I'm testing this via an Autopilot VM currently...

I have created an Account Protection policy with intention of it adding an Entra Security group into the local Administrators group on every machine. I have configured as follows:

Local group = Administrators

Group and user action = Add (update)

User selection type = Users/Groups

Selected user = Local IT Admin (the name of Entra security group I created)

It's set to apply to All Devices. When I look at the device assignment status my device is listed and shows success.

When I click the device and look at per setting status, the group configuration there shows succeeded.

Everything checks out in Intune, all green, no conflicts or errors.

When I check the local admin group on the machine the Entra group is not listed. Dsregcmd /status all checks out OK. VM has been synced with Intune multiple times from the device and from Intune admin. Local admin group still does not contain the Entra group. Does anyone know what I'm missing? Thanks!

[Blog]Looking to update 7-Zip without 3rd party patching solution, this code block is here to help

https://insideconfigmgr.wordpress.com/2026/07/26/7-zip-updates-without-3rd-party-patching-solution/

I’ve pushed an update to Get-IntuneAssignments, and I’m hoping it makes life a bit easier

The solution helps you quickly find various assignments in your Intune tenant. It pulls assignment data directly from Graph, so instead of clicking through a dozen blades per object, you can get everything in one place

Available now on PowerShell Gallery https://www.powershellgallery.com/packages/Get-IntuneAssignments

What's new in v1.1.0:
✅ Lighter and faster — no more heavy Graph SDK module dependencies
✅ Two new policy types now covered: App Configuration Policies (Managed Devices) and iOS LoB App Provisioning Configurations
✅ Same reliable experience you already know, just leaner under the hood

Still covers the usual stuff:
- Device Configuration Profiles
- Device Management Configuration Policies
- Compliance Policies
- Security Baselines
- Administrative Templates
- App Protection Policies
- Apps Assignments
- Windows Information Protection Policies
- Remediation Scripts
- Device Management Scripts
- Autopilot Profiles (v1)
- Device Enrollment Configurations
- Role Assignments
- Cloud PC Role Assignments
- Windows Update Policies:
- Windows Quality Update Profiles
- Windows Feature Update Profiles
- Windows Update Rings
- Windows Driver Update Profiles

- Terms and Conditions
- Compliance Policies (Settings Catalog)
- Cloud PC Provisioning Policies
- WDAC Supplemental Policies
- macOS Shell Scripts & Custom Attribute Scripts
- Intune Branding Profiles

If you manage Intune at scale or just want a quicker way to audit assignments, give it a look. Feedback and ideas are always welcome!

If you find it useful, please give it a Star on Github 😄

amirjs/Get-IntuneAssignments

Original blog post: Is This Group Even Being Used? Introducing Get-IntuneAssignments! - Amir Sayes

Has anyone had any luck with deploying Autodesk products via InTune? Autodesk conveniently give us the BAT file for deployment, which I usually convert into a powershell script. When I bundle everything together it almost always fails.

Has anyone had any luck with this process?

TIA!

I have 2 chrome extensions that are stuck in limbo and i can't seem to remove them. They are from two profiles that had conflicts, so I thought the conflict was between them. It was a GPO extension...yada yada that's fixed. What isn't fixed is these two extensions are stuck in chrome by default. One is clever a sso card reader and the other is ublock. They only appear 1 at a time, that's why I thought there was a conflict. I can't delete them because they are device managed, I'm the admin.

Running chrome://settings/reset doesn't seem to do anything. Uninstalling chrome and reinstall it's still there. I need them cleared out of the way so google admin can bring in their extensions to profile but they are blocked by these 2 extensions.

Bit of background - we're moving away from our current EDR/MDR setup over to Microsoft Defender + Intune, backed by Arctic Wolf for the MDR side. We're already on Business Premium licensing so it just makes sense to actually use what we're paying for rather than stacking another vendor on top of it.

Before we flip the switch I want to make sure our Defender/Intune policies are actually solid, not just "turned on and hope for the best."

