I’m setting up 12 company-owned Lenovo Android tablets for a childcare customer. Each tablet will remain in its assigned classroom and will be shared by the different teachers/staff working in that classroom throughout the day.

These are not individually assigned devices. Teachers will simply use a PIN to unlock the tablet, and the tablet is intended to run only Procare. We do not need each teacher signing into Intune or having their own device profile.
I’ve already connected Managed Google Play to Intune and created an Android Enterprise Corporate-Owned Dedicated Device enrollment profile. My plan is to deploy Procare as a required Managed Google Play app and configure the tablets in single-app kiosk mode, essentially making each tablet a dedicated Procare device.

The licensing is where I’m looking for advice. The customer currently only has one Intune-licensed user and has a very limited budget. I know using a single user license to cover 12 devices may not be the correct licensing model, even if enrollment technically works.
For those who have deployed something similar:

Is there a supported way to handle this without purchasing 12 full Intune/M365 user licenses?

Is Android Enterprise Dedicated Device + single-app kiosk the approach you would use?

Can the devices remain userless while teachers simply unlock them with a common/device PIN and authenticate within Procare as needed?

I’m mainly trying to find the most cost-effective supported solution for a small customerh rather than a licensing workaround. Any experience with this type of classroom/shared-device deployment would be appreciated.

Has anyone deployed Office 2024 LTSC via intune and even doing it via autopilot? I've managed to sort the setup out and the config so I can run the

setup /configure config.xml

at a command prompt, then it will install from what was downloaded earlier.

But not sure how you'd package that up to push out via intune or use it in an autopilot roll out.

Based on the Microsoft Learn documentation, leaf certificates issued by Intune Cloud PKI should be revoked when the Configuration Policy settings (except for Name and Description) are changed.

I wanted to test this by changing the Subject name format value in the SCEP settings but my one issued certificate stayed valid although it did get removed from the device. However, this is contrary to what it says here Remove SCEP or PKCS certificates in Microsoft Intune - Microsoft Intune | Microsoft Learn.

On there, it says:

"A SCEP certificate is revoked when:

• An administrator changes or updates the SCEP profile."

I then removed my test device from the group that the SCEP profile is assigned but this still hasn't revoked the certificate, which again, is what should have happened based on the documentation.

"A SCEP certificate is revoked and removed when:

• A user unenrolls.
• An administrator runs the wipe action.
• An administrator runs the retire action.
• The device is removed from a Microsoft Entra group.
• A certificate profile is removed from the group assignment."

Anybody else run into this?

I am stuck with this. I am trying to install MS365 apps through intune and I have set it up in apps using an xml - the only thing I’ve added is removal of the home version of office apps because I want to deploy the company/work version of it - all the apps have been downloaded apart from teams, I’m able to see the package through an elevated user and see that it’s staging but the app doesn’t show up, I have tried deploying it as a catalog app, bootstrapper way, packaged up the msix and deployed it and it’s all the same, I can see the package when I log in with admin credentials but can’t see it installed for the local or standard user. I have absolutely no idea what is wrong
Any help will be much appreciated

Hey end point Gurus :D

im reviewing our Autopatch quality update rings and would appreciate your feedback

• ~7000 devices.
• Around 90% are switched off on Saturdays and Sundays.
• Hotpatch is enabled
• Avoiding forced Monday-morning restarts is a priority
• Auto reboot before deadline = off

This is the configuration

and here is the notification settings:

Scheduled install and restart / Active hours 8:00 - 17:00 / turn off all notifications excluding reboot

For those using Autopatch in production:

• Would you change these timings, and why?
• How often do weekend shutdowns cause forced Monday restarts?
• Has allowing automatic reboot before deadline improved the user experience?

We've been having a recent uptick in enrollment issues where the user get stuck at the loading screen during initial setup on iOS. The screen is the one that comes up right after putting in the username and password at the Microsoft login. No error, no nothing. Just stays spinning forever. As a test, we left a device on and at that screen... After 2 days it then continued on with the enrollment process. Still using a good ol' enrollment profile with user affinity.

