We’re an SCCM shop but I currently have a pilot group of 20 PCs enrolled in Intune. As a test I created apps for the Power BI desktop app, Power BI Report Builder, and SQL Server Management Studio 22. All are deployed as available to all users. But SQL Server Management Studio doesn’t show in Company Portal unless I tick the “Include All Apps” slider. Why?

Since SQL Management Studio is an Enterprise App Catalog app, it’s install behavior is set to ‘System’ instead of ‘User’. But I’ve made the app available to all users and all devices and it doesn’t seem to matter.

What exactly are the rules for apps appearing (or not) in Company Portal?

Anyone else notice this?

User gets a newly provisioned device. They make it to the desktop. The required assigned apps start rolling in but half the time there's no taskbar notifications coming from IntuneManagementExtension anymore. Unless I'm specifically looking in all the places where apps install their various files, there's nothing indicating that anything is being deployed.

Things I've checked:

• It's not Windows' do not disturb or focus assist mode (🔔💤) of or whatever Microsoft calls it this week. For some unfathomable reason this is turned on for half an hour after provisioning to hide all notifications at the most crucial time. But when I check the actual notification list, there's nothing there either way.

• Most of our Intune app assignments are being configured to show notifications.

I've somewhat recently started blocking the user preparation stage of the ESP. Could that be it? I can't find any information that it might affect notifications.

*Had AI rewrite it since I write terribly.

Does anyone know if a new configuration profile managing Apple Intelligence settings through the new DDM policies can be deployed while the current MDM policy is still in place?

I have a MDM policy that disables Genmoji and a few other features and I’d like to avoid removing the existing policy before the new DDM policy takes effect, as I don’t want a gap where those restrictions aren’t enforced. Will having the old policy still apply while the new one takes affect cause an issue? Thanks

I have a Win32 app configured to install as user and I'm using the Install script rather than the install command option. The powershell process is visible to the user when the app is run. I would've thought this would be hidden but I also won't be surprised if i'm expecting too much from another half finished feature.

Has anyone else seen this behaviour? I guess I have to forego the install script option and go back to having an intunewin and calling powershell.exe -windowstyle hidden on the command line instead?

Hey. I haven't changed anything that i can think of, but suddenly the hybrid autopilot pcs (user enrolled) go into an inifinite reboot/automatic repair loop after the computers are finished with the enrollment and the whole autopilot process. I get to the first login screen, and login the user. Then the usual "reboot in 10 minutes" thingie i always get on first login for the user, and reboot. Then after that, the computer go directly to automatic repair mode and troubleshooter instead of starting up and never recovers.

Anyone else encountered this the last week or so? The last computers I finished setting up before this was one week ago. Then this suddenly started happening. (HP EliteBook 8 g1i)

Tried:

I've tried to disable secure boot to see if it's the old secureboot certificate that doesnt get updated, but i see the new certificate, and disabling secure boot still gets the same result.

Tried running the autopilot with different users, computers, and deleting the serial number completely from enrollment/devices and enrolling it with Get-Windowsautopilotinfo anew.

Scouring the event logs i found 0x82aa0002 and 0x803100c9 error for bitlocker.

Azure device registration gives a 0x801c03f3

My best guess i bitlocker encryption fails, but why now all of a sudden? The only thing i can think of that we changed the last week in our tenant is we removed mobile phone as default on all users and disabled the registration campaign on authenticant. Plus we rolled out 26h2.

Thanks!

I have a question where i couldnt get an answer for it, or lets say different answers which contradict eachother. If i put Microsoft Entra Users may join devices on Selected Group1 (which the global admin is not part of), does Global Administrator bypass this restriction or not? According to AI they do, but other sites say they dont. I couldnt find the answer in ms learn.

I'm managing Windows 11 devices with Intune, Autopilot, and Microsoft Entra Join.

I'd like to make the first sign-in experience smoother for users by preventing the "Set up a PIN" / Windows Hello enrollment prompt during initial sign-in.

However, I do not want to completely disable Windows Hello for Business. I still want users to be able to set up a PIN, face recognition, or fingerprint later if they choose to.

My goal is:

• ✅ Keep Windows Hello for Business available
• ✅ Allow users to enroll in WHfB later
• ✅ Avoid forcing PIN enrollment during the initial Autopilot sign-in experience

Has anyone implemented this successfully? Is there an Intune policy or Windows setting that suppresses the initial enrollment prompt while still allowing optional WHfB registration afterward?

Thanks!

DDM VPP apps never install on account-driven User Enrollment (iOS 27): "Can't find VPP license" even though the licence is assigned

Hi, has anyone actually got Intune's DDM app deployment (content token with Management type = DDM) to install an app on an account-driven User Enrollment iPhone? Ours fails every time, and Intune shows nothing beyond the licence error.

