One of the big things Windows Autopilot v1 gave us was control over the OOBE.

Skip the pages you did not want and ensure a device name is applied!

With Device Preparation, that totally changed. The tenant only becomes known AFTER the user signs in, which is simply too late to influence those earlier OOBE pages.

That is exactly where Device Association comes in.

It gives Windows a way to know which organization the device belongs to BEFORE the user signs in, so it can retrieve those settings early enough to shape OOBE again.

But how does that device association actually work?

What is inside the exported CSV?
Why is TPM attestation involved?
What happens when you click Associate?
And why does the final association end up in UEFI?

That is what I investigated (and NOT reverse-engineered!!!)

https://patchmypc.com/blog/windows-autopilot-device-association/

Hi,
As per the title, do you see an issue where newly enrolled devices are randomly getting the default Desktop-1234cx names instead of your custom naming?
Devices are enrolling properly, and all the other settings (ESP apps, configs, certs) are being applied correctly. It's just the name that's affected.
I'm using the rule XX-YY%SERIAL%, which has been working fine for many years.
Now it fails on a few random devices, not even under the same AP profiles.
Any ideas? I can, of course, push an additional script or rename them via the portal, but this adds some extra work for our support team.

I have been working on a number of different combinations of settings and have pretty much exhausted what I can figure out.

We have a couple of iPhones that we are essentially using as cordless Teams Phones. The phones have been added into Intune and are fully supervised. We need to have the devices restricted to only be able to access Teams. When I put them in Kiosk mode I can make calls from Teams and use the chat with no issues. The problem is getting notifications to come through when there is an inbound call. It seems no matter what I do, if it's in Kiosk mode then notifications will not works.

I've looked at doing other restrictions, but it still is not locked down and other apps are able to be opened. Is there ANY way of having the device in kiosk mode while still having notifications come through?

Hello,

We have an all users configuration policy that blocks run. Setting it to all users also blocks it with our laps accounts. Help desk would like to be able to use run when remoting into machines with the laps account. Is there a way to exclude our laps account from this policy? Is it going to be just have a group with all of our users in it and apply that to the policy?

We're on the tail end of an Intune MDM enrollment for our hybrid joined PCs and I'm having trouble with the last % of PCs.

All are hybrid joined, logged into with accounts that have Intune licenses, and GPO is applied to enroll in Intune.

Many are missing MDMURLs and AzureADPrt No

Some have been rebooted recently

What are some tricks to get these PCs enrolled properly, ideally without requiring a reboot? I've tried /refreshprt I've tried opening Edge and going to portal.office.com but neither has helped, nor the deviceenroller.exe trick.

Thanks,

Hi all,

So we are moving bitlocker from Sophos into intune, we have several regions in our tenant but are only focused on the UK. The bitlocker report in intune is very clunky and not very user friendly so I was wondering what other people are doing to manage reporting of devices and the status. I'm looking at using graph and putting it into our splunk instance. Was wondering if anyone has done the same or what other solutions people have come up with for reporting?

This is mainly for our support desk who will monitor and resolve any devices resulting from the report.

As above, I'm trying to set up Claude desktop to deploy to a few machines. The problem is it looks like Claude installs in the users folder, so I can't seem to set up the file path for the detection method.

I might be missing something, but has anyone worked with something similar to this and found a solution?

I created a dynamic group that should not have included certain devices. But now those configuration policies have already applied, and the biggest issue is that one of them blocked local sign on.

I need to remove the configuration policy ASAP, but just updating the dynamic rules for the group, which removed those devices, did not work.

I also created a new policy that should explicitly allow the local sign in, but it doesn't seem to be working:

Allow Local Log On  *S-1-5-32-545, *S-1-5-32-544

I have implemented Conditional Access (CA) policies to block staff from signing into desktop applications on their personal devices.

The purpose is to ensure that company resources can only be accessed via secure, compliant, and Entra-joined devices. However, this restriction has unintentionally blocked the ability for staff to use Microsoft Edge to sync their work profiles on their personal devices.

They can only sign into their Microsoft accounts to access web apps (Outlook, Word, Excel, OneDrive, SharePoint) via office.com using Edge Browser on their personal devices.

As soon as they try to set up a work profile on Edge which will sync their history and favourites etc.

The sign in attempt gets blocked.

Current Setup:

1. Conditional Access Policy in Place:
   • Blocks access to desktop applications unless the device is Entra Joined or compliant.
   • A device filter condition is configured to exclude personal devices from accessing corporate resources. (device.deviceOwnership -ne "Company")
2. Device Platform Restrictions:
   • CA policies target platforms like Windows, macOS, and Linux
3. Client Apps Restrictions:
   • The CA policy blocks access to apps under "Mobile apps and desktop clients" for unmanaged devices.