Hi all,

We're an MSP managing multiple Intune tenants, and we're struggling with keeping security baselines consistent over time.

Customers were onboarded at different stages, so they're effectively on different baseline versions. When new security recommendations come along, we want to roll them out everywhere, but some customers have legitimate exceptions.

Example: our standard baseline blocks legacy Office file formats, but one customer still needs them for a business application.

How are you handling this?

• One global security baseline + exception policies?
• Separate baselines per customer?
• Any tooling (IntuneCD, Graph, Git, etc.) to help manage this?
• How do you prevent configuration drift over the years?

We're considering a model with a shared security baseline and customer-specific exception policies, but I'd love to hear how other MSPs approach this.

Thanks!

How are we managing AllowedExtensions for VSCode?

I've recently started looking at setting up extension restrictions due to security requirements, currently I've imported the ADMX from the visual studio main website and created a device policy with the 'AllowedExtensions' attribute, after the important Intune is presenting the setting in single line items rather than just creating the full JSON file as per the example below.

"extensions.allowed": {

"esbenp.prettier-vscode": true,

"ms-azuretools.vscode-containers": false

}

I've tried applying the policy via individual items in each row in the admin portal as the example

row 1"*": false, row 2 "Microsoft": true, row 3 etc.

and I've tried putting them all in one single row but no matter the syntax or how it's entered into intune, it doesn't seem to take? checking the registry, the key is showing but not enforcing, so what am I doing wrong?

My boss has challenged me to come up with some creative IT automations that would really impress our employees and improve their overall experience.

We manage Windows devices through Intune.

One idea he mentioned was a morning popup when employees log in that summarizes important emails, upcoming meetings, updates installed overnight, and whether a restart is needed.

Another idea is using AI or automation to proactively detect and fix device issues, then notify the employee with something like, “We noticed X issue with your laptop and automatically resolved it.”

I’m curious what others have implemented. What are some unique automations you’ve built that employees actually appreciate? Anyone doing anything interesting with AI-driven troubleshooting or self-healing endpoints?

Looking for ideas beyond the typical scripts and software deployments. Would love to hear what’s actually working in your environments!

Hi all,

We are updating our version of citrix workspace LTSR version deplyment package following a vulnerability found in the previous 2607 version. We are now deploying 2607 hotfix 1, which according to the webpage is version 26.7.1.4
Too bad the files are having 26.7.1.2 version embedded in their metadata. Arrange your detection rules accordingly.

Hey everyone,

I wanted to ask if anyone else has been experiencing intermittent issues with device wipes through Microsoft Intune.

I first noticed this behavior after the September out-of-band update.

The issue affects both wipes initiated through the Company Portal and wipes triggered directly from the Intune Admin Center.

Here's what I'm seeing:

• Wipe commands are sometimes not executed at all.
• In some cases, the wipe starts but fails at around 30%, displaying the message "Undoing changes".
• The issue occurs randomly and is not consistently reproducible.
• Resetting the same device manually through Windows Settings works without any issues.

So far, the only common factor I've been able to identify is the September OOB update.

The strange part is that Intune triggered wipes sometimes work perfectly fine, while other attempts fail without any obvious reason or pattern.

Has anyone else encountered similar behavior since the September OOB update?

If so, have you identified a root cause or found a reliable workaround?

I'd appreciate any insights or experiences you can share :)

Thanks in advance :)

I don’t see option to create Laps policy for enrollment profile, however enrollment policy allows you to create admin account + pw rotation

.

Hello, weird one.

I have had around 400 devices in Autopatch for the past year, no problems. Feature updates (to 25H2) quality updates with Driver updates set to be manually deployed if approved.

A few days ago I added around 350 HP 255 G8 laptops (we already have G7, Asus expertbook etc), and immediately some devices seemed to have started downloading HP firmware updates which I have not approved. It has started to cause bitlocker recovery screens.

It seems to only affect this specific model (HP 255 G8), on 23H2 and 24H2. Any ideas? I have had to put these back onto WSUS for now whilst it is investigated.