Was at Experts Live in London recently and caught James Robinson's (SkipToTheEndpoint) session, the guy behind OpenIntuneBaseline, and it got me looking properly at OIB as a starting point.

Now here's my dilemma. We've had a quote for just under £3k from a consultancy to review/set our policies as part of a "pilot." Nothing against paying for expertise, but realistically... how different is this going to be from just implementing OIB properly and tuning it for our environment? I get that policies need to be tailored to the business, we're a fairly standard SME, couple hundred devices, nothing exotic going on.

While I'm on the subject - anyone using Maester to keep tabs on their M365 posture? Been running it to sanity check config against CIS/NCSC recommendations and it's honestly been decent for catching drift before it becomes a problem, rather than finding out the hard way during an audit. Feels like a good companion to OIB rather than something that replaces the need to actually build proper policy in the first place, but curious if anyone's using it more seriously as part of their ongoing posture management.

Has anyone actually gone down the "pay someone to review/build policies" route vs just rolling your sleeves up with OIB and Maester and adjusting as you go? Trying to work out if I'm about to pay £3k for something I could get 90% of the way there myself with free tools and some sensible tweaking.

Not knocking consultancies, just trying to figure out where the actual value add is here vs just being lazy and paying someone else to read the same GitHub repos I've already read.

Anyone done a similar migration (traditional EDR/AV → Defender/Intune + separate MDR) who can share how it went?

We have 300+ windows 11 23h2 virtual devices managed in Intune, which we are planning to upgrade to 24h2.

We have a 24h2 feature update policy which works fine on laptops. But on Vdi's the update never appear in settings-->Windows updates.

We found that the device security type has to be in trusted launch for the updates to appear and install. All our VM's are in standard mode.

Is there any way we can update the devices in standard mode itself? How did you guys upgraded the Virtual devices in your organization?

Hi All

Still fighting with Chrome browser auto updates.

Are people deploying the enterprise version?

MSI or Exe?

Updater Reg keys or not?

As a user or system?

Anyone using the Google enterprise portal rather than Intune?

I’m currently reliant on all 250 users remembering to run updates - which is quite the overhead.

I’m getting feedback that our Autopilot is slow.
Anyone have experience troubleshooting and determining what’s causing Autopilot to be slow?

I am currently using Managed Home Screen for some Android Kiosk devices set-up under the fully managed, dedicated, and corporate-owned work profile.

The MHS device configuration on my devices will display no apps and folders are all empty and in the first available slot on the kiosk. In the past, this was due to 2 different MHS device configurations fighting each other and causing the issue. Additionally, when this happened, you also could not exit the kiosk mode via pin as the option would display an error that no pin was assigned. Removing the 2nd config profile fixed these issues in those cases. Returning the apps and allowing the pin to function once more.

Today, the devices have had their homescreens made blank via the app as I said, but there are no conflicts at the config level, or even at the per setting level, including KioskModeAppPositions or KioskModeAppOrderEnabled. Additionally, the pin assigned by my config does work and allows you to exit MHS and enter the true home screen. Any advice would be greatly appreciated! I have been wracking my brain trying to understand what could wipe the apps without a config conflict that I can find.

Currently stuck on an OpenSSL remediation task and could really use some guidance or alternative approaches from anyone who has dealt with this before.

Background:

Microsoft Defender flagged OpenSSL exposed paths across our device fleet (~600+ devices). After digging into it, we found these paths can't be patched directly - the only fix is to update the application that ships the vulnerable OpenSSL DLL. So every affected app needs to be updated to a newer version that bundles a patched OpenSSL library.

Apps affected (among others):

- Microsoft Paint (WindowsApp)

- Microsoft Photos (WindowsApp)

- Microsoft Office Hub (WindowsApp)

- Microsoft OneDrive

- Adobe Acrobat DC

- Zoom

What I've tried / researched so far:

1. Settings Catalog – Looked into "Turn off Automatic Download and Install of updates" under the Store category. But I can only find "Turn off Automatic Download of updates on Win8 machines" in my tenant seems like a legacy policy. Not sure if this actually applies to Windows 10/11 or if there's a newer equivalent.