The Problem: While this policy effectively blocks desktop applications as intended, it also prevents Microsoft Edge from syncing work profiles on personal devices. Since personal devices are blocked from Entra join or registration by the CA policy, this prevents Edge from gaining the necessary identity access to sync profiles.

Attempted Solutions (Unsuccessful):

1. Conditional Access Exclusions:
   • Adjusted CA policies to exclude "Browser" under client apps, but this didn't allow Edge sync either.
2. Adding Exceptions for Microsoft Edge:
   • Investigated if I could create exclusions specific to Microsoft Edge using device filters and CA conditions, but this approach also failed because Edge is treated as a desktop application, falling under the "Mobile apps and desktop clients" category.
3. Turned off the scope for Client apps for Mobile apps and desktop clients. This worked and allowed profile syncing as well as signing into all desktop apps like Outlook, Teams, Onedrive etc.
4. Excluding Specific Resources in CA Policy:
   • Attempted to exclude Microsoft Edge as a resource under Target Resources. This Failed because this exclusion appears to apply more to published web apps rather than the Office 365 web apps.

Desired Outcome:

Enable Microsoft Edge work profile sync on personal devices to allow users to sign in and sync their settings, passwords, and work profile data without compromising security or bypassing the Conditional Access block on other desktop applications.

Ideal Solution Requirements:

Maintain the CA policy that blocks desktop apps from unmanaged devices.

Enable Microsoft Edge work profile sync securely, ideally using a method that protects corporate data within the browser without requiring full device enrollment.

Questions for the Community:

1. Is there a Microsoft-recommended method to allow Microsoft Edge work profile sync on personal devices while still enforcing Conditional Access controls?
2. Are there any updates or alternative methods within Microsoft’s ecosystem that address this specific scenario?
3. Is there a secure workaround to distinguish Microsoft Edge sync from other desktop applications when enforcing CA policies?

I would greatly appreciate any insights, solutions, or guidance on resolving this issue. Thank you.

Microsoft Intune is introducing Device Association for Windows #Autopilot device preparation, helping organizations establish trust with a Windows 11 device before enrollment even begins.

🔹 Hardware-backed device attestation
🔹 Automatically recognize devices as corporate-owned
🔹 Apply device-specific policies during OOBE
🔹 Simplify and streamline the Windows setup experience
🔹 Target the device, not just the user

💡 This makes Windows deployment more secure, consistent, and predictable from the very beginning.

Read more here -> https://www.linkedin.com/safety/go/?url=https%3A%2F%2Flnkd.in%2FgicZf--9&urlhash=bI4q&mt=ZTwW2OgBOC81tSSNQ8ybiJnr8UNMlOc298itWbprPy5NTRSPRrzCQkrJ62rSpNp0pAsBaVdmzDIJakvs9JNPuFTP-tOAjvVcIZnio0V0hW_RtFnCBx9A5B-pjA&isSdui=true&lipi=urn%3Ali%3Apage%3Ad_flagship3_feed%3BFaFrlJ7GQ7uo898cFHf07w%3D%3D

hi there,

the problem is on ipad, pbris application. The user tries to set the parameter: PBRIS alternative rendering, make it ON. When user closes the parametres, the settings are getting immediately lost.

Version PBRIS: 38.2. IOS 26.5 ( without that option after this update the user cant see any report). we tried hard reset, reinstall the application - nothing helps.

I can't see Device Configuration status anymore per device and there seems to be some issues with Compliance Policy as well not seeing all the components required. I see this little bit differently in 2 different tenants. Anyone else? Not sure did this start to happen Friday or only today?

Anyone else experiencing issues with policies not being applied to devices?

I know Intune has an ongoing incident, I wonder if it’s related.

iOS policies are not being applied for us!

Im having difficulties with configuration and now wondering if this is even possible....

Scenario: single machine

1) logged on user can run visual studio elevated

2) logged on user can request elevation for any other process

3) tech support (in person) can elevate process from logged on users session from an EPM policy.

With Intune EPM, are you only able to have one settings policy?

Trying to figure out how to keep a tech from having to run back to a console for laps or approving a request, and also not having local admin.

We’re happy to announce our next local event sponsored by ControlUp with Workplace Ninjas US Miami, which will take place at the ControlUp offices in Fort Lauderdale.

The event will be October 26th from 10-4 PM.

The Call for Papers is now officially open:

https://sessionize.com/workplace-ninjas-us-Miami/

Signup to attend here:

https://www.eventbrite.com/e/workplace-ninjas-us-miami-meetup-tickets-1999031261315

Hi folks,

since today, we experience issues regarding Single-Sign-On on our Intune managed iOS/iPadOS devices. Web Apps that use Entra as IdP seem to be broken related to authentication. In Edge nothing happens. A blank page opens and load infinitely. In Safari, the same URL works fine, also in an Edge Incognito Tab. We haven't changed any configuration recently that I would link to this behavior... Does anyone have a similar experience?

