I’ve ticked use web sign on

Comes up with hello mfa methods only then fails to connect (guess as you need a cert for whfb to work over rdp)

Created a dns record with the hostname.

I can ping machine via hostname.

Rdp port 3889 is enabled and allowed on firewall.

I have added user to rdp allow list and can telnet to 3889.

I can rdp by unticking “require device to use network authentication to connect” but ideally don’t want to do this.

Entra joined only, built using autopilot the machine.

Any ideas how to get rdp to work?

I got ABM and LAPS all working good.

Now I have PSSO in Secure Enclave mode as largely suggested but would like to move to Password mode.

Why? Because I want users to have the same password for everything (it's SSO in the end right?).

1) Why is Secure Enclave suggested over Password mode ? I hear about better passkey management via biometrics access methods, is it true ?

2) I'm struggling to have a matching password complexity rule on both local mac user and azure account. By default mac consider double chars and sequential numbers as weak, while azure does not.
Has anyone shared a 100% working configuration for both ?

For the concept:

The way we join the laptop to our company domain is adding it to the Active Roles then change domain of the unit then run the SCCM. After it syncs the policy then it will become compliant to Intune

My question now is:

How to clean up a laptop that is not powering on? How to make it not viewable to Intune (if we only have view access) . We have some cases that it still viewable in Intune but only tagged as non-compliant but the device is due for disposal coz its not powering on.

Need some of your inputs. Thanks

We currently have our Intune device cleanup rule set to 180 days and are considering reducing it to 90 days.

Our main concern is users on maternity/long-term leave whose laptops may remain switched off for more than 90 days. My understanding is that the cleanup rule only hides the stale Intune record rather than wiping/retiring the device, and it can reappear if the device checks in again before its management certificate expires.

What process do others use for long-term leave devices? Do you just allow them to be cleaned up and check/re-enrol them when the user returns, or do you handle these devices differently? The challenge is these users are remote

We have about 900 laptops and a lot of them have lost your wifi due to this update. The issue is we can't push a fix when the device has no connectivity, so we end up having to visit a lot of devices.

If you use AutoPatch how are you handling the mess this update is causing?

Does anyone have any method to disabled store results in Windows 11 search? e.g. search for 'snip' and it shows 'Sniper Fury', which is not exactly suitable in an Enterprise environment (thanks Microsoft). It also causes issues when the store is blocked, since people find apps that look like they are installed, then it just says the store is blocked.

There is no item in Settings Catlog for this that I can find.

The registry key is HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows\Explorer\DisableSearchBoxSuggestions, however since it is in Policies I've not found a way of setting this using a script.

Help.

Thanks

Just seen the email and read the link. Very excited to see what this will turn into...

I wonder if it will be a Cloud or on Prem focussed product? Either way, both companies have some epic people, with lots of experience so I have very high hopes.

Looking forward to hearing more!

Announcement:

"Today at MMS Midway in San Diego, Patch My PC and 2Pint Software announced that they are teaming up to bring our customers a unified approach to provisioning, deployment and ongoing endpoint management.

This technology partnership will bring operating systems, applications, drivers, configuration and deployment visibility together into one solution.

With Patch My PC's curated catalog and 2Pint's deployment and imaging technology, it's never been easier for large enterprises
with complex environments to take machines from factory settings to work-ready."

Patch My PC Partners with 2Pint Software to Simplify Windows Deployment and Application Management

Hi everyone,
We have around 250 non-compliant devices in Microsoft Intune, and I’m looking for the most efficient way to investigate and remediate them in bulk.
I’d like to:
Export all non-compliant devices and their specific compliance failure reasons.
Identify whether the issue is caused by the same policy or setting across multiple devices.
Remediate common issues in bulk instead of opening each device individually.
Trigger device syncs in bulk if possible.
What is your recommended approach? Would you use Intune reports, Microsoft Graph PowerShell, or another method?
The devices are windows,iOS,Mac
I’d appreciate any practical experience, scripts, or best practices. Thanks!

They seem to not actually install, but Company Portal reports almost immediately that the app is installed successfully. No toast notifications or anything, I've seen it this morning with 2 Microsoft Store applications we deploy. Not sure yet if it's also win32 apps.

Hey everyone,

We're having a strange issue with our Intune-managed iPads(A16 gen.11).

