Does anyone have any method to disabled store results in Windows 11 search? e.g. search for 'snip' and it shows 'Sniper Fury', which is not exactly suitable in an Enterprise environment (thanks Microsoft). It also causes issues when the store is blocked, since people find apps that look like they are installed, then it just says the store is blocked.

There is no item in Settings Catlog for this that I can find.

The registry key is HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows\Explorer\DisableSearchBoxSuggestions, however since it is in Policies I've not found a way of setting this using a script.

Help.

Thanks

Sorry for asking here. I just don't have a test unit now and just saw that macOS 27.2 is no longer a beta release.

But for those using Platform SSO (password) on Mac, is it working already on 27.2? There is no mention of it in the Apple Release Notes.

They seem to not actually install, but Company Portal reports almost immediately that the app is installed successfully. No toast notifications or anything, I've seen it this morning with 2 Microsoft Store applications we deploy. Not sure yet if it's also win32 apps.

We currently have our Intune device cleanup rule set to 180 days and are considering reducing it to 90 days.

Our main concern is users on maternity/long-term leave whose laptops may remain switched off for more than 90 days. My understanding is that the cleanup rule only hides the stale Intune record rather than wiping/retiring the device, and it can reappear if the device checks in again before its management certificate expires.

What process do others use for long-term leave devices? Do you just allow them to be cleaned up and check/re-enrol them when the user returns, or do you handle these devices differently? The challenge is these users are remote

Hi everyone,
I have a few devices that, for some reason, are not installing Windows updates.
My organization uses Intune Windows Update rings to manage Windows updates, and the affected devices are already members of the correct Entra ID group.
Has anyone implemented an Intune remediation script to troubleshoot and resolve Windows Update issues on devices in this situation? I would appreciate any suggestions or recommendations.
Thank you.

For the concept:

The way we join the laptop to our company domain is adding it to the Active Roles then change domain of the unit then run the SCCM. After it syncs the policy then it will become compliant to Intune

My question now is:

How to clean up a laptop that is not powering on? How to make it not viewable to Intune (if we only have view access) . We have some cases that it still viewable in Intune but only tagged as non-compliant but the device is due for disposal coz its not powering on.

Need some of your inputs. Thanks

I’ve ticked use web sign on

Comes up with hello mfa methods only then fails to connect (guess as you need a cert for whfb to work over rdp)

Created a dns record with the hostname.

I can ping machine via hostname.

Rdp port 3889 is enabled and allowed on firewall.

I have added user to rdp allow list and can telnet to 3889.

I can rdp by unticking “require device to use network authentication to connect” but ideally don’t want to do this.

Entra joined only, built using autopilot the machine.

Any ideas how to get rdp to work?

Hey everyone,

We're having a strange issue with our Intune-managed iPads(A16 gen.11).

We have emergency lighting control units that provide their own WiFi networks. Our technicians connect to these units using an in-house developed app, either by scanning a QR code or manually entering the WiFi credentials.

The problem is that Intune-enrolled iPads fail to connect with "Unable to join the network". Even connecting manually through the iPadOS WiFi settings doesn't work.

What we've tested so far:

• Same iPad without Intune enrollment connects perfectly fine.
• Enrolled iPads connect to other WiFi networks without issues.
• Intune-enrolled iPhones(iPhone SE 3.gen) using the same enrollment profile can connect to these control units without any issues.
• No device restrictions or WiFi configuration profiles assigned to the affected iPads.
• Tried all Private WiFi Address settings, no difference.
• Devices are enrolled through ADE with user affinity, supervision and locked enrollment.

Has anyone run into something similar? The fact that the exact same iPad works without enrollment, while enrolled iPhones work just fine, makes me think it's somehow MDM-related. I'm running out of ideas.

I got ABM and LAPS all working good.

Now I have PSSO in Secure Enclave mode as largely suggested but would like to move to Password mode.

Why? Because I want users to have the same password for everything (it's SSO in the end right?).

1) Why is Secure Enclave suggested over Password mode ? I hear about better passkey management via biometrics access methods, is it true ?

2) I'm struggling to have a matching password complexity rule on both local mac user and azure account. By default mac consider double chars and sequential numbers as weak, while azure does not.
Has anyone shared a 100% working configuration for both ?

Hello everyone, Does anybody have a solution for the following situation?

