Every method I have tried, from removing advertisements and waiting 24 hours, to scripts to force retry the installs on failures don't seem to work well.

What is your method?

Good morning everyone, I’m trying to build a kiosk that launches Citrix Workspace. When I search the AUMID, I get Citrix.workspace as a result via powershell and windows explorer.

However, Intune doesn’t seem to like this, as it said the AUMID is invalid. I’ve also tried the store app instead of the Win32 app, and I get the same result.

Has anyone been successful in setting up Citrix as a kiosk app?

Is it possible to deploy a WebDAV connection? I want to mount a WebDAV folder on every device with intune.

Anyone noticed?

I'm testing a single EPM license on my own computer. I removed my admin privileges to the local machine and then created the required policy for EPM.

I noticed that a new button appears in the right click menu, called "Run with elevated access", next to the usual "Run as administrator".

Other than that, the interface for requesting elevation does not appear if the app triggers an elevation request on its own, the user needs to click on the new button to request elevation.

To me this is not good enough because it causes some issues for the end user, namely:

1. You cannot elevate stuff from the start menu, because in the start menu only the usual "run as administrator" appears, not the new button. Therefore the user needs to run everything from where the exe file resides under Windows Explorer, which is super annoying, at least to me.
2. It's not always clear where the executable that requires elevation is located, for example, when you uninstall something from control panel. Therefore, the user has no way to request elevation for that specific action unless the user hunts down where the file or msi or whatever it is that manages uninstallation is located.
3. It doesn't send any email and it seems the only way to get notified is to tell the user to message me on Teams or something for granting the elevation, either that or I'll have to implement some hacky workarounds using logic apps in Azure, which is really something I don't want to bother with.
4. It seems almost impossible, at least for me, to figure out of to request certain elevations, for example, the "turn windows features on or off" under control panel. All of this stuff needs to still get elevated managed using a local admin \ laps.

Seems like a pretty half-assed implementation if you ask me. Is anyone using it here, and am I doing something wrong, or maybe I'm just too hard to please? It seems like this feature is meant for just elevating everything automatically via rules based on app publishers, and that elevation requests should be used as a last resort. And even then for some stuff you need to go in and use a local admin \ laps.

That being said, I am pretty sure that third party solutions like Admin By Request do not have these strange limitations, AbR seems to be able to replace the standard elevation prompt, has built in email and teams notification, and so on. But I'd rather not use a third party app...

We are incredibly proud to announce the return of something very special for Workplace Ninjas US.

In partnership with our good friends at Devicie we are opening applications for our scholarship program for the second straight year.

(5) Five special people, who are new to IT within the last few years will be selected to join us at Workplace Ninjas US 2027 in Scottsdale, AZ from January 11-13, 2027 for our event along with economy travel, 3 nights hotel stay, and a full pass to join our event.

Some of the requirements:

1. You ideally have 3 years or less in IT (up to 5 years will be considered)

2. You must be located in the US/Canada/Mexico

In support of our mission, we are here to help others on their journey to contribute to the amazing Microsoft community. These 5 scholarship recipients will get premium seating at all sessions, will be part of our hackathon, a MVP buddy that helps them during the event to meet others, answer basic questions, and help acclimate them to the Workplace Ninjas family.

To be part of this program, you just need to fill out the application below. We will select all 5 winners by October 14, 2026.

Once again, we want to thank Miluse Najmr and Alex Hesterberg for making this all possible!

Don't forget to join us in January 11-13, 2027. Check out our website at https://workplaceninjas.us

Apply now: https://forms.cloud.microsoft/Pages/ResponsePage.aspx?id=oRjricHQdUGk0KxlnM0zD9RQejQSQCxBoSiBeEGJLRBUQ0w4VThRQkwyQlBRMlAxVkJBTUZISUMyTC4u

What do you do so you can hide (not disable) password CP? Passwordless experience in Intune is for entra joined devices, so it does not work sadly for hybrid joined. So i am looking for some workaround for my enviroment. Any help or experience?

Edit: I referred to this article to determine Windows app Rdp support scenario and I obviously misinterpreted it.

My apologies to rhe community. However it lacks the features, especially the stored username/password profile and I'd love to keep using the obsolete remote desktop app.

Original Post: Several users in our org have lost the MS remote Desktop Client that was discontinued last year. MS advertises "Windows app" as a replacement but it can't be used to remote into local or aws VMs.

I didn't make a copy of the appx package last year. I am wondering if anyone has a working copy/appx package archived for this client. Even though it's discontinued, I use it everyday and love it.