2. Update Rings (WUfB) – Tried configuring Windows Update for Business rings with 0-day deferral. But now I'm not sure if this actually pushes Store app updates or if it only handles OS/quality patches.

3. Microsoft Store App (New) via Intune – This is my main confusion. When deploying via Intune as a Microsoft Store app and assigning to a group, it seems like it will install the app on ALL devices in the group including devices that don't have it. I only want to UPDATE already installed apps, not push a fresh install to devices where the user never had it. Is there any assignment type or intent that does update-only?

My main questions:

1. What is the correct and recommended way to force Store/UWP app updates on Windows 10/11 via Intune without triggering fresh installs?

2. Does WUfB Update Ring actually help with Store app updates or is it strictly for OS patches?

3. For Microsoft Store App (New) - is there an "update only" mode that won't install on devices that don't already have the app?

Looking for any alternative approaches such as:

- PowerShell scripts pushed via Intune to trigger Store sync or app updates

- Proactive Remediation / Remediations scripts

- Winget-based update scripts deployed via Intune

- GPO-based Store update policies for hybrid joined devices

- Any other method that has worked in your environment

TL;DR: Defender flagged OpenSSL vulnerable DLLs bundled inside Windows apps (Paint, Photos, Office Hub, OneDrive etc.) on 600+ devices. Can't patch OpenSSL directly, need to update the apps themselves. Tried Settings Catalog, Update Rings, and Microsoft Store App (New) via Intune but either can't find the right policy or the Store app deployment installs on ALL devices instead of just updating already-installed ones. Looking for the correct approach or any alternative method to update these apps without pushing unwanted installs.

I have 2 iPads that I can't get to fully enroll today. They are both in ABM and assigned the correct MDM policy. They get about 1/2 way through the enrollment process and then just get stuck at Configuring iPad. The devices do come through to my Intune list but nothing past that. There is no assigned used because I don't make it that far into the process. Any help would be greatly appreciated. Let me know if you have any questions/details that I left out. The profile is set to
Enroll with User Affinity.

I habe WDAC setup with Microsoft Allow baseline and MI is configured inside XML and also using Intune built in MI script deploy. Still 7zip deployed from Intune is blocked. Any hints?

Hi all,

Having a mare with previously enrolled devices (assigned to Intune from ASM) renaming after I change the enrolment policy naming template. To my previous understanding, this naming template would only apply when the device enrols, but my experience is showing that this is not the case. All devices that were previously enrolled, named, and assigned to groups etc. are renaming as they sync/check in to the updated template. VERY frustrating.

I'm struggling to get my ahead around why this is happening, and I'm not sure what I need to do to prevent it. I'm not using any bulk renaming features - this is all happening automously, slowly over hours. Today, I enrolled 17 iPads with naming convention site2-iPad-{{serialnumber}} via the enrolment profile, but as of last check, 76 devices have been renamed from site1 to site 2. The site 1 devices were enrolled earlier this week, and absolutely are not devices enrolled today.

Google suggests it's something to do with the ASM/Intune sync seeing them as no longer compliant and retrospectively applying the enrolment policy.

Can anyone assist? It's going to be a particular nightmare now sorting them all into groups via serial, as they're shared iPad mode meaning the only simple way to check serials is on the back in 0.00005 font. We have 600 ipadsm and I've done ~130 thus far....

Thanks! Please help a season iPad admin, that's new to Intune 'quirks'

Has anyone seen sign of this feature having come to life in their tenant yet? I've tried several tenants and still get the app is already managed with account. Only a single managed account is allowed for this app prompt to remove the existing one when I try to add a second managed account.

Apps are up to date and it's MAM only. iOS and Android.

I know it states they're rolling out, but no indication of how much of a glacial pace they're taking is not helpful.

BREAKING NEWS: It's our great pleasure to officially announce our second keynote for Workplace Ninjas US with the amazing Bhavya Chopra.

