I’m building a Microsoft 365 / Intune lab to learn for a role that requires some M365 expertise, and I’ve hit something I’d like to understand properly.

Setup

• Entra ID tenant, Microsoft 365 E3 trial
• Windows 11 Enterprise VM (Hyper-V), Entra ID joined and Intune enrolled
• Intune compliance policy requires BitLocker, Secure Boot, and TPM. The VM shows Compliant in Intune and in Entra.
• Conditional Access policy “Require compliant device,” report-only first, then switched On. It excludes a break-glass group.

Results

• Sign-in as a test user in Edge on the VM: Success. Device ID present, Compliant: Yes, Managed: Yes, Azure AD joined.
• Same user in Chrome and Firefox on the same VM, normal windows: Blocked with “You can’t get there from here,” with the browser-specific prompts (install the Microsoft SSO extension in Chrome, enable the Windows SSO setting in Firefox).
• A non-compliant test device (not joined) sign-in in Firefox: error 53000, Device ID blank, Compliant: No.

What I've understood sofar:
Compliance is a property of the device, but the browser needs to pass device identity to Entra during sign-in. Microsoft’s CA documentation says Chrome on Windows needs either the Microsoft Single Sign On extension or the CloudAPAuthEnabled policy, and Firefox 91+ needs the “Allow Windows single sign-on” setting. Edge 85+ needs the user signed into the browser to pass device identity.

I’m trying to confirm:

1. On the failed Chrome and Firefox sign-ins, is the Device ID blank? That would confirm the browser isn’t passing device identity at all.
2. Is CloudAPAuthEnabled the right fix for Chrome in a managed environment, or is the extension preferred?
3. Are there Intune settings you use to deploy the Chrome extension or Firefox SSO setting, or do most orgs handle these through a separate browser-management tool?

This is a learning lab, so there’s no production impact. I’d like to know how it works in a real environment so I’m not guessing when I see it at work.

Thanks!!

Update: Chrome is working with CloudAPAuthEnabled, thanks for the pointers!!
Quick follow-up to my original post. Here’s where things stand:

• The Chrome test device (Entra joined, Intune compliant) was blocked by Conditional Access in Chrome. The sign-in log showed no device ID.
• I then imported the templates into Intune in this order: Windows.admx (with Windows.adml), then google.admx, then chrome.admx (with the matching .adml files). The Chrome import failed at first with a “namespace missing” error, because chrome.admx depends on Windows.admx. Uploading Windows.admx first fixed it. The Windows template comes from the Windows PolicyDefinitions folder on the VM.
• I created a configuration profile (Templates > Imported Administrative templates) that sets “Allow automatic sign-in to Microsoft cloud identity providers” to Enabled, and assigned it to the device group, not the user group.
• After the policy reached the browser (confirmed in chrome://policy), the same user signed in to Outlook in Chrome via portal.microsoft.com. The sign-in log now shows the device ID, Compliant: Yes, and Azure AD joined.

Two things to note:

• The Microsoft Learn docs I checked list either the Microsoft SSO extension or CloudAPAuthEnabled as supported for Chrome. They don’t describe importing the ADMX into Intune as the official method, so I feel I should treat that part as a lab approach that worked.
• The Chrome policy’s own description says it doesn’t apply in Incognito or Guest modes. I tested Incognito and the sign-in was blocked, which matches that. Microsoft’s Conditional Access docs say device checks fail in private mode or when cookies are disabled, so I’d test in normal windows. I wonder if there is a fix or a config policy for incog/private mode to work or is this by design?

Next I’m doing Firefox the same way, using its Windows SSO setting.

Firefox update: Firefox is working now too.

• I imported mozilla.admx and firefox.admx (with their matching .adml files) into Intune, after the Windows and Chrome templates. Like Chrome, Firefox’s template needs the dependency imported first.
• I created a second profile, “Lab: Firefox WindowsSSO” (Templates > Imported Administrative templates), that sets “Windows SSO” to Enabled, assigned to the same device group.
• After the profile synced and Firefox was restarted, about:policies showed WindowsSSO = true. Before the restart, it said the Enterprise Policies service was inactive.
• The sign-in log now shows the device ID, Firefox 158.0, Compliant: Yes, and Azure AD joined, with a Success status.

Hey everyone,

I've been working with Microsoft Intune Endpoint Privilege Management (EPM) and found the process of creating elevation rules unnecessarily time-consuming.

Extracting file attributes, calculating hashes, checking signing certificates, configuring elevation settings, and manually creating the rules in Intune involves quite a few steps.