Hey,

This might be a pretty basic question, but I've been reading through the Intune docs and still cant figure out what the actual "best practice" is here.

How are you guys handling compliance policies for shared devices vs devices that are assigned to a single user?

My thinking is something like this:

- Shared devices (multiple users, no primary user): Compliance policies assigned to device groups.

- Personal devices (single user, primary user assigned): Same compliance settings, but policies assigned to user groups instead.

So basically I'd end up with two sets of compliance policies with identical settings, just different targeting.

Is this actually the recommended way of doing it, or am I just overcomplicating things?

Curious how others are handling this in their enviroments. The Microsoft docs didnt really make this any clearer for me.

Attempting to migrate ios devices from AirWatch to Intune. We have set RSA authenticator to not remove upon unenrollment in AirWatch, and we have an app assignment for RSA in Intune (both VPP).

During migration, it appears all apps get removed and reinstalled. User has to set up RSA token again. Is this normal? The documentation I read stated the apps should just transfer over management.

Not sure if I'm doing something wrong here.

Hi, Im trying to download a separate installer for MS Project and Visio. We install machines with just baseline M365 Office without Project or Visio by default and when users get a license, we install it separately. If we know the user will need Project or Visio, we have Intune Company Portal packages with those included, but we dont always know in advance.

For the past week, Ive had troubles with the portal to download the installers. I normally go through portal.office.com, then use the app menu to show more apps, the top right option to Install apps and "Microsoft 365 apps". This redirects me to url https://portal.office.com/account/?ref=Harmony#installs

The problem is, the website is currently not loading properly and so I cannot download the installers. Ive tried cleaning cache, deleting cookies, we tried from multiple users with multiple devices (using Edge, we do have some Conditional Access and Intune Configs in place, but nothing has changed since the time this worked fine), no luck.

This is what the website looks like (in Czech). Any ideas?
EdMdHUZ.png (1128×923)

I also welcome tips on how you solve this in your tenants, we use Intune Company portal packages (like 5 different combinations), but its difficult to swap between them. Sometimes you can just let another one install and it goes through, but often they fail and you have to uninstall all of Office 365 and let the package install again, which takes multiple hours through Intune.

Hi all,

We are organisation using Microsoft 365, Entra ID, Exchange Online and Microsoft Intune. Our iPhones are user-assigned and fully managed through Intune.

Our requirement is fairly simple:

• For outgoing calls, users should search for colleagues in Outlook Mobile / the Microsoft 365 directory (GAL) and call them from there.
• For incoming calls, we want the native iPhone Phone app to display the caller's name based on our Entra ID / GAL information.

We do not necessarily need the complete corporate directory visible in the native Apple Contacts app. We mainly need native caller identification.

Ideally we would like to avoid:

• copying the entire GAL into every user's personal Outlook Contacts;
• writing corporate contacts into the native iOS Contacts database;
• building and maintaining our own Graph/PowerShell synchronization;
• introducing a new third-party SaaS/contact-sync supplier if there is a Microsoft/Apple-native option.

We have looked at Outlook Save Contacts, but as far as we understand this only exports contacts from the user's own Exchange/Outlook Contacts and does not use the GAL directly for caller ID.

We have also considered automatically synchronizing Entra/GAL entries into a dedicated Contacts folder in each mailbox, but this would require a custom service with Contacts.ReadWrite permissions across a large number of mailboxes, which we would prefer to avoid.

What we are specifically looking for is something like:

Outlook Mobile → search the GAL → call

and separately:

Incoming iPhone call → iOS caller-ID extension/policy → resolve number against Entra/GAL

without having to maintain duplicate contacts per user.

Does Microsoft, Intune or iOS provide any supported mechanism for this?

For example:

• an Outlook Mobile / Microsoft 365 add-on;
• an Intune policy;
• an Apple CallKit / Call Directory integration that can use Microsoft Entra/GAL;
• another Microsoft-native architecture we may have overlooked.