Our setup:

• Windows 11 Pro shared devices, Entra joined via bulk enrollment (provisioning package, package_ account)
• Intune device license for the shared devices; users have no Intune license (Office 365 F3)
• All policies/apps are assigned to device groups only

Problem:

• As soon as an unlicensed user is signed in, MDM sync fails.
  • Manual sync from Settings returns 0x80190190 (400).
  • In the event logs - event 201 in DeviceManagement-Enterprise-Diagnostics-Provider/Sync shows 'Forbidden (403)' with the signed-in user as account.
• Sync from the Intune portal doesn’t help either.
• Last check-in in Intune stays stuck until a user with an Intune license signs in, then it syncs instantly.

According to Microsoft’s docs, users on devices with a device license shouldn’t need their own Intune license... If anyone else is familiar with this situation, how did you get the devices to sync? Any help is much appreciated. Thank you.

Hi all,

I'm interested in how other organisations are provisioning corporate iPhones using Apple Business Manager/ADE and Intune, particularly around Apple IDs, Company Portal and automated app deployment.

Our current process is roughly:

1. Factory reset the corporate iPhone.
2. Go through Setup Assistant and Automated Device Enrollment.
3. The iPhone recognises that it belongs to our organisation and installs the Intune MDM management profile.
4. We ask the user to create an Apple ID using their company email address and sign into it on the corporate iPhone.
5. Company Portal is installed and the user signs into it with their corporate Microsoft account.
6. The device completes registration/compliance.
7. The user then installs/receives the apps they need.

The Apple ID requirement is the part I'm trying to improve.

Creating an Apple ID with the user's company email adds extra steps to every new starter setup. It also creates additional offboarding work because when somebody leaves or returns their phone, we need to make sure they sign out of the Apple ID/Find My before the device is erased and reissued, otherwise we potentially have Activation Lock to deal with.

Our existing ADE profile is configured with:

• Enroll with User Affinity
• Authentication Method: Company Portal
• Install Company Portal with VPP: Don't use VPP

I'm wondering how organisations using a more modern Intune/ADE configuration handle this.

Ideally I'd like our provisioning experience to be:

Turn on corporate iPhone → Automated Device Enrollment → Intune manages the device → required apps automatically install → user authenticates using their corporate Microsoft account → device becomes compliant → Outlook, Teams and other required corporate apps are automatically deployed.

Ideally there would be no requirement to create an Apple ID just to provision and use the corporate device.

We also use third-party apps such as Workday, Eptura etc, so ideally these could be deployed automatically as required managed apps as well.

For those managing corporate iPhones at scale:

Are you deploying Company Portal and your standard corporate apps through Apple Business Manager Apps and Books/VPP using device-based licensing, so users don't need an Apple ID?

Are you still using Company Portal authentication with ADE, or have you moved to Setup Assistant with modern authentication / the newer Intune Apple enrollment policies?

Do your users need an Apple ID at all during initial corporate iPhone provisioning?

And are you automatically deploying apps such as Outlook, Teams and third-party business apps so that the phone is essentially ready for the employee once they've authenticated?

I'd be really interested to hear what other organisations' end-to-end new starter and device-reassignment processes look like. I'm trying to make ours much smoother for both Service Desk and the end user.

I’m the only IT person at a construction company. We’ve got a bit over 100 iPhones and a lot of turnover, so phones get wiped and handed to the next person all the time.

What I’m trying to get to:

- Company contacts in the phone’s native contacts so caller ID works on regular calls
- New phones get the list without me setting each one up by hand
- Owner and exec cell numbers don’t end up on every phone in the company

We’re on Intune. Hiding the execs from the GAL completely isn’t an option, people still need to email them. I just don’t want their cell numbers on every field guy’s phone.

Has anyone set this up with Intune? Is it doable natively or did you need something on top?

Hi everyone,

I'm wondering if anyone else has experienced a similar issue with Microsoft Entra ID Conditional Access policies and whether there's a known solution.

I recently configured a Conditional Access policy called "AppProtection" in Entra ID. Everything worked perfectly for the first few days, but then I noticed that the policy started blocking certain Microsoft applications, including Microsoft Forms, Microsoft Authenticator, and other apps that use Microsoft Graph as a resource.

An important detail: Our Conditional Access policies are user-based, not device-based. They are assigned to users rather than specific devices.

Here's what I've tried and noticed so far:

1. I excluded Microsoft Forms, Microsoft Authenticator, and the other affected applications from the Conditional Access policy, but the issue still persists.

2. I read that excluding the applications themselves might not be enough and that their underlying resource (Microsoft Graph) also needs to be excluded.

3. However, Microsoft Graph isn't supported as a selectable resource in Entra ID Conditional Access, so I can't exclude it from the policy.

