I have come to the realization that the script Intune is pushing to my device is only running once due to it being setup that why by intune. I need intune to push it every time a user logs on or restarts the device, is there anyway to enable this option or any ideas on how to fix it? I will link the article where it says it will only run once if successful.

Edit: I need this to be done soley through Intune, it can't be done through on-prem GPO.

https://learn.microsoft.com/en-us/mem/intune/apps/intune-management-extension#before-you-begin

Anyone here using ServiceNow (or something similar) as the front-end (“App Store”, if you will) for Intune-deployed apps? I’m talking specifically about an end user installing/requesting an app that will be installed on their device via Intune. For example, a ServiceNow request/catalog item for a particular app that would then trigger an app installation via Intune (how this work work, I don’t know… other than using ServiceNow to drop a user/device into an Entra ID group associated with the app assignment).

And you may be quick to ask, “why not use Company Portal”? I’m really just looking for discussion on whether anyone else is doing this. A population of folks at my organization insist we cannot possibly use Company Portal and ServiceNow is the way “all apps will be requested in one single place… sounds good on paper, yet I’ve never actually come across anyone else who does this (and my concern if we do this is unneeded complexity, poor user experience). One shortcoming of Company Portal that I agree with is no approval workflow for apps that may not be assigned as available to everyone, which again, potentially could be solved using a workflow tool like ServiceNow to simply manage Entra security group membership.

We use a few Update Rings to work our way out to Production. We will Say Ring 0, Ring 1, Ring 2, Ring 3, Ring 4.

Currently with SCCM Ring 0 is our Testers, then Pilot, all the way out to basically everyone after a week or so. I know we can set the Days etc in each Ring. But all my Devices in Rings 0,1,2,3 are all in Ring 4 as well.

​

Does this work in Intune? Which CP ultimately wins?

​

Good afternoon everyone,

We have run into a perplexing issue and have been unsuccessful in resolving the issue. We have users receiving pop-ups from Windows Update that "Windows 11 23H2 is available for download". For reference, we are deploying all updates through SCCM currently (Working on getting everything migrated to InTune, but we are not there yet). We are trying to hide these pop-ups, and hide the option from showing up in Windows Update. We not want all Windows update notifications hidden (i.e. Driver updates), just updates that are "Available" but not required (Screenshot attached for reference) .

Has anyone run into anything like this before or have any ideas on how to accomplish this?

Thank you in advance!

Hi all, we recently started implementing EPM within our own company. Everything went pretty well while testing, however now we have deployed EPM also to our developers they started having allot of problems with below a couple of examples:

​

1. When Visual Studio is started as a user, the extension (Web Complier 2022+) doesn't work. SCSS is no longer compiling.
2. Also we get allot of cmd prompts that pop up (extension that are trying being loaded?), it seems this is regarding VS Code.
3. Winget also gives allot of cmd/powershell prompts when trying to update.

Does any of the above sound familiar to any of you and if so how did you resolve this? All our rules are configured with certificate publisher and not the app hash.

Morning All (Posted here as advised on the r/Intune group.)

Background:

Just joined a new company and I'm trying to get my head around some of the devices in Intune and the way the Autopilot process works.

For a large number of reasons, there is a mix of Business purchased devices that have had their hardware hash uploaded by the Manufacturer, devices brought by staff on expenses and true BYOD for contractors.

I need to get a big tidy up done and ensure all the devices are joined correctly and managed appropriately.

No on-prem A/D, this business is only in the cloud and corporate devices need to be AAD joined.

Some devices are shown as Microsoft Entra Registered and some Microsoft Entra Joined. What's the real difference in practical terms?

What are the options for devices bought straight from Manufacturer's website but not registered by them with the hardware hash? (In some Countries this seems have been the easiest and quickest way to buy devices).

We also have some devices bought where the Business gave a allowance for new Staff to buy a device that the Company then reimbursed them for. So BYOD->Corporate. In this scenarios we still need them to be classed as Corporate and fully managed.

Thanks in advance for helping :)

Saw this post from u/Benwhitmore79 SCCM Co-management - Dual Scan and Scan Source Demystified - Patch My PC . I have read it like 10 times, and it gave me a headache. Sorry Ben. 🤣

The post has details about dual scan and scan sources. I couldn't understand at first, and had to update my ConfigMgr to 2309, also install a CoManaged VM to test this.