We have emergency lighting control units that provide their own WiFi networks. Our technicians connect to these units using an in-house developed app, either by scanning a QR code or manually entering the WiFi credentials.

The problem is that Intune-enrolled iPads fail to connect with "Unable to join the network". Even connecting manually through the iPadOS WiFi settings doesn't work.

What we've tested so far:

• Same iPad without Intune enrollment connects perfectly fine.
• Enrolled iPads connect to other WiFi networks without issues.
• Intune-enrolled iPhones(iPhone SE 3.gen) using the same enrollment profile can connect to these control units without any issues.
• No device restrictions or WiFi configuration profiles assigned to the affected iPads.
• Tried all Private WiFi Address settings, no difference.
• Devices are enrolled through ADE with user affinity, supervision and locked enrollment.

Has anyone run into something similar? The fact that the exact same iPad works without enrollment, while enrolled iPhones work just fine, makes me think it's somehow MDM-related. I'm running out of ideas.

Hello everyone, Does anybody have a solution for the following situation?

Our setup:

• Windows 11 Pro shared devices, Entra joined via bulk enrollment (provisioning package, package_ account)
• Intune device license for the shared devices; users have no Intune license (Office 365 F3)
• All policies/apps are assigned to device groups only

Problem:

• As soon as an unlicensed user is signed in, MDM sync fails.
  • Manual sync from Settings returns 0x80190190 (400).
  • In the event logs - event 201 in DeviceManagement-Enterprise-Diagnostics-Provider/Sync shows 'Forbidden (403)' with the signed-in user as account.
• Sync from the Intune portal doesn’t help either.
• Last check-in in Intune stays stuck until a user with an Intune license signs in, then it syncs instantly.

According to Microsoft’s docs, users on devices with a device license shouldn’t need their own Intune license... If anyone else is familiar with this situation, how did you get the devices to sync? Any help is much appreciated. Thank you.

Sorry for asking here. I just don't have a test unit now and just saw that macOS 27.2 is no longer a beta release.

But for those using Platform SSO (password) on Mac, is it working already on 27.2? There is no mention of it in the Apple Release Notes.

Hi everyone,
I have a few devices that, for some reason, are not installing Windows updates.
My organization uses Intune Windows Update rings to manage Windows updates, and the affected devices are already members of the correct Entra ID group.
Has anyone implemented an Intune remediation script to troubleshoot and resolve Windows Update issues on devices in this situation? I would appreciate any suggestions or recommendations.
Thank you.

Hi everyone,

I'm wondering if anyone else has experienced a similar issue with Microsoft Entra ID Conditional Access policies and whether there's a known solution.

I recently configured a Conditional Access policy called "AppProtection" in Entra ID. Everything worked perfectly for the first few days, but then I noticed that the policy started blocking certain Microsoft applications, including Microsoft Forms, Microsoft Authenticator, and other apps that use Microsoft Graph as a resource.

An important detail: Our Conditional Access policies are user-based, not device-based. They are assigned to users rather than specific devices.

Here's what I've tried and noticed so far:

1. I excluded Microsoft Forms, Microsoft Authenticator, and the other affected applications from the Conditional Access policy, but the issue still persists.

2. I read that excluding the applications themselves might not be enough and that their underlying resource (Microsoft Graph) also needs to be excluded.

3. However, Microsoft Graph isn't supported as a selectable resource in Entra ID Conditional Access, so I can't exclude it from the policy.

4. I've come across discussions from other people experiencing similar issues, but I haven't found a working solution yet.

The strange part is that this only happens on Android and iOS devices, and only in certain scenarios.

For example:

1. Microsoft Forms / SharePoint

When an employee opens a link through the SharePoint mobile app that redirects to Microsoft Forms, access gets blocked by the Conditional Access policy.

However, if the employee copies the exact same link and opens it directly in Microsoft Edge, everything works without any issues.

1. Microsoft Authenticator / Passkey Registration

When I try to register a passkey for an employee using Microsoft Authenticator, the process fails with an error that essentially says:

"You can't get there from here"

My questions are:

1. Is there a way to exclude Microsoft Graph as a resource, or is there another recommended workaround?
2. Is there a way to resolve this without disabling the AppProtection policy entirely?

I'd really appreciate any suggestions or experiences from others who have dealt with this.

Thanks in advance!