)
• Intune device license for the shared devices; users have no Intune license (Office 365 F3)
• All policies/apps are assigned to device groups only

Problem:

• As soon as an unlicensed user is signed in, MDM sync fails.
  • Manual sync from Settings returns 0x80190190 (400).
  • In the event logs - event 201 in DeviceManagement-Enterprise-Diagnostics-Provider/Sync shows 'Forbidden (403)' with the signed-in user as account.
• Sync from the Intune portal doesn’t help either.
• Last check-in in Intune stays stuck until a user with an Intune license signs in, then it syncs instantly.

According to Microsoft’s docs, users on devices with a device license shouldn’t need their own Intune license... If anyone else is familiar with this situation, how did you get the devices to sync? Any help is much appreciated. Thank you.

Hi all,

I'm interested in how other organisations are provisioning corporate iPhones using Apple Business Manager/ADE and Intune, particularly around Apple IDs, Company Portal and automated app deployment.

Our current process is roughly:

1. Factory reset the corporate iPhone.
2. Go through Setup Assistant and Automated Device Enrollment.
3. The iPhone recognises that it belongs to our organisation and installs the Intune MDM management profile.
4. We ask the user to create an Apple ID using their company email address and sign into it on the corporate iPhone.
5. Company Portal is installed and the user signs into it with their corporate Microsoft account.
6. The device completes registration/compliance.
7. The user then installs/receives the apps they need.

The Apple ID requirement is the part I'm trying to improve.

Creating an Apple ID with the user's company email adds extra steps to every new starter setup. It also creates additional offboarding work because when somebody leaves or returns their phone, we need to make sure they sign out of the Apple ID/Find My before the device is erased and reissued, otherwise we potentially have Activation Lock to deal with.

Our existing ADE profile is configured with:

• Enroll with User Affinity
• Authentication Method: Company Portal
• Install Company Portal with VPP: Don't use VPP

I'm wondering how organisations using a more modern Intune/ADE configuration handle this.

Ideally I'd like our provisioning experience to be:

Turn on corporate iPhone → Automated Device Enrollment → Intune manages the device → required apps automatically install → user authenticates using their corporate Microsoft account → device becomes compliant → Outlook, Teams and other required corporate apps are automatically deployed.

Ideally there would be no requirement to create an Apple ID just to provision and use the corporate device.

We also use third-party apps such as Workday, Eptura etc, so ideally these could be deployed automatically as required managed apps as well.

For those managing corporate iPhones at scale:

Are you deploying Company Portal and your standard corporate apps through Apple Business Manager Apps and Books/VPP using device-based licensing, so users don't need an Apple ID?

Are you still using Company Portal authentication with ADE, or have you moved to Setup Assistant with modern authentication / the newer Intune Apple enrollment policies?

Do your users need an Apple ID at all during initial corporate iPhone provisioning?

And are you automatically deploying apps such as Outlook, Teams and third-party business apps so that the phone is essentially ready for the employee once they've authenticated?

I'd be really interested to hear what other organisations' end-to-end new starter and device-reassignment processes look like. I'm trying to make ours much smoother for both Service Desk and the end user.

I’m the only IT person at a construction company. We’ve got a bit over 100 iPhones and a lot of turnover, so phones get wiped and handed to the next person all the time.

What I’m trying to get to:

- Company contacts in the phone’s native contacts so caller ID works on regular calls
- New phones get the list without me setting each one up by hand
- Owner and exec cell numbers don’t end up on every phone in the company

We’re on Intune. Hiding the execs from the GAL completely isn’t an option, people still need to email them. I just don’t want their cell numbers on every field guy’s phone.

Has anyone set this up with Intune? Is it doable natively or did you need something on top?

Hi everyone,

I'm wondering if anyone else has experienced a similar issue with Microsoft Entra ID Conditional Access policies and whether there's a known solution.