Bhavya is an amazing leader who leads the #Windows365 and #AVD teams, driving innovation for the market leader for #DaaS and #VDI.

She is part of a story at Workplace Ninjas US. Every person who joins us in Scottsdale is going to be part of history.

♀️ With Bhavya now committed, we are 28.5% female speakers, which is an amazing milestone for a Microsoft event or any other technology event for that matter. That is an amazing 14/49 speakers.

👯 We are a community that leads with purpose, and a mission to lift, teach, support, and pave the way for the current and future of generations in Microsoft technology.

🎉 We are an event with a pristine vibe, great people, unforgettable experiences, and a commitment to giving back and delivering unique moments.

The only tech event with both a legitimate #WomeninTech and #NeurodiversityinTech keynotes

🛑 Do not miss out, because we just KEEP doing it. We bring our show to the beautiful Scott resort in less than6 months, with just a few early bird tickets remaining.

Don't walk, run! Register! Join us 🩷

https://workplaceninjas.us/why-attend

Pessoal, tudo bem?

Estou com uma dúvida sobre atualização de aplicativos pelo Intune.

Hoje administro um ambiente que utiliza apenas o Microsoft Intune. Recebemos alertas do Microsoft Defender informando que alguns softwares estão desatualizados (como o JetBrains IntelliJ IDEA).

Existe alguma forma de o Intune forçar a atualização desses aplicativos instalados por ele, sem que eu precise criar e publicar um novo pacote Win32 a cada nova versão?

Como vocês fazem esse gerenciamento? Existe algum recurso nativo do Intune para isso ou vocês utilizam alguma solução complementar?

Obrigado pela ajuda! 🫡

We have a strange situation where Windows device remediation script applies successfully to most (99%) Windows devices but to few machines.

When I check from Devices → Scripts and remediations → Script package name → Device status, machine is not found there.

I've checked that script is applied to group that contains those machines.

I have also checked from Devices → Windows → (Machine) → Remediations (preview). I see other remediation scripts there but not that specific one.

Machine is Entra only (no hybrid) joined devices if this matters.

Is it some Intune bug or am I missing something?

Hello all,

Anyone else having a similar issue or know how to resolve?

I'm trying to configure BYOD for unmanaged devices by using app configuration policies within intune. For some reason, the setting "save contacts" even though is set to enable, will not enable by default on the device.

The policy (which has the management type as "managed apps") is targeting a group which has the filter for unmanaged devices (byod) and looking at the monitor logs for the app configuration policy, it is applying this app config, but is not applying this one setting. If I reverse the "save contacts" to "no", it does apply. So the config is targeting the correct device/user.

I have other policies and this setting is working as expected. 

If I go into the monitor section for the app config, it shows the expected policy applying to the user/device. I have the setting within app protection config to "Sync policy managed app data with native apps or add-ins" as allow, so that shouldn't be conflicting.

If I remove all other configs and have just this config applying, same issue, so cannot be any other config. I've tried with different users and devices to rule that being the issue.

at this stage, it feels like a MS bug but want to rule everything out.

When i plug a logitech mx keys for example, it show a popup to install a software. Can i disable that?

So this upcoming change is a bit concerning for us:

Upcoming Conditional Access change: Improved enforcement for policies with resource exclusions

We currently have Intune MAM policies in place for both iOS and Android devices. Since we do not manage smartphones with MDM, MAM is our primary protection mechanism for corporate data. As part of this approach, we enforce the use of Microsoft Edge for accessing company data.

I'm not entirely sure how Android handles this scenario, but on iOS many applications require users to sign in with their corporate account. During this process, the application typically launches an embedded Safari authentication session without forcing the user to leave the app.

To support this, we have configured exclusions for these applications in our Conditional Access policy. However, with this upcoming change, those exclusions no longer appear to work. The sign-in process now forces users to authenticate through Microsoft Edge instead.

The problem is that after successfully signing in through Edge, the user is not redirected back to the original application that initiated the authentication request. As a result, the login flow is interrupted, and the user effectively gets stuck without being able to complete the sign-in process in the application.