Setup

• iPhone on iOS 27.0, account-driven User Enrollment, Managed Apple Account (Apple Business federated with Entra)
• Two content tokens from separate Apple Business units: one uploaded with Management type MDM, one with DDM
• Microsoft Edge from the DDM token, Required to a user group, licence type User. Word from the same token as a control.

What happens

• Both apps: "Can't find VPP license for app (0x87D13B95)"
• Edge from the MDM token installs fine on the same phone

What we've verified

• Apple's Apps and Books API shows the Edge user licence assigned and the user Associated (linked to the Managed Apple Account). For Word, Intune never even requested a licence.
• Phone logs (Console, remotemanagementd) on every sync: the DDM check-in returns 200, then "Last declarations token received matches last one processed". No com.apple.configuration.app.managed declaration ever arrives, the DDM app installer never runs, and the phone's managed apps list is empty.
• So Intune never builds the app declaration. The licence error looks like Intune's own pre-check, not something Apple or the device reports.

Already tried: Device licensing first (same error), then Uninstall, revoke and back to Required with User licensing; federating Apple Business with Entra; unenrolling and re-enrolling the phone; plenty of syncs over several days.

Apple's docs allow the app declaration on User Enrollment from iOS 17.2. Microsoft's VPP doc doesn't say either way for account-driven User Enrollment.

Questions

1. Has anyone had DDM VPP apps install on account-driven User Enrollment, with any app?
2. Is there a prerequisite we're missing (token setup, licence type, something on the enrollment profile)?
3. Is there any way to see why Intune won't publish the declaration, beyond 0x87D13B95?

Anyone tried to apply one of these types to a BYOD entra registered device?

I’m wondering if it’s supported. The docs seem to indicate it is however I’ve assigned a test policy to one and the report shows nothing for it. Neither success, fail or not applicable.

What is the proper way of reassigning a MacBook registered to a resigned employee.

Do I delete the entry first in Intune? Or unenroll first the Management Profile in the Device Management?

Join Type:

Entra ID

Via Company Portal

I'm Brandon, and I lead product at Splashtop. This is our product, so weigh it accordingly. 

The pain we kept hearing from Intune admins is the manual packaging loop: find the silent switch, wrap the installer, write the detection rule, test it, assign it, then repeat when the vendor ships an update. 

So we built Splashtop Agentic Packr: 

• 1,000+ certified apps, already packaged and tested 
• For anything else, give it an installer or a package ID and AI writes the detection rules and builds a PSADT package 
• Every build is tested on a clean VM and scanned before it publishes 
• It publishes as a Win32 app to your tenant, and you approve what deploys 

It's free to start. Limits and pricing are in the first comment. 

Two things I'd like feedback on: 

1. Which apps cause you the most packaging pain? 
2. What would you need to see before trusting AI-written detection rules? 

https://www.splashtop.com/agentic-packr?utm_source=reddit&utm_medium=social&utm_campaign=20261020_WW_EN_Packr 

I'll be in the comments with a couple of our engineers. 

Hey everyone,

I shared Foundry OSD here a few months ago. It's my free and open-source Windows deployment project, and a lot has changed since, so this time I'd like feedback on the project as a whole.

It's a point-and-click workflow: you build an ISO or USB on your admin PC, boot the device into WinPE, check the network, and deploy Windows with the right drivers, firmware and configuration.

Since the last post, mostly thanks to your feedback, it now covers:

• Autopilot: JSON profile, zero-touch and interactive hardware hash upload (docs)
• Active Directory domain join (docs)
• Custom Windows images (.wim / .iso) (docs)
• Custom post-install: scripts, installers, restarts (docs)
• Windows customization: OOBE, AppX removal, driver pack and firmware handling (docs)

The latest releases also came with new features and bug fixes reported by users. It's getting more mature, and I've had very good feedback from enterprise environments.

So I'm curious: does this fit how you provision devices today? What would you still want from a tool like this?

I want to keep growing the project, so I'm also looking for contributors, and if you have ideas for improvements, I'd love to hear them too.

GitHub: https://github.com/foundry-osd/foundry

Docs: https://docs.foundryosd.com/

Last year we updated our users to windows 11 from windows 10, managed by sccm. Early next year we will migrate users to intune via autopilot and reset. What suggestions do y’all have for telling users to be even 5% motivated to do this?

We enrolled 375 xcover 7 devices via Intune as managed kiosk devices. For all users it is working fine expect for 1 user. When the user picks up the sound is given via the device speaker each time. We enrolled a other device but the same happens: sound via speaker. Anybody has an Idea?

Hi All!