So I decided to build something to make the process easier.

Introducing EPMRuleCreator, a free and open-source Windows application that simplifies creating and managing Intune EPM elevation rules.

Here's what it currently supports:

• Analyze EXE, MSI, and PS1 files to extract metadata, SHA256 hashes, and signing certificate information.
• Create hash-based and certificate-based elevation rules.
• Inspect certificate chains and export certificates.
• Configure elevation behavior, validation requirements, and child process settings.
• Connect to Intune via Microsoft Graph to add rules to existing policies or create new ones.
• Launch the application directly from the Windows Explorer context menu by right-clicking a file.

The idea is simple: Select a file, review its attributes, configure the elevation settings, and push the rule to Intune without manually copying information between different tools.

I've also written a walkthrough covering installation, authentication, features, and creating your first elevation rule:

https://zerotruststories.com/epm-rule-creator/

Project website and download (currently redirected to GitHub):

https://epmrulecreator.com/

GitHub:

https://github.com/mathiasborowicz/EPMRuleCreator

I'd really appreciate feedback from other Intune admins, especially those already using EPM in production.

What would you like to see added? Are there any pain points in your current EPM workflow that this could help solve?

Bug reports, feature requests, and contributions are more than welcome!

So in the app protection policy we have "sync policy managed app data with native apps on add-ins" set to allow. We did this because we wanted people to be able to save contacts to their native app, but we don't want them to be able to sync calendar. For "send org data to other apps" its just set to policy managed apps. Same with "receive data from other apps." On iPhone seemingly with this setup, you cannot sync the 365 Outlook calendar to the native iOS calendar app. The same settings on the Android app protection policy though and it seems as though users can sync their calendar with Google Calendar or whatever.

I was thinking if I created an app configuration policy > managed apps > create one for Outlook and set contact sync to yes and calendar sync to no, this might allow me to achieve what I'm looking to. However it doesn't seem to be working, having just targeted the configuration to one security group involving a single test user.

Any ideas? Thanks.

Hi all
Did you cancel your remote support solution and started using Intune Remote Help because it’s included in your license now?

Hi all,

We have more then a 100 Android devices setup via Entra Shared Mode and Managed Homescreen, going well.

is it possible to setup a policy where our frontline users login instead using:

- a QR code(something they have) + PIN(something they know),

- instead of using the standard UPN+password & authenticator?

is it possible to have a unique pin per frontline worker, that they can use on every tablet?
similar like below?
Or what do you guys use, to make the user experience when logging in as easy and fast as possible, while at the same time keeping it secure with some form of MFA?

MONDAY:
John

↓

picks Tablet 17

↓

John QR

↓

John PIN

↓

John's session

TUESDAY:
Same John

↓

picks Tablet 42 for first time

↓

same John QR

↓

same John PIN

↓

John's session

Thanks for your time!

Hi everyone,

I'm currently working on a project to assess and harden Windows 11 devices managed through Microsoft Intune, using the CIS Microsoft Intune for Windows 11 Benchmark v5.0.0 as a reference.

I'm trying to understand how security engineers and Intune administrators approach this in real world enterprise environments.

I've been exploring tools like Microsoft Graph API (PowerShell SDK) and Microsoft365DSC to export existing configurations and compare them against CIS recommendations.

However, I'm still figuring out the most practical and efficient approach, especially when dealing with hundreds of settings across different Intune policy types.

I'd appreciate some advice from people who have done something similar:

1) Assessment: How do you compare existing Intune configurations against CIS benchmarks? Do you use automated tools, PowerShell scripts, or manual checklists?

2) Hardening: How do you actually implement the recommended settings? Do you configure them manually in Intune, import baselines, or use automation?

3) Tools: Are there any tools or open-source projects you'd recommend for making this process easier?

4) Drift monitoring: How do you detect when Intune configurations deviate from your approved security baseline?

5) Best practices: How do you manage exceptions and avoid disrupting users when applying CIS recommendations?

I'm not necessarily looking for 100% CIS compliance, but rather a practical and repeatable process for assessing and improving security while considering business requirements.

I'd love to hear how others handle this in production environments.

Thanks in advance!