4. I've come across discussions from other people experiencing similar issues, but I haven't found a working solution yet.

The strange part is that this only happens on Android and iOS devices, and only in certain scenarios.

For example:

1. Microsoft Forms / SharePoint

When an employee opens a link through the SharePoint mobile app that redirects to Microsoft Forms, access gets blocked by the Conditional Access policy.

However, if the employee copies the exact same link and opens it directly in Microsoft Edge, everything works without any issues.

1. Microsoft Authenticator / Passkey Registration

When I try to register a passkey for an employee using Microsoft Authenticator, the process fails with an error that essentially says:

"You can't get there from here"

My questions are:

1. Is there a way to exclude Microsoft Graph as a resource, or is there another recommended workaround?
2. Is there a way to resolve this without disabling the AppProtection policy entirely?

I'd really appreciate any suggestions or experiences from others who have dealt with this.

Thanks in advance!

Hi everyone

I'm curious to know how everyone manages Edge updates or just browser updates in general across their endpoints? Do you just use the built in updater in the browser or use a third party solution like PMPC/Robopack or PDQ?

I know some of the third party options once used will block the built in updater so just want to find the best way before making any changes across the environment. Currently edge updates itself via the in built updater for us.

Appreciate any advice

Thank you

Getting the notifications in Defender portal under Remediations. Seems the Defender service has a tamper proof feature that may be preventing a fix ?

As I test Autopilot for my org, I've noticed that after 3-4 times of wiping the device to start over, the wipe command no longer works and trying to reset the device gives a generic "there was an issue". Ive been using a recovery USB when this happens but no even that seems to just not want to work.

So I guess I should try to figure out the main problem which is why does recovery fail after a few cycles and how would one fix it?

I don't anticipate having to wipe a single device a bunch of times in production but you never know in today's economy

I have been going crazy trying to find a way to search for device records in Intune using the recorded IMEI number. All google searches and AI responses tell me to enter the IMEI with or without {} to find a match. No results found.

I tried to use the Graph tool but the sample search snips did not return any device information. The Filter options do not include the IMEI field.

My carrier (Verizon) only reports devices by IMEI and we are typing to lookup the correct device record in Intune to ensure correct user assignment. The devices are registered using the Serial Number in the name.

Intune does report IMEI under the device properties, System Enclosure section. I just need to know how to query that value.

Any suggestions?

Not sure if I am going crazy but I cannot find the VPP tokens under Settings -> Payments & Billings -> Apps and Books in ABM.

I ended up going to Organizational Units and selecting my OU -> Content Token -> “Download”.

Did something change?

Untill now enrolling IOS devices worked like a charm. Bought a new iPhone 18 Pro (IOS 27.0.1) and trying to enroll the phone now. I've entered my company credentials but can't get past configuring iPhone screen.

In Intune under enrollment program token i see the device, state enrolled, contacted never. Still in Intune under Apple Mobile devices i see the new device, with what seems like a temporary name. There is no Entra device assigned. It doesn't get any further than this and the configuring iPhone screen is endlessly shown.

My company account is no different from any other user. Anyone else experiencing issues enrolling IOS devices?

https://imgur.com/a/KcOTbqI

Looking for the best option for getting these MacBooks enrolled into intune so that we can apply a CA policy allowing only compliant devices access. I have looked into the intunemacadmins.com page (very helpful) but it only shows for a fresh set up. Will I need to do that? Will having the Mac’s install company portal and signing in be enough? Rather new to the Mac side of things so any help is appreciated!

At what point is a device completely removed from Intune? Would it be once it's deleted out of devices and windows autopilot devices?

I ask because I want to donate a stack of laptops to a local charter school but I don't want them to show up in our tenant.

We were previously using this policy to control the default store apps on Windows 11 devices, and then a few months back it broke (I think it was due to local ADMX & Settings catalog conflict) & swapped to using a custom OMA URI to set the settings successfully.

I see there is now also a "Remove Microsoft Store Apps with Dynamic List" in the settings catalog.. Does this fix the previous conflict and now work correctly?

If so, should we be setting both policy options? Or only the new option?

And do I need to do anything with the custom OMA URI settings to clear that out or just unassigning is enough?

Hi all

I am planning on migrating the updates within intune from WUfB to Autopatch.

I'm going to create a group for assigning the devices to Autopatch and exclude the same group from all the Rings in WUfB. But I can't find any useful information on how to tell if the update on the client is received from Autopatch or from the "old" configuration from WUfB. As far as I understand, the updates from Autopatch also use the "technology" of WUfB. Is there a smart way to tell the difference?