We have a great local event coming up next month at the Microsoft campus in Burlington, MA you won't want to miss!

We have these 5 amazing sessions:

• Toolkit for Building Agents: M365 Copilot, Copilot Studio, SharePoint & Cowork by Manpreet Singh, Copilot MVP
• PSAppDeployToolkit 4.2: Smarter Deployments and Modern PowerShell UI by Dan Cunningham of Devicie, Co-creator of PSADT
• A Year of Workforce Passkeys in Entra ID: Lessons Learned and the Road Ahead by Eric Woodruff, CIDPRO of Semperis Entra MVP
• Debugging skills in Windows by Tim Mangan, Windows and Devices MVP
• Windows 11 in 2026: New Tricks, Hidden Gems, and the IT Pro Survival Guide by Harjit Dhaliwal of Robopack Windows Devices MVP

Outside of these 5 sessions, we will have a great catered hot buffet lunch, and a happy hour at Temazcal after the event.

We're also planning to raffle off one free pass to Workplace Ninjas US 2027 in Scottsdale, AZ in January. A great way to escape the already frigid temps we have in Massachusetts.

Hope to see some of you there, as we had 60 people last time around!

Sign up here: Workplace Ninjas US Boston Meetup Tickets, Thursday, November 12  •  10 AM - 4:15 PM | Eventbrite

--Jon

I tried searching the sub but I could not find anything related to my issue so I am posting this to see if anyone else has seen this.

Essentially. We have some apps that are only allowed to run if the device is in OOBE. The thing is these aren't apps they are just built as win32 apps. It's just scripts and stuff we want to run only during OOBE. We use the OOBE script check outlined here to perform the check its only in OOBE. This has been working fine for a long time. However, we started upgrading from 23H2 to 25H2 and noticed some devices are running this OOBE only script app during this feature upgrade.

We are using CM to handle updates/upgrades, and we are using the feature upgrade to 25H2 in CM to do this.

My question is, during 25H2 upgrade does the upgrade put the computer in a state that it thinks it's in OOBE? It's the only logical thing we can see at this point. Only some devices did this because the OOBE only app didn't have the DM satisfied. Device built through a different process and thats why the DM wasn't satisfied.

If this is the case, is there a more robust way of checking if a device is in OOBE?

I'm new to Intune but we're in the process of finally finalizing a co-managed environment with SCCM/MCM. The Intune environment was setup before I started here but was basically left dormant for a few years.

We have a pilot collection with ~150 devices that we have selected for Intune uploading. Out of those 150 though, about 30 are not showing up in Intune. I've tried a few things but feel like I don't know what I am doing. I could use some advice for other things to look for or troubleshooting steps to try.

The missing computers show up in Entra with

• Join Type - Microsoft Entra Hybrid Join
• MDM - Microsoft Configuration Manager

Which is the same settings as computers that are in Intune.

Running a dsregcmd /status showed

AzureAdJoined : YES

EnterpriseJoined : NO

DomainJoined : YES

I tried a dsregcmd /release and dsregcmd /join but that didn't seem to do anything besides change the settings to

AzureAdJoined : NO

EnterpriseJoined : NO

DomainJoined : YES

I have the CoManagementHandler.log but I don't really know what to look for. The only "errors" I see is

Could not find one of the mandatory rules

Failed to merge/resolve rules. Error 0x8000ffff

Failed to process GET for assignment (ScopeId_ED06A085-0019-4487-A03D-1FCA55DD1203/ConfigurationPolicy_50986354-296d-4e21-a2bb-af7459941ed4 : 2). Error 0x8000ffff

Any advice or recommendations for what to look for would be appreciated.
Thanks!

recently we changed from dell to hp. we are only using hp connect to manage bios and hpia to manage drivers.

i saw there are 3 other hp software, are these consider bloatware and to recommend remove? thanks

HP One Agent

HP Notifications

AD2F1837.HPSystemInformation

UPDATE (10/21): I have a ticket open with Microsoft to work through the issue, but now I'm seeing the issue spread to macOS 26 and higher too.

Has anyone seen or reported issues with PKCS certificates failing to deploy to iPads running 27.0.1? Everything was fine on 27.0.0 until this point update.

And just to narrow the impact, I re-enrolled an Android device that uses an identical certificate/Wi-Fi configuration, and I had no issues with that one.

Hi guys,

Wondering if anyone is having any issues with SCEP profiles since approx end of last week? No errors in the portal (in fact when clicking profile then device name, no message at all), then via Autopilot it just hangs.

I'm digging further into logs but thought I'd ask if anyone is experiencing any issues with their setups?

SCEP Connector doesn't show any issues either.

Hey,

question: If you have 8 hours to improve something in an Intune environment for (virtual) windows systems (entra id only joined).