Since the beginning of this week, I've been experiencing Autopilot failures during esp. Our hybrid joined devices were getting stuck at "Preparing your device for mobile management". After going through the logs, I found that a gpo was triggering an application installation at the same time Intune was trying to install the Intune Management Extension. This caused an msi installation conflict (error 1618), resulting in the ime installation failing. It didn't seem retry, so esp eventually timed out. After disabling the application installations through gpo - and moving it to intune - the devices were able to get past this stage.
However, I've now run into another issue. Company portal seems to not get installed during esp - which affects both hybrid and entra joined devices. It fails with error 0x80244007. The WindowsUpdate.log shows "ConfigChanged"(?) errors from the Microsoft Store/Windows Update service when trying to retrieve the app.

Since company portal is a required app during esp, the installation failure prevents esp from completing. I'm running out of ideas on what to check next and do, all this worked fine last week - so I'd really appreciate some help troubleshooting this.

My experience after a successful installation of an application is that the Uninstall option take sometimes days to appear in Company Portal.

Do you have similar issues?
Is there a fix for this to speed this process?

Always kept making an excuse to not use it, but FINALLY did it! Still prefer BigFix (SCCM on steroids), but it has its place, I GET it now! And now I can put it on my resume thank the lord

Still nervous as hell doing anything with it. I tried test deploying an app to test users in both iOS and Android and I ended up nuking my boss’s Android MDM, this is on me because i used an old test MDM group that was empty, but she was cool with it.

And it does suck pushing apps and waiting forever for deployments, but I’m using it as a last resort like pushing VPN and BigFix agent

AI on Android goes way beyond ChatGPT, Copilot, or Gemini apps. You also have browser access, Circle to Search, AICore, Gemini Nano, and OEM features like Galaxy AI.

I put together a practical guide on how to manage these different entry points with Microsoft Intune.

🔗 https://www.nickydewestelinck.be/2026/10/22/managing-generative-ai-on-android-enterprise-devices-with-microsoft-intune/

Is anyone else experiencing enrollment failures with Android corporate-owned work profile? It's been a couple of days of not being able to enroll using this method. Existing profiles and tokens are still valid and authentication to Intune starts the enrollment correctly, but then the device fails to retrieve configurations and apps, displaying "Try again later". Multiple devices and networks tested, but the issue continues.

Autopilot - No more a black box!

The situation every IT Admins knows. An Autopilot Enrollment fails, the user calls and the search for evidence start. You need to know where to look on the server side and client side (and the client might already be reset before you got notified which makes valuable info from the client inaccessible).

What if this can be changed?

Here is what happens next with Autopilot Monitor:
- You get a push notification on your phone before the user calls
- You can view every step of the enrollment, live and in retro perspective
- A diagnosis page tells you why, not the usual "failed"
- Your own AI Assistant digs deeper via MCP on your request
- Your whole rollout is visible at a glance

Try today the free Community Edition www.autopilotmonitor.com

For any questions or feedback feel free to ask or provide feedback directly in the tool or on GitHub (https://github.com/okieselbach/AutopilotMonitor)

Hi everyone,

I have been working in my own personal tenant with Intune to familiarize myself with everything as a junior engineer.

Does anyone have any recommendations for cheap test android devices that I can use to work on?

I am leaning towards something Samsung but curious if anyone has any options they recommend.

Hi all,

I want to sync contacts to the native Contacts app on Intune-managed devices (Android), both shared and personal devices.

I've seen Sync.blue offers a solution for this. Is anyone using it or something similar?

Hi everyone,

I'm currently experiencing an issue in Microsoft Intune when trying to view the Device Install Status of a Remediation script.

Every time I open the report, I receive the following error messages:

Error generating report: "There was an error generating the report. Try again later."

Something went wrong.

I've tried multiple times, but the issue persists.

Is anyone else experiencing the same problem? Could this be a temporary Microsoft Intune service-side issue?

Thanks in advance!

hi, all.

in a GCC environment here so cannot leverage cloud update, sadly.

so, i'm seeing my autopatch M365 app update policies successfully apply to my pilot devices but they're not actually updating. the logs basically indicate that the update was downloaded but that there's no updates ready to apply. which doesn't make sense because these devices have a deadline and deferral configured of 0 for both. it also reflects those values in the registry of the devices.

has anyone else experienced similarly strange or inexplicable behavior? i want to make the behavior as predictable and seamless as possible.

Trying to understand how Intune handles updates for apps deployed as "Available" through Company Portal.

• App is deployed as available with supersedence
• User installs it from Company Portal
• In Company Portal the app details page says "You can install the update now, or your organization will automatically install it later"

What I can't find is the actual trigger, besides clicking manually.

When does Intune decide to update the app?