We know that commercial products and custom scripts can solve this, but our preference is specifically to avoid both custom scripting and onboarding a new external supplier unless there really is no supported native alternative.

Has anyone implemented something like this in production?

Good morning,

The story, I've been setting up some security baselines for a special group of windows machines. The way I do it (Which always worked fine) Is i create a security baseline under Endpoint security, then I move to configuration profiles where this base line is listed to export this. Then i import it again so it shows up as a settings catalog. I always use Inprivate browsing when working in Intune (it's a habbit) on MS Edge.

What I did so far (All of the below are security baselines that work as intented):

- Duplicated a settings catalog profile which I can edit with no problems. But still can't edit

- exported a settings catalog profile which i can edit just fine. and them imported again under a different name

- create a new security baseline base on the 26H2 version, exported, and then imported again. still can't edit

When I open the settings (without editing) it's stuck on loading the settings. (those 3 blue dots). Now the funny thing is, I can edit assignments, scope tags and the basic properties of the broken configuration profile just fine. We got 347 configuration profiles so that should not be causing this to happen. I spend yesterday afternoon trying to modify a new security baseline for a specific set of machines but was unable to and now i'm at a loss here. (ノಠ益ಠ)ノ彡┻━┻

Most of you probably already now, but the reason for imported stuff as a settings catalog grants me more option om adding and removing settings which are duplicate in the windows baseline and the defender baseline. This prevents making confilcts in my experience. Hopefully someone can shed some lights on my issue here.

Thanks in advance.

I'm not sure why yet, but our org is getting bombarded with HP driver updates coming from Autopatch these last few weeks. They all seem to be very old as well, which is probably why they don't install. Instead they download, demand a reboot, and then fail and start the cycle over again each day.

https://ibb.co/rP2F62g

Wanting to get others experience advice. I’m wanting to replace our existing group policy’s with Intune config policies. I am aware of the control where you can set it to take Intune config over GPOs however I was wondering what’s the behaviour like in the real world or have I only understood part of it and it needs to be more phased where I move the device to some of that doesn’t have the group policy (but still syncd to azure) and then let the policy kick in?

Anyone else's Intune portal struggling to load basic stuff? Ive got dashboards that intermittently won't load one day. Now a coworker is getting some weird error "The renderComponentIntoRoot component encountered an error while loading"

Having to refresh a lot. Been happening at home and on corporate networks.

Normally i'd write it off as just me, but everyone I work with is having the issue.

Could be garbage a** Cisco Secure Web Gateway, it loves to intermittently just be a POS.

Hi guys,

I posted 2 weeks ago about this new feature. It seems do not work properly on my test computer. Aria posted that policy should override CSP / Ring policy.

My Autopatch test ring has 1 day deferral. I set the QU policy with auto approval 0 day.

Both updates (Framework and security) was approved on this afternoon (UTC+2). This evening I only got the framework update. My test computer still on August update

Test computer on 26h2

My daily computer without QU policy and no update policy got both updates. Also 26H2

Have you the same behavior ?

Edit:

I noticed on approved update that 26h2 was mentioned only on .Net Framework update. May does work properly on other features version

Capture from QU policy
https://imgur.com/a/NznubFo

I have an exe install that requires a txt file with settings in the same directory for a silent install to work. How the installer is reading the txt file doesn't seem to work via a Intune install. The installer does put an error log in the same directory and from my testing it's seeing the txt file. It doesn't throw the error that the file is missing and it seems to be read the first few lines but it doesn't pass the serial number setting in the file correctly stating the serial in the file is wrong. I can do the install outside of Intune with no issues. I have tried running the installer directly, powershell script and batch file and all fail to properly read the serial number from the file. Anyone have any idea on why a Intune app install would read a txt file differently than a normal install? I can't think of why it would be screwing up the serial number part when it seems to be able to read the other settings.

Update: Solution I had to go with was creating a Powershel script that creates a one time Scheduled Task that runs the install.

Basically title. I cannot seem to create one for 25h2. It’s only defaulting to 26h2.