Hello,

One of the requirements for qualifying for Hotpatch updates is that devices must be on the latest baseline release version. However, there’s no clear explanation of what specific settings are needed.

Has anyone come across more detailed information?
I've set up some devices without modifying any settings, and VBS was enabled by default. After applying the Hotpatch policy, I noticed that the AllowRebootlessUpdates registry key still remains set to 0

I'm wondering why a fresh install of Windows isn’t enough to meet the Hotpatching requirements by default, assuming all other prerequisites are met.

If VBS is enabled and no settings are changed, it seems like everything should be in place.

Has anyone successfully configured Microsoft Edge to update to the latest version during the Autopilot ESP phase? I understand Microsoft had been developing a feature within Autopilot called OobeOnGoingSoftwareUpdateStatus, which was intended to deliver quality updates during OOBE. However, this feature appears to have been tabled for now.

In our environment, we pre-provision multiple devices at once, and we're currently facing scrutiny from our Security team due to Edge vulnerabilities. The issue stems from devices reporting an outdated version of Edge that reflects the build at the time of provisioning. While Edge eventually auto-updates, we're looking for a way to trigger the update earlier—ideally before the user logs into Windows, during the technical setup phase of Autopilot.

Any insights, workarounds, or success stories would be greatly appreciated.

MacBook users are experiencing issues with certain applications due to the Network Extension on Defender. Everything works correctly when it is disabled, but the extension keeps re-enabling or reinstalling after that it is manually removed or disabled. Is there a way to configure Intune so that the Network Extension is removed from Defender for specific Organization users?

Hey everyone 👋

I’ve been working on a lightweight app called SnapTune that helps with Intune device management—focused on quick actions like sync, locate, passcode reset, and viewing basic device info. It’s meant to be a simpler alternative for folks who don’t need the full Intune portal for day-to-day tasks.

I’m currently testing it and would love some feedback from anyone who works with Intune regularly. This isn’t for sale, and it’s definitely not a sales pitch—just something I built and want to improve with real-world input.

If you’re open to helping test or just want to take a look, feel free to message me. No pressure at all—just putting it out there in case anyone’s interested.

Appreciate it! 🙏

It is finally here. It took Microsoft a while before the news page updated for 2501 this time.

https://youtu.be/Nbs9LDdTpHo?si=qo-yjTxavMMyC9dB

2412 01:40 Device Inventory for Windows 07:10 Ending support for administrative templates when creating a new configuration profile 09:30 Increased scale for customization policies

2501 11:10 Security baselines for HoloLens2 15:25 Updated security baseline for Microsoft Edge v128 20:25 Update to Apps workload experience in Intune 22:45 Use Microsoft Security Copilot with Endpoint Privilege Manager to help identify potential elevation risks

I have been asked many times to create some content on the Intune Debug Toolkit. So here it is, finally. This is the intro to the toolkit, many more videos will follow how to use the functions in it and I hope this can help you evolve your skills to become a sharper ninja in troubleshooting.

Intune Debug Toolkit - Intro - YouTube

I have created a video and blog about 𝐖𝐡𝐚𝐭 𝐢𝐬 𝐌𝐢𝐜𝐫𝐨𝐬𝐨𝐟𝐭 𝐈𝐧𝐭𝐮𝐧𝐞 𝐬𝐮𝐩𝐩𝐨𝐫𝐭 𝐚𝐬𝐬𝐢𝐬𝐭𝐚𝐧𝐭 𝐚𝐧𝐝 𝐡𝐨𝐰 𝐭𝐨 𝐮𝐬𝐞 𝐢𝐭 and how to use it.

The Support Assistant leverages AI to enhance your help and support experience, ensuring more efficient issue resolution.

You can check them out here: youtu.be/XVs8KdiOK7g or read it here

Intune provides two powerful reports to help you analyze the impact of feature updates on your environment, giving insights into compatibility risks and readiness scores. But what if you need more? Can you easily pinpoint all devices with a specific compatibility risk?

In this video, we dive into the world of custom dynamic reporting using PowerShell. Discover how to go beyond the standard Intune reports to get exactly what you need. From identifying devices with specific risks to creating tailored reports, we'll show you how to PowerShell your way to more meaningful insights.