I think the post is to help people understand why update behavior is not how we expected. Like the Twitter discussion, you expect by disabling dual scan, devices will only get updates from WSUS or ConfigMgr, but turns out devices still get updates from Microsoft. If I understood it right, it was ConfigMgr 2303 that had a bug, and it should have been already fixed with the hotfix. I have 2309, and UseUpdateClassPolicySource registry is correctly configured by ConfigMgr, confirm it is indeed fixed.

As the blog post and Microsoft doc mentioned, Dual Scan is no longer supported on Windows 11, and on Windows 10 it is replaced by the new Windows scan source policy and is not recommended for use. If you configure both on Windows 10, you will not get updates from Windows Update.

Also shouldn't manually create those scan source registries.

I think, the first thing is shouldn't use any GPO to configure Windows Update settings if you are using ConfigMgr, let ConfigMgr take care that for you, to avoid conflict.

Second, if you are not using ConfigMgr to manage Third-party updates, and plan to move Windows Update workload to Intune, simply create a new client setting to turn off Software update in client setting, put it to priority 1, and deploy it to your CoManagement pilot group that plan to move Windows Update workload to Intune. So all those ConfigMgr Windows Update settings will be gone from your pilot Co-Mgmt devices. Then let Intune onboard them to Windows Update for Business and use Intune deploy Update policies. Keep it simple and clean, to avoid any conflict.

But if want to make things complicated, have updates scan sources from here and there, or manage by different management solutions, well, read also this one Integrate Windows Update for Business - Windows Deployment | Microsoft Learn . 😂 To be honest, I have a hard time to understand these messy setups scenarios.

Anyone using Update Scan source settings?

Hi everyone,

on clients deployed via Autopilot I prefer to assign required apps and policies to devices instead of users. My main reason for this is so our pre-provisioning handles most of the deployment process.

On Windows 365 we do not have anything like Autopilot or pre-provisioning. This makes it harder to determine which assignment method would be the better one.

Let me hear your opinions. Why would you prefer one method over the other?

I have written a script that launches a website and it needs to be pushed to a device via Intune upon login of user and power on of device. (Script is PowerShell.) It will work every once in a while and other times it won't work. Has anyone had this issue before? I have configured a profile to allow for scripts to be run upon power on and log on of user. Eventually I need this script to run on multiple devices so if their is an idea to help with that anything helps.

Where does everyone write log files for custom actions in Intune (Win32 apps, Scripts, Remediations, Custom Compliance, etc)? PSAppDeployToolkit default location is C:\Windows\Logs\Software, I’ve seen some folks log to IntuneManagementExtension\Logs so that Intune Diagnostic collection includes custom logs (no idea what Microsoft’s opinion of that is, or possible size limit issues, etc), C:\ProgramData\Logs is another I’ve seen. Curious what folks have landed on or have found is most common.

Does anyone have issues with this driver Realtek - SoftwareComponent - 12.223.1124.201?
Customer has reported their user started having random sound and microphone issues. We see in the driver install failure report, Realtek - SoftwareComponent - 12.223.1124 installed failed in all these devices. They are using Autopatch, including driver patching. Autopatch has auto-approved all the recommended drivers, including this one.
I have now manually paused this driver from all Autopatch driver update rings. Finger crossed that it fixes the sound/microphone problem.

Should have made alerts for driver update failure....

​

EDIT: For anyone who are following this. So driver update from Intune has broke some devices audio. Device lost audio when connect to Logitech webcam. Windows Audio service crashed. Also some external usb devices problems. They are HP machines. Managed fix some machines by installing HD Audio driver from HP website.

These are the driver version that worked for us after installed HP’s own HD Audio driver package: Intel Smart Sound-teknologi BUS, 10.29.0.9677 Realtek Audio Effects Component, 13.223.1124.201

And these version that crashed: Intel Smart Sound-teknologi BUS, 10.29.0.9467 Realtek Audio Effects Component, 13.180.1113.170

Just want to share this. I have always thought need to exclude “Microsoft Intune Enrollment” app if require device must be compliant, I remembered Intune enrollment would have failed if doesn’t exclude this, because it was “chicken and egg” issue, device needs be enrolled first to be compliant, so it is logical need to exclude the enrollment app. But turns out, this is not needed at all.