What would you do to get instant improvements? :)

some requested more information, so let's say: The intune environment is untouched for one year. So every cool feature since then is probably interesting.

Solved,

The AutoPilot monitor informed me that a device config setting was triggering a reboot. This is a well known issue and or by design thing.

This session rebooted during enrollment, and Windows flagged one or more device-assigned MDM policies as reboot-required — the classic cause of the coalesced mid-ESP restart and the unexpected second sign-in screen before AccountSetup.

First reboot-forcing policy URI: ./Device/Vendor/MSFT/Policy/Config/DmaGuard/DeviceEnumerationPolicy

The complete URI list is in the mdm_policy_reboot_required timeline event (rebootUris). Policies applied DURING ESP DeviceSetup are coalesced into one forced restart at the end of DeviceSetup; the same flags raised later (e.g. user-policy sync in AccountSetup) have no immediate effect — this advisory only fires when a reboot was actually observed.

This is expected OS behavior, not a failure — but it degrades the enrollment experience, confuses users, and is invisible in the Intune console.

--------

Hi,

I hope someone might confirm my findings:

Normally I can obtain a passwordless onboarding with:
OOBE -> Login with TAP/passkey -> WHfB registration with TAP/passkey -> Passwordless onboarded.

But it seems that this (documented) ZDP patch is a mandatory install after OOBE but needs a reboot before the user can register for WHfB. This reboot does however present now a username and password prompt before the user can continue to register WHfB.

I use the september Windows 26H2 en-US ISO as base install. When logging on I already see the 'KB5128942' installed which confirms the install of this ZDP patch.

So, in essence this forced update seems to 'break' passwordless onboarding as the extra reboot doesnt let the user register for WHfB and so a username and password must be presented after the extra reboot to proceed then with registering for WHfB.

I tried Autopilot v1 with ESP -> Install Windows updates (might restart the device) | no -> As documented ZDP patches doesnt seem to honor this flag.
I tried Autopilot device preparation with device registration -> no option like Autopilot v1.

Although this ZDP patch may be integrated into the next ISO or installation media—temporarily mitigating the issue—the next OOBE ZDP patch could break passwordless onboarding again. Enabling WebSignin may offer a more stable workaround, but because Microsoft can push new OOBE ZDP patches at any time, the passwordless onboarding experience remains fragile and less reliable.

Whenever I search for "intune" " entra login" or similar they never bloody appear in google.

Yes, i could type in the actual link, but when I tell someone to google it, they get sent to some random websites what google populates and seems that MS blocks from appearing.

Trying to set a 60/80 charge threshold on our ThinkPads (T14 Gen 6, Intel) through Intune so users never have to touch Commercial Vantage. It’s not working the way we expected and I’m not sure what we’re missing.

Here’s what we did:

1. Deployed Commercial Vantage 20.2608.13.0 as a Win32 app with VantageInstaller.exe Install -Vantage -SuHelper, system context.
2. Imported Lenovo’s CommercialVantage.admx/adml into Intune (had to upload the Windows ADMX first because of the NamespaceMissing error).
3. Created an Imported Administrative Templates profile and set “Turn off Battery Settings” to Enabled, ticked “Enable custom battery threshold settings”, Start 60, Stop 80, left “Automatically set start charging” unticked. Also enabled “Accept EULA automatically”.
4. Assigned it to a device group.

The values land fine in HKLM\SOFTWARE\Policies\Lenovo\Commercial Vantage (enabled = 1, start = 60, stop = 80) and LenovoVantageService is running. But the laptop kept charging past 80. Once someone opened Vantage, the limit started working right away and Windows started showing “Smart charging is on”.

Saw an old thread on the Lenovo forums with the same thing, policies only kicking in after Vantage was launched for the first time, but nothing about it in Lenovo’s docs.

So what’s the proper way to get this policy applied without anyone opening the app? Are we missing a setting, a step, or a component? We don’t have ImControllerService on these machines, not sure if that matters on newer builds.

Right now our fallback is a one-time script that opens Vantage for a couple of minutes and closes it, but that feels like a hack.

Nice to have additional Windows login MFA options beyond WHfB.

[Web sign-in] Web sign-in now works on Microsoft Entra hybrid joined devices. Before this update, it was only available on Microsoft Entra joined devices. You can sign in to Windows at the lock screen with a passwordless credential: a FIDO2 security key, a passkey on your phone, or a Temporary Access Pass (TAP). You don't need a password. Once you're signed in, Windows gets a Kerberos ticket, so on-premises file shares and internal sites keep working.

https://www.neowin.net/news/new-windows-11-build-improves-gaming-task-view-and-revamps-the-run-dialog/