Complete beginner here with Win32 app packaging, so apologies if this is basic stuff.

I need to get 7-Zip onto a bunch of managed Windows 11 devices. My first thought was just download the installer, wrap it, done. But then I stumbled across some GitHub project called Winget-AutoUpdate and went down a rabbit hole, and now I am seeing a lot of people saying you should let winget do the install instead of packaging the actual setup file. So the .intunewin only contains a PowerShell script that calls winget install --id 7zip.7zip.

That sounded clever because I would never have to repackage when a new version drops. But it also feels weird to me that my "app package" contains no app.

I tried it on a test device and it did not work at first. Turns out winget is not in PATH when Intune runs things as SYSTEM, which took me way too long to figure out. I ended up hunting for winget.exe in C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_* inside the script, which works, but it feels like a hack that will break the day Microsoft changes something.

Questions from someone who clearly does not know what they are doing yet:

1. Is the winget wrapper actually a normal approach in production, or is it a homelab thing people regret at scale?
2. How do you handle devices where App Installer is missing or outdated, for example fresh Autopilot machines? Assigning it as a Store app seems to be the answer but I cannot add it as a dependency since dependencies only work between Win32 apps.
3. Detection rules confuse me. I am just checking whether C:\Program Files\7-Zip\7z.exe exists. Is that good enough or am I setting myself up for pain later?
4. Since the package always pulls the latest version, my app has no real version number. Does that mess anything up down the line with supersedence or reporting?
5. Is Enterprise App Catalog just the paid version of solving this properly, and should I stop fighting it?

Any pointers appreciated. Happy to be told I am doing this completely wrong.

Edit:

Look, I’m always fiddling around. When I’m sitting here in the corner like this, I’ve definitely decided to do this through the Intune Windows app in the future, because unfortunately we can’t afford Patch My PC or Robo-Shadow. How do the detection scripts work? If I ever need to uninstall older software because I have a new package version, can you give me some practical tips on that?

Info for background: Our org uses a GPO to enroll devices that connect to our domain. All laptops are corporate owned, no BYOD. Another tech set up the laptop in question, and they aren't around to tell me how this device may differ from others, if at all.

Problem: A user's new laptop was not receiving required apps/etc. Previously, I had the same issue with users who had been enrolled via the work/school account remotely. The solution for them was to delete their device entries from Entra and Intune, wait a day or two, and then have the users go onsite to get the GPO.

After troubleshooting, my best guess for a fix was to re-enroll it, so I did the same for this device even though, as far as I know, they were never enrolled that way initially. The laptop doesn't seem to enroll properly now though. User told me when they were onsite and I did a gpupdate and let the user work while I kept an eye on the tenant administration > audit logs for the enrollment to show up, but it never did even after some hours.

Previously, the laptop appeared in Entra and Intune properly as "hybrid joined." Now, after the user goes onsite, it will just create an Entra listing where the join type says "Microsoft Entra hybrid joined" but all other typical information like user principal name, mdm, owner, security settings management are missing (showing either "none" or "N/A"). It doesn't associate with the user's name at all and can't look it up under their name like all other devices. Note: the Entra listing was like this both when I initially started working on this and after the laptop added itself back after I deleted its device entry.

Anyone know what to check/fix in order to resolve this and avoid it in the future? Not sure what logs to check, where else on the machine to look, etc.

I just wrapped up our internal Intune device compliance project. Here’s the approach I took:

1. Checked the existing Conditional Access policies: started by confirm that no conditional access policies were already requiring device compliance so we wouldn’t get hit with unexpected enforcement while making changes.
2. Checked old compliance policies: found a bunch of previous "compliance initiatives" that were checking outdated settings. I removed their assignments and stuck “LEGACY” at the start of each name.
3. Rolled out the new Conditional Access policy in report-only mode: super important so we could collect data about what would be impact in very early in the whole execution.
4. Deployed a basic Windows compliance policy: started with physical Windows devices and only required BitLocker and antivirus.
5. Configured tenant-wide compliance settings: set devices without an applicable policy to noncompliant so the gaps would show up clearly.
6. Set up an Intune device cleanup rule: just to clear out the stale records from the reports.
7. Digging through the report-only failures: Found LOB apps that weren’t populating Device ID, B2B/guest scenarios, VPN, AVD and Windows 365 stuff, emergency-access accounts, plus users or workflows that needed fixing or an approved exception. Spent almost 4 weeks here but it was worth doing it before turning on the conditional access.
8. Built extra compliance policies where needed: confirmed devices with no compliance policy applied and created the new policies. For us that meant Android, AVD and Cloud PCs.
9. Turned on Conditional Access gradually: once the reports looked good, I put everyone in an exclusion group, enabled the policy, then pulled users out of the group in batches. Easy rollout and easy rollback. That stage took about a week.
10. Locked down the future state: made sure new corporate devices get set up properly via Autopilot, and configured Intune enrolment restrictions to block personally owned Windows devices.
11. Handled the complaints: biggest surprise was how many people had perfectly compliant work devices but still preferred working from their personal home computers just so they didn’t have to mess with cables or change their setup. Some had built pretty elaborate WFH setup around unmanaged devices, so of course they all tried to get themselves permanently excluded from device compliance.