I recently configured a Conditional Access policy called "AppProtection" in Entra ID. Everything worked perfectly for the first few days, but then I noticed that the policy started blocking certain Microsoft applications, including Microsoft Forms, Microsoft Authenticator, and other apps that use Microsoft Graph as a resource.

An important detail: Our Conditional Access policies are user-based, not device-based. They are assigned to users rather than specific devices.

Here's what I've tried and noticed so far:

1. I excluded Microsoft Forms, Microsoft Authenticator, and the other affected applications from the Conditional Access policy, but the issue still persists.

2. I read that excluding the applications themselves might not be enough and that their underlying resource (Microsoft Graph) also needs to be excluded.

3. However, Microsoft Graph isn't supported as a selectable resource in Entra ID Conditional Access, so I can't exclude it from the policy.

4. I've come across discussions from other people experiencing similar issues, but I haven't found a working solution yet.

The strange part is that this only happens on Android and iOS devices, and only in certain scenarios.

For example:

1. Microsoft Forms / SharePoint

When an employee opens a link through the SharePoint mobile app that redirects to Microsoft Forms, access gets blocked by the Conditional Access policy.

However, if the employee copies the exact same link and opens it directly in Microsoft Edge, everything works without any issues.

1. Microsoft Authenticator / Passkey Registration

When I try to register a passkey for an employee using Microsoft Authenticator, the process fails with an error that essentially says:

"You can't get there from here"

My questions are:

1. Is there a way to exclude Microsoft Graph as a resource, or is there another recommended workaround?
2. Is there a way to resolve this without disabling the AppProtection policy entirely?

I'd really appreciate any suggestions or experiences from others who have dealt with this.

Thanks in advance!

Hi everyone

I'm curious to know how everyone manages Edge updates or just browser updates in general across their endpoints? Do you just use the built in updater in the browser or use a third party solution like PMPC/Robopack or PDQ?

I know some of the third party options once used will block the built in updater so just want to find the best way before making any changes across the environment. Currently edge updates itself via the in built updater for us.

Appreciate any advice

Thank you

Getting the notifications in Defender portal under Remediations. Seems the Defender service has a tamper proof feature that may be preventing a fix ?

As I test Autopilot for my org, I've noticed that after 3-4 times of wiping the device to start over, the wipe command no longer works and trying to reset the device gives a generic "there was an issue". Ive been using a recovery USB when this happens but no even that seems to just not want to work.

So I guess I should try to figure out the main problem which is why does recovery fail after a few cycles and how would one fix it?

I don't anticipate having to wipe a single device a bunch of times in production but you never know in today's economy

I have been going crazy trying to find a way to search for device records in Intune using the recorded IMEI number. All google searches and AI responses tell me to enter the IMEI with or without {} to find a match. No results found.

I tried to use the Graph tool but the sample search snips did not return any device information. The Filter options do not include the IMEI field.

My carrier (Verizon) only reports devices by IMEI and we are typing to lookup the correct device record in Intune to ensure correct user assignment. The devices are registered using the Serial Number in the name.

Intune does report IMEI under the device properties, System Enclosure section. I just need to know how to query that value.

Any suggestions?

Not sure if I am going crazy but I cannot find the VPP tokens under Settings -> Payments & Billings -> Apps and Books in ABM.

I ended up going to Organizational Units and selecting my OU -> Content Token -> “Download”.

Did something change?

Untill now enrolling IOS devices worked like a charm. Bought a new iPhone 18 Pro (IOS 27.0.1) and trying to enroll the phone now. I've entered my company credentials but can't get past configuring iPhone screen.

In Intune under enrollment program token i see the device, state enrolled, contacted never. Still in Intune under Apple Mobile devices i see the new device, with what seems like a temporary name. There is no Entra device assigned. It doesn't get any further than this and the configuring iPhone screen is endlessly shown.