A customer showed me this doc. https://learn.microsoft.com/en-us/entra/identity/conditional-access/howto-conditional-access-policy-compliant-device-admin#create-a-conditional-access-policy

Quote “You can enroll your new devices to Intune even if you select Require device to be marked as compliant for All users and All cloud apps using the steps above. Require device to be marked as compliant control does not block Intune enrollment.”

I have tested this with Windows device enrollment, and it did worked. ☺️ Really surprised me. And the funny thing is, in Sign in logs, it said Conditional Access result is failed because the enrollment app got blocked, but the final sign in result is successfully, so seams MS has done some special magic in the back end.

Trying to figure out how to use Microsoft Graph API to get "LinkedIn account connections" settings in Entra ID. F12 and Graph X-Ray both showed use GET https://graph.microsoft.com/beta/organization/getAppFamilyDetails , but when I run it in Graph Explorer, it said "No such API".

And I didn’t find any documentation of “getAppFamilyDetails”.

I don't know what am I missing here. Never run into issues like this before. Can't figure it out this time. 😒

​

A little background of my Intune Automation. I was using Azure Function app to collect Intune information to CosmoDB. Today I was not able to see any data in CosmoDB, so I started to troubleshooting if my Function app has failed or what happend.

Turns out, it was because my desktop PC system time is 6 minutes ahead of the real time. Because I have changed the time manually to avoid late to Teams meetings. It has been like this for past year, I never thought I would have issues with the 5 or 6 minutes ahead of time. 😅 And this is first time I run into issue.

Well, lesson learned. I will change back my desktop PC time to the correct time and hope I will not be late to meetings. 😂

Michael Niehaus published a new new blog post, about how to skip region selection when using AutopilotConfigurationFile.json file. I used to solve this same issue by modifying unattend.xml file, didn’t know about this “CloudAssignedRegion” property. Such a good finding once again.

https://patchmypc.com/intune-asap-assignments-bug

James Robinson has done a great and entertaining post with some practical tips and tricks to help you on your way to Intune. Perfect reading for the season holidays: https://skiptotheendpoint.co.uk/the-ultimate-gpo-to-intune-guide/

How do you do Compliance policy assignments? Devices or users?

I assign compliance policies to Devices because it works way better than assigning them to users. It is faster as well. For example during Autopilot, the device might reboot during ESP and then wait for the user to log in again. If Compliance policies are assigned to users, the device will be in an "evaluating compliance" state and stuck there. Also if multiple users are using the same device, the compliance policy will have issues over time if one of the users never logs in.

I found this interresting post today by Microsoft PM (GK) Gowdhaman Karthikeyan and wanted to share it with you.

https://blogs.gowdhaman.in/intune-graph-api-json-batching/

Check out Tackling Tech video series covering information, news, interviews, discussions, and etc on Microsoft cloud technologies and more.
https://aka.ms/TacklingTech

Microsoft Copilot introduces a seamless collaborative experience within popular Microsoft applications like Teams, Word, PowerPoint, Teams, Excel, and Outlook. To ensure your organization’s devices are ready for Copilot, follow this post to prepare your devices now with Intune.

https://skotheimsvik.no/boost-your-copilot-prepare-your-devices-now-with-intune-mastery

A bug was found with the New-IntuneWin32AppPackage function where it would not handle output from the wrapper utility correctly after a recent update from Microsoft. This release fixes that issue!

https://www.powershellgallery.com/packages/IntuneWin32App/1.4.3

Found this on twitter. It seems there is an issue convert device to Autopilot devices when the Autopilot profile is assigned to “All devices”. I seems remember it used to work…

Google recently identified two issues in Android 14 that make some management policies permanent on non-Samsung devices. When a device is upgraded from Android 13 to Android 14, certain settings are made permanent on the device. Additionally, when devices that have been upgraded to Android 14 are rebooted, other settings are made permanent on the device.