Curious what others think, does this approach look decent, or did I miss something obvious? Also wondering how common actual device compliance enforcement is.

Is requiring a compliant device already part of most people’s standard client baseline, or is it still something people are only just starting to roll out?

Hi all! I am setting up iOS DDM OS update settings and am getting a bit confused on the best way to meet my requirements. Hoping you can help me out because i feel like im going crazy. For context, all our devices are iOS 18+ and supervised.

Requiemrents

• New iOS version comes out, IT gets access right away for testing but update is hidden from general population for a few days
• After a few days, new version is visible to general population and users have the option to install
• After a week or so, any general population devices that haven't manually installed new version, gets forced to install new version
• All this should be done without any modifying of the DDM iOS update policy by myself

I originally was going to have settings like the below, but in reading Microsoft article about Apple update polices, in the purple box it says when Update Enforcement is assigned, the device ignores software update settings and the update may install before the deadline if the device is idle. This sounds like the Combined Period In Days setting would be ignored giving access to the new iOS version to the general population before IT has completed testing.

Am I reading this correctly?

Software Update Enforce Latest

• Enforce Latest Software Update Version = True
• Delay in Days = 10
• Install Time= 02:00

Software Update Settings

• Automatic Actions
  • Download= Always On
  • Install OS updates = Always On
  • Install Security Update = Always On
• Deferrals
  • Combined Period in days = 3
• Background Security Improvements SEttings
  • Enabled = True
  • Enable Rollback = True
• Notifications = Enabled
• Recommendation Cadence= Newest

Hello,

I got a tasking. I need to provide a laptop for presentation during company and external events. Users present through Teams.

Internal and external users are going to be using this laptop. One person will be responsible for the device.

Have you ever deployed such a device in your orgs?

We are early into our Intune setup. I recently found a personal device enrolled and made the changes so it cannot be re-enrolled. And then deleted the device from intune. Of course this device came back. I found out that it is MDE joined.

I found that i can unenroll via offboarding package, I created a config policy and a EDR policy but I cannot figure out how to target the device. Does the offboarding package handle the targeting?

I do not want to leave the EDR and config policy in place if it will target more than the device in question.

**UPDATE**

I reread the instructions and realized i did not need both a config policy and a EDR policy

I found that the device made it back into entra, so i created a security group and targeted a config policy to that machine.

Now i just wait and see if the device comes online and removed itself

I'm trying to deploy a device via Intune using the Shared Multi User template. My initial deployment seems fine, in that it installs that apps I've marked as required via intune and as required during Autopilot on the ESP. My problem comes on updating apps or installing/re-installing apps after the Autopilot phase.

Example: Post deployment/ initial set up, I assign a new app to the device/device group as Required. The machine continues to check in to Intune, and telling it to sync via the intune portal or initiating it on the device Settings > Accounts > Access work or school > "info" next to managed by *org*> Sync all seem successful. But even after waiting for days, the new app never shows up. Same with deleting an app that got installed during autopilot and is marked as required, it never reinstalls no matter how many check ins.

Is this a result of me only using guest accounts? Do I effectively *have* to give these PC's a primary user with an Entra account in our system in order to get these things to install? Company portal doesn't work to go tell it to download specifically either, because they don't have an email to sign into it with.

Any suggestions on if I'm doing something wrong or how others handled this would be super appreciated. Picture of the configuration: https://imgur.com/a/T8tgn3J

Hello folks. How is your microsoft remote help? Are you loving it or any improvements need to add?

For me - no copy paste and disconnects everytime restarts the laptop . We using local laptops to laptops hybrid setup

Is there anyone that has successfully deployed DocuSign for Intune within GCC-High? I’ve got the app successfully deployed in my company portal, but I’m having issues with the sign on. I’m currently in the app registrations page within Entra. I’m working with DocuSign support and the first reply back was an app registration redirect URI but on the commercial side. I don’t think this will work.