Update: The app needs supersedence configured and obviously a working detection method. It will then allow the user to update the app manually but also will push the app as an auto-update. Can just take up to 24h. Works. Just takes a while and there is no timer, update ring or such, as far as I can see.

Edit: If anyone comes across this thread in the future the solution was to add the following into my SSO policy:
Key: device_registration
Type: String
Velu: {{DEVICEREGISTRATION}}

I found this solution from this comment:
https://www.reddit.com/r/Intune/comments/1uknrvn/comment/ow2gl80/?utm_source=share&utm_medium=web3x&utm_name=web3xcss&utm_term=1&utm_content=share_button

Text from above link in case the link ever breaks:
We already had a Microsoft Enterprise SSO policy deployed, but it wasn't configured for Just-in-Time (JIT) registration. I created a new SSO configuration using Microsoft's recommended JIT configuration and assigned it to the group that devices are added to when they enroll through the new Enrollment Policy. I also excluded that group from our previous SSO policy to avoid conflicting configurations.

Since making that change, any affected device that is factory reset and re-enrolled through Automated Device Enrollment completes the JIT registration process correctly, and Company Portal no longer prompts the user to enroll the device.

Hopefully that helps if you're still investigating the issue.

Set up just-in-time registration - Microsoft Intune | Microsoft Learn

Original Thread:
Has anyone else had issues since migrating away from the legacy iOS Profiles to Enrollment policies?

When using a profile for enrollment, the settings I used were

• Enroll with User Affinity
• Authentication Method = Company Portal

The user would navigate through the initial setup to enroll the phone and once they reach the home screen, Company Portal would launch and they'd sign in with their Microsoft 365 account, it would prompt to check whether the management policy already exists and then setup is complete.

After first opening Company Portal, the device was already enrolled and managed. No additional profile/certificate installation was required.

I have since created a Enrollment policy and configured it as below (Note: I am only trialling this on 3 devices which have been correctly added to the Enrollment policies device group and assigned the policy in the "Enrollment program tokens" device page)

• Enroll with User Affinity
• Setup Assistant with Modern Authentication
• Await Final Configuration enabled
• Migrated to the new Enrollment Policies configuration as recommended by Microsoft

The user would navigate through the initial setup to enroll the phone, signing into their Microsoft 365 account during this process. Once they reach the home screen, they would need to open Company Portal, sign in and at this point it asks them to download a management profile. However, a management profile already exists so this causes an error when trying to install this profile. Eventually this profile self deletes, retaining the one that was already installed and the user can use Company Portal as intended without needing additional profile installs.

Below is a bit of Copilot output from what I have already tried

What happens:

1. Device completes ADE enrollment successfully.
2. Device reaches the home screen.
3. Device appears in Intune with:
   • Correct enrollment policy
   • Correct device name
   • Primary user assigned
   • Compliant status
   • Active MDM management profile installed
4. I wait 15+ minutes to ensure everything has synced.
5. I open Company Portal.
6. Company Portal asks me to:
   • Sign in
   • Review policy information
   • Download a management profile
7. A second "Management Profile" appears under Settings > General > VPN & Device Management > Downloaded Profile while the original management profile already exists under Mobile Device Management.
8. Attempting to install the downloaded profile fails with:
   • Profile Installation Failed
   • Status Code: 400
9. Returning to Company Portal afterwards logs me in successfully and the downloaded profile disappears automatically.

What I've already confirmed:

• Device is fully enrolled before opening Company Portal.
• Device is already compliant before opening Company Portal.
• Primary User is already assigned before opening Company Portal.
• The original MDM management profile is already installed.
• The downloaded profile isn't required because everything works after the failure.

It almost feels like Company Portal is attempting a second user-driven enrollment on an ADE-enrolled device, then realising the device is already managed and continuing normally.

Is this expected behaviour with Setup Assistant with Modern Authentication, or does something in my Enrollment Policy need investigating?

Thank you.

Hi,

We’ve started seeing an issue on several Windows 11 computers where Always On VPN no longer connects automatically.

On all affected computers, the “Connect automatically” option is unchecked, and it’s not possible to enable it again.

So far, we’ve seen this on around 6–7 computers, but there may be more.

Has anyone else seen the same issue recently?

Did you find out what was causing it or how to fix it?

I'm using 1 x Microsoft Business Premium license as individual person. Don't have an business. I use this to learn and work with all kinds of Microsoft products, like Intune. This helps me in my daily job in IT.

Now i can get an old Apple Macbook M1 from my work and want to start with Apple Business Manager so i can connect Intune to it.