My company account is no different from any other user. Anyone else experiencing issues enrolling IOS devices?

https://imgur.com/a/KcOTbqI

Looking for the best option for getting these MacBooks enrolled into intune so that we can apply a CA policy allowing only compliant devices access. I have looked into the intunemacadmins.com page (very helpful) but it only shows for a fresh set up. Will I need to do that? Will having the Mac’s install company portal and signing in be enough? Rather new to the Mac side of things so any help is appreciated!

At what point is a device completely removed from Intune? Would it be once it's deleted out of devices and windows autopilot devices?

I ask because I want to donate a stack of laptops to a local charter school but I don't want them to show up in our tenant.

We were previously using this policy to control the default store apps on Windows 11 devices, and then a few months back it broke (I think it was due to local ADMX & Settings catalog conflict) & swapped to using a custom OMA URI to set the settings successfully.

I see there is now also a "Remove Microsoft Store Apps with Dynamic List" in the settings catalog.. Does this fix the previous conflict and now work correctly?

If so, should we be setting both policy options? Or only the new option?

And do I need to do anything with the custom OMA URI settings to clear that out or just unassigning is enough?

Hi all

I am planning on migrating the updates within intune from WUfB to Autopatch.

I'm going to create a group for assigning the devices to Autopatch and exclude the same group from all the Rings in WUfB. But I can't find any useful information on how to tell if the update on the client is received from Autopatch or from the "old" configuration from WUfB. As far as I understand, the updates from Autopatch also use the "technology" of WUfB. Is there a smart way to tell the difference?

Hey All,

Going to MMS in San Diego. It’s my first IT conference. Anyone else have any experience with their events. Anything I should check out in SD while I’m there?

Thanks

I’m hoping to get some direction here. Working on a non-autopilot enrollment for a single Windows 11 device. This device has been imaged with our standard business image. Pretty basic here. I’m attempting a join through ‘Add work or school account’ and going through entra using a DEM account I created. All goes well. I can reboot just fine. Once I log on with a user (hybrid standard user) when I reboot after that, I’m failing and sitting at the dell secure bios screen.

Things I’ve tried:
Removed all policies and configurations from applying to this user
Rebuilt boot in windows RE
No bit locker is being used
Others I cannot think of.
Intune is pretty base right now

If anyone has any direction whatsoever I would appreciate it!

Windows Production PCA 2011 (the cert that signs the Windows boot manager) expired on 19 Oct; KEK CA 2011 and UEFI CA 2011 already went in June. Devices still boot, but they stop getting new boot-chain fixes (boot manager updates, DBX revocations) until they trust Windows UEFI CA 2023.

Quick check (admin PowerShell):

[System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023'

And HKLM\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing\UEFICA2023Status should end at "Updated".

I wrote up the full steps (firmware first, AvailableUpdates = 0x5944, events 1808/1797/1798) plus a detection/remediation pair for Intune Remediations, and how to avoid BitLocker recovery while doing it:

https://wk-hub-4e2.pages.dev/secure-boot-certificates-expire-2026

Pilot per hardware model – curious what failure rates others are seeing on older firmware.

Bare Metal OS install automatically encrypts disk, which prevents bit locker configuration from Intune for full disk encryption to fail.I have noted the same in 24h2 onwards. Is there a way we can prevent auto encryption of used space during bare metal os install so that later it can pick up the configuration from Intune.

Device hybrid joined to local ad and managed through Intune. Windows hello policy allowed for the device from policy in Intune.

Issue being seen, when setting up windows hello, a passkey is created however passkey isn’t fed to M365 account so if we then go into the mysignins and security info section and try create a passkey it already states device is registered but no passkey is within the authentication methods of that user.

Anyone know how we get that passkey that is created as part of windows hello to go to their authentication methods when they register it.

Powefull tool for deploying win32 apps in Intune.

It takes you through the whole process, including possibility for testing the app in Windows Sandbox.

https://www.reddit.com/r/Intune/s/wm96AcjVJo