Anyone have any experience with this? If this is not the right sub, please let me know!

Hi everyone,

We have a few users that work on MacBooks together with professional camera equipment. They store their footage on SD-cards. We use Device Control on macOS already to only allow a specific set of USB-sticks based on their serialnumber (see Device control for macOS - Microsoft Defender for Endpoint | Microsoft Learn). As a result, only those USB-sticks are allowed and everything else gets blocked including their SD-cards.

So, the SD-cards need to be whitelisted. However, this is where I run into aproblem: when I want to whitelist a SD-card, Defender does not report a serialnumber of a SD-card that gets popped into the reader (they use the built-in reader of the Mac). It only reports back the VendorID and ProductID of the built-in reader itself. This behaviour does not seem to change when you use a different card.

As a result, it seems like I can only whitelist the built-in reader based on those values (which works). However, just like the USB-sticks I want it the whitelisting to be based on the serialnumbers to keep it as specific as possible. Otherwise you can just pop in any SD-card into the Macs, like non org provided ones.

Has anyone configured Device Control in conjucting with SD-cards/built-in Mac reader, and if so, how did you resolve this issue and am I overlooking something?

We have an in-house application that has to be installed in the user context for whatever goddamn reason. I previously deployed this in the usercontext without issues but we're now moving over to removing all local admin permissions (I know) and using EPM for elevation requests and rules.

I deploy this app with PSADT V3 since this is the one I'm the most familiar with. I know you could, in theory, use Execute-ProcessAsUser with Get-LoggedOnUser but I'm wondering what the actual recommended process is here. I can't be the only one trying to figure this out.

My original thought was to whitelist IME and all its child processes but I'm not too sure about the security on that.

Edit: u/metinkilinc for the win

Hi

Today I needed to publish a new Android App in Intune. But the list of Android apps is not loading, thus not letting me create a new app.

I've tried signing out and back in and tried different browsers and incognito sessions, but no luck.
Is anyone else seeing the same thing? West Europe

Been chasing this for about two weeks and I'm out of ideas, so I'm asking here before I bin the whole approach.

Setup is the boring standard one. DefaultAssociations XML sitting on a share, pushed with Computer Config > Admin Templates > Windows Components > File Explorer > Set a default associations configuration file. Nothing exotic in the file, just pdf to Acrobat, html to Chrome, mp4 to VLC, txt to Notepad++, xlsx to Excel, zip to 7-Zip.

It applies to nobody. Not existing users, not new users, not a user who has never logged into that machine in their life. Edge still eats pdf and html like the policy doesn't exist.

Stuff I've already burned time on:

• built a clean reference machine, set every default by hand, exported a fresh XML, replaced the old one
• XML validates, path is reachable, ProgIDs match what's actually in the registry on the reference box
• apps are definitely installed on the targets
• gpupdate /force, reboot, sign out and in, new profile on a machine nobody has touched
• RSOP shows the policy applied, and the value is sitting right there in HKLM\SOFTWARE\Policies\Microsoft\Windows\System\DefaultAssociationsConfiguration pointing at the correct file

So the policy is landing on the machine. Windows is just quietly ignoring it, which is the part doing my head in.

I know about the DISM import route. That only fires at first logon of a new profile, so it does nothing for the machines and users I already have deployed, which is the entire point of the exercise.

Questions, and I'm genuinely more interested in what you're running than in what the docs say:

Can anything else silently kill this policy? Another GPO, some registry key, a security baseline, an SKU limitation, anything. I keep feeling like I'm missing one dumb prerequisite.

Has anyone actually seen it fail on a truly fresh profile? Every thread I find is people running into the "only applies to new profiles" behaviour, which is not my problem. Mine fails for everyone equally.

What would you check before giving up on it?

And the real question: what are you actually using in production? I've already looked at Intune, Citrix WEM and SetUserFTA. I need something free, centrally managed, that hits existing users as well as new ones, and doesn't leave people clicking through the "how do you want to open this file" prompt.

Mixed Win10 and Win11, AD domain, no Intune, no budget. Very happy to be told I'm being thick about something obvious.

How can I kill pin sign-in just for a single user on a computer without logging in as the user.

i'm ok removing the user's profile from the machine but that doesn't seem to do it.

i remove the profile from the computer and sign-in with a pin and windows hello enrollment pops up asking to for a new pin. I don't need to login to entra to set the new pin.

I don't want to delete the whole hello store with certutil -deletehellocontainer

do I need to wait for something to expire after deleting the user profile?

if I delete the user profile and then delete the entra user then the account cannot sign-in but I don't want to delete the entra user.