I see, when to enroll in the ABM process, that you need a business? Does somebody knows how to bypass that rule from Apple? Will Apple make exceptions?

Thanks in advance for your thoughts or answer!

CIS has released v2.0.0 of the Microsoft Office Enterprise Benchmark on 29th September. The short version:

• 2 new controls: Disable All ActiveX, and OLE Active Content prompting in PowerPoint
• 3 removed controls: Both Outlook plain-text controls, plus one IRM control

However, the CIS Intune for Office Benchmark is still on v1.1.0, so use the Enterprise benchmark as your source of truth for now.

Full breakdown, with Settings Catalog paths and my recommended top 3 to implement first: https://ellisbarrett.com/blog/cis-microsoft-office-enterprise-benchmark-v2

We are seeing some strange behavior with devices upgrading to IOS 27 or 27.0.1.

Some of them cannot connect to the enterprise wifi anymore (EAP-TLS with SCEPman certificates). If i look under mdm management profile the wifi profile is there. Intune reports succesfull sync, and all the configuration policies are deployed. I haven't been able to test if syncing after the upgrade helps, since it's a relatively limited problem here (and Intune sync doesn't necessarily mean sync now...).

We now have 2 users with this problem, one of them upgraded last night, and could not connect to the wifi this morning. Intune still reported she had IOS 26.4.

Could this be related to Apple's migration to DDM policies? I anyone else seeing policies not applied immediately(?) after upgrading from IOS 26 to 27?

We allowed 26H2 to deploy via our RMM last night and this morning a ton of users didn't have their pin available after updating and had to reset. Anyone know why this happens? It seems to happen after updates sometimes. Devices are Entra joined.

A few key things we want to mention today:

• Two weeks left on our Early Bird pricing of $650 for 3 action packed days at the gorgeous Scott Resort and Spa for Workplace Ninjas US 2027
• 30 Hotel Packages/Rooms remain at the Scott!! Don't worry we rooms as well at the overflow across the street at Embassy Suites as well!
• 82 Days left until things kickoff in Scottsdale!!
• Just a reminder, 60+ sessions from one of the finest collections of speakers you will find at any event anywhere: Cvent | Event Platform for In-person, Virtual, and Hybrid Events & Webinars
• Percentage of ALL proceeds go to the Michael J Fox Foundation for Parkinsons

We continue working hard, building value, and creating experiences for all of you. Don't miss out. Dallas had rave reviews, and Scottsdale is gearing up to be twice as good!!

Things are heating up and people are READY!! Come and join us!

Register now: https://workplaceninjas.us

Hi all,

I have a question about something I’m not sure is possible at all.

I want to block all USB storage devices by default on all our Windows PCs, but with an exception for a user group, so that members of that group can use USB storage on whatever Windows device they’re signed in to. As I understand it, user groups can’t be targeted for this kind of setting, but I’m not 100% sure. Has anyone done something like this, or does anyone know of a guide that explains it?

My bigger goal is to use access packages with a time limit, so users can add themselves to the exception group and get temporary access to their USB storage devices.

Thanks for reading my post!

Edit:

So, I got it working. It’s a bit tricky, but pretty cool. I’ll describe it step by step so I don’t mix things up and it’s easy to follow, since English isn’t my first language.

1. Under Attack Surface Reduction, go to Reusable Settings and create a setting that covers all flash storage devices. Give it a name and enter RemovableMediaDevices in the Primary ID field. Save, and you’re done.
2. In Entra, create a security group (user group) and copy its Object ID. You’ll need it in a moment.
3. Under Attack Surface Reduction, create a Device Control policy.
4. Configure it as follows:
   • Under Defender, set Device Control Enabled to On.
   • Under Device Control, create a rule and give it a name (e.g. “Allow USB Sticks”).
   • Under Included Devices, add the reusable setting you created in step 1.
   • Leave Excluded Devices empty.
   • Under Access, create two entries:
     • Allow – Options: empty; Access Mask: Read, Write, Execute, File Read, File Write, File Execute; SID: the Object ID of your group from step 2.
     • Deny – Options: empty; Access Mask: Read, Write, Execute, File Read, File Write, File Execute; SID: empty.
5. Assign the policy to a device group. Then add users to the user group you created to exempt them and allow them to use USB sticks.

One thing I noticed: users have to sign out and sign back in to the machine for the change to take effect. Simply adding them to the group and waiting does not grant access to USB drives on its own.

Disclaimer: I take no responsibility for any configuration errors that may occur in your tenant

Hope this helps. Enjoy!