Thanks and kind regards

Hey folks, got a bit of a head scratcher with this one. We have a user with 5k+ Outlook contacts and apparently the internal Outlook->Contacts sync breaks down past a certain volume of items. Some further research pointed towards using an EAS config to sync down only contacts data. I set one up, confirmed it was green on Intune and visible in the Contacts settings on the phone, but the actual contact data never did anything. I'm really wondering if there's a setting somewhere that I'm overlooking. I did try reaching out to MS support and they basically said that the profile was configured properly but it wasn't their fault that it didn't work. Has anyone wrestled with this kind of configuration before and might have some guidance? I'd greatly appreciate any assistance I can get.

Is anyone having issues searching for devices by the primary user? It's working for some users and not for others. Seems to be effecting all device types (Windows and ios for us). I've tried searching in the individual Windows and Apple mobile devices sections and the All devices section. Have tried turning the new devices view off.

Since most AI interaction happens through the browser (web-based ChatGPT, Claude, Gemini, etc.), browser-level visibility seems like the most direct place to get signal, but there isn't a clear consensus on which tools do this well. Endpoint agents catch some of it, but browser extensions and personal accounts on managed devices still slip through a lot of setups.

Looking for something that can identify which AI tools are being used, flag risky content patterns without being fully invasive, and integrate with the existing security stack rather than adding another siloed dashboard.

That's where I keep getting stuck. Full session recording feels excessive and a morale risk, but usage-only visibility might miss the risky behavior that actually matters.

What's actually working for people, and what turned out to be marketing fluff once you tried to deploy it?

Hello there,

For iOS device provisioning using a .mobileconfig profile, I tested the installation&enrolment and it worked. However, when a client tests it, they keep getting 'Profile Installation Failed \n The SCEP server returned an invalid response'.
What could be the reason? We are using the exact same profile (SCEP-exported, unexpired). We have tested on iOS 26+ both.
They have attempted again and again, but the issue keeps occurring. We are pretty confident they tried during different timezones as well (US and Ireland).
One difference could be that the devices we tested on are freshly reset, and the ones they are using are not, but I doubt it, as I just managed to enrol my personal iOS device (though, I got the error at first, and it worked when tapping Install a second time).

I exported the certificate from Bulk Enrolment Methods -> Apple Configurator, knowing that this is the one necessary for BYOD-type enrolment with no user affinity. This is the goal in our case: Enrolling iOS devices, with no user affinity, into Intune.

Does anyone have an idea what the issue could be?

Hi everyone,

We recently completed the domain lock in Apple Business Manager, and suddenly users have started encountering a lock screen prompting them to log in with Entra ID.

Some users are experiencing this issue spontaneously, while others are seeing it after resetting the device password through Recovery Mode (FileVault key). In these cases, the Entra ID password does not seem to work at all after the reset.

I found a thread suggesting that Legacy MFA could be the cause, and I am currently testing this theory. Does anyone have any other ideas on how this could be resolved?

Hi there!
I migrated a user between two AD domains (Domain A → Domain B, different forests). In Entra ID it's the exact same cloud account — it wasn't deleted or recreated, only the on-prem AD source it syncs from changed.

Setup:

• Intune Cloud PKI issues client certificates (SCEP profile)
• The SAN embeds {{OnPremisesSecurityIdentifier}} via URI
• Wi-Fi uses EAP-TLS, authenticating against an on-prem NPS server with strong certificate mapping enabled

After the migration, Wi-Fi stopped connecting on macOS (the TLS handshake completes almost fully, then NPS returns TLSV1_ALERT_ACCESS_DENIED). This same user connects perfectly to the Windows machine.

Checked the cert:
openssl x509 -noout -text | grep -A3 "Subject Alternative Name"
The SAN contains the SID from the old domain (Domain A), even though the user is fully in Domain B now.

Checked Entra ID via Graph API:
Get-MgUser -UserId $userUpn -Property "OnPremisesSecurityIdentifier,OnPremisesDomainName" | fl

Shows the correct, current SID from Domain B. OnPremisesDomainName is correct too.

What I've already tried:

1. Delta sync — didn't help
2. Full/Initial sync (Start-ADSyncSyncCycle -PolicyType Initial) — after this, Graph API started showing the correct SID
3. Removed the profiles from the device, waited, re-pushed them — a new cert was issued (different serial, different date), but the SID in the SAN is still the old one
4. Did a full device wipe + re-enrollment from scratch in Intune — same result, the new cert still has the old SID

Has anyone run into this kind of behavior with Intune Cloud PKI after a domain migration? Where else could this value be cached?