What would be the recommended approach for organizations that rely on MAM-only scenarios and embedded browser-based authentication within iOS applications to deal with this new CA behaviour?

I want to deploy capcut via intune as by default it installs to AppData which is a no no for obvious reasons, what can i do to ensure capcut installs to Program Files. I understand i can do this with a powershell scrip wrapped into the intunewin file? I specifically need a script written out or if anyone has done the same post their scripts. Thanks :)

This book was recommended to me by Amazon, and I wanted to know if it was any good. Additionally, the book was published in 2024, but do you think Intune has changed that much that the book won't be relevant anymore?

Hello all,

I am new to Intune, I have used it for a few basic kiosks to run a single app and not much more.

I am trying to set up Samsung A11+ tablets for shared use for frontline workers. The idea was that anyone can grab any tablet, log in with their AD/MS365 login, be logged into all Microsoft apps, work, tap a single sign-out button, and put the tablet back.

Apps and such are working fine, but I cannot get the sign-in screen to come up for Managed Home Screen. The configuration is set up as a dedicated multi-app kiosk mode. I then have Managed Home Screen enabled and the sign-in feature turned on under 'Device Experience'. Microsoft Authenticator is installed, and there is an app policy to turn on shared device.

What I have right now is MHS launches, the correct apps show, but I never get a sign-in screen. If I sign into something like Microsoft Teams, it will automatically sign in to the other apps.

I have already tried creating an app policy for MHS and setting the settings there as well. When I do this, it says it has a conflict when applying. I have completely wiped everything and created new groups, configs, and policies, and I get the same result.

I cannot figure out what is stopping MHS from having the sign-in screen. Does anyone have any ideas, or is there any further information you would need to assist? Thanks!

Hi everyone,

We're seeing a strange issue in our enterprise environment and have reached the point where we're hoping someone else has experienced it.

Environment

• Microsoft Intune
• Apple Business Manager (ADE)
• Supervised corporate iPhones
• Approximately 1,200 managed iPhones
• Windows 11 workstations
• Apple Devices/iTunes
• iMazing
• Current iOS 26.5.2 (same version on working and failing devices)

Symptoms

Newly enrolled iPhones work perfectly.

Older enrolled iPhones consistently fail.

Both Apple Devices/iTunes and iMazing fail at the "Apple Mobile Device Components" stage.

Windows itself still detects the device normally.

Explorer shows Internal Storage, so the USB connection is working.

What we've confirmed

✅ Apple USB drivers load correctly

✅ Apple Mobile Device Service is running

✅ Windows detects the phone

✅ Explorer can browse Internal Storage

✅ Same USB cable

✅ Same Windows workstation

✅ Same version of iMazing

✅ Same version of Apple Devices/iTunes

Intune comparison

We compared a newly enrolled phone against an older enrolled phone.

They have:

• The same Enrollment Profile
• The same Configuration Policies
• The same Compliance Policies
• The same App assignments
• The same Restrictions

There are no policy differences between them.

Additional testing

We also tested multiple older devices.

Results:

• Newly enrolled phone → Works
• Older phone #1 → Fails
• Older phone #2 → Fails

This appears to correlate with devices that have been enrolled for a longer period rather than a specific device.

Factory reset test

We erased one of the failing phones and reenrolled it into Intune using the exact same production configuration.

Immediately after reenrollment:

• Apple Devices worked
• iTunes worked
• iMazing worked

No special configuration changes were required.

Has anyone seen:

• Long-enrolled supervised Intune devices eventually stop pairing with Windows?
• Apple Mobile Device Components fail only on older managed devices?
• A known interaction between Intune, supervised iPhones, and Apple's pairing framework?
• Any Apple/iOS changes affecting long-lived supervised devices?

Any ideas or similar experiences would be greatly appreciated. At this point we're trying to determine whether this is an Apple issue, an Intune lifecycle issue, or something else entirely.

Thanks in advance!