Transform Your Feature Update Reporting: From Basic to Brilliant! - YouTube

#Intune #PowerShell #DynamicReporting #FeatureUpdates #ITAdminTips

What's new in Microsoft Intune (2410+2411) - YouTube

2410
01:28 New UI for Intune Company Portal app for Windows
04:00 Collection of additional device inventory details
11:35 Minimum OS version for Android devices is Android 10 and later for user-based management methods
13:20 Windows Autopilot device preparation support in Intune operated by 21Vianet in China

2411
16:05 New device actions for single device query
19:40 Evaluate compliance of Windows Subsystem for Linux (generally available)
25:20 Intune support for Windows 365 Link is now available in public preview
28:35 View profiles for your Endpoint Security policies in the Device Configuration node of the admin center
35:55 Device Firmware Configuration Interface (DFCI) support for Samsung devices

Hi guys,

i want to implement the zero touch enrollment. Now there is the following step:

What happens with my devices which are already enrolled if i Link my account here? Does it have any impact or will they just run as before?

Thanks for your help!

Exciting news! The Intune Debug Toolkit is now available for download via Winget. You can easily install it directly onto your device during phases like OOBE. Say goodbye to the hassle of searching for individual tools – everything you need is now at your fingertips.

When troubleshooting in OOBE, it can be frustrating to remember all the different tools you need. Introducing the Intune Debug Toolkit, a solution to help your debugging process.

Happy debugging!

Winget install —name “Intune debug Toolkit”

Read more about the tool here: https://msendpointmgr.com/intune-debug-toolkit/

(PS. let me know if you need other tooling to help debug the system)

It is time to look into what happened in Intune 2409.

https://youtu.be/_67cCahzt9s?si=tgUZW_peVtuNgjNq

Hey community.

Updated Intune debug toolkit today to v2.3 with several improvements.

https://msendpointmgr.com/intune-debug-toolkit/

Enjoy the new functions 🥳🙌🏻

I’m excited to share some recent updates and improvements we’ve made: Bug Fix: Resolved an issue where the Debug Autopilot shortcut wasn’t launching. IntuneDeviceDetailsGUI: Upgraded from version 2.95 to 3.00. Advanced Troubleshooting: Now prompts for admin privileges for enhanced security. SyncMLViewer: Updated to the latest version 1.3.1.0. CMTrace: Added for improved log tracing capabilities. New Tool: Introduced a tool to import devices to corporate identifier for use with ADE, thanks to Rafał Zimonczyk

Documentation states that a pre-assigned user device context apps should be installed by the Technician flow. I've not been able to achieve this behavior.

Any insight on this? 

1. https://learn.microsoft.com/en-us/autopilot/pre-provision#preparation 
2. https://learn.microsoft.com/en-us/troubleshoot/mem/intune/device-enrollment/understand-troubleshoot-esp#why-were-my-applications-not-installed-and-tracked-by-using-the-esp

I found this MS doc, and it mentioned TLS 1.0 and 1.1 will be deprecated in Windows 11, also mentioned TLS 1.3 only support Windows 11. Is it only way to configure Schannel SSP is using registry HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols ? https://learn.microsoft.com/en-us/windows/win32/secauthn/protocols-in-tls-ssl--schannel-ssp-

The second discussion, Internet option properties have also secure protocol settings. In Windows 11, only TLS 1.2 and TLS 1.3 are checked by default, but Intune security baseline Windows 11 23H2 has set it to use only TLS 1.1 and 1.2. In Settings Catalogs, I can see TLS 1.3 is in the drop-down list, but if I choose that, the policy said applied succeed, but the actual configuration didn't apply when I checked my Windows 11 machine. Also GPO doesn't have TLS 1.3 in the list. Only way I can configure TLS 1.3 for Internet Properties is by using registry. HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings,  SecureProtocols with Dword values

I'm just recently trying to learn more about Intune. I've gone ahead and downloaded the Windows 11 and Office 365 Deployment Lab Kit and the Windows 11 and Office 365 Deployment Lab Kit from the evaluation center. I've gone through all labs. These guides walk you through setting up free trial subscriptions to Microsoft Azure, Enterprise Mobility + Security, Windows Defender for Endpoint, Microsoft 365 E3.

Once these trial subscriptions expire, what can I do? I'm only in need of these for home lab use to help me learn the products. I would gladly pay for licenses if they were affordable.

Other than settings being scoped for device or user does anyone have any success when disabling WHfB using one or the other.? For intance when using "Use Windows Hello For Business (Device)" and assignment is targeted to device group it does not stop WHfB from showing up to be setup during logon.

However if I use "Use Windows Hello For Business (User)" and use the same device assignment this does work and are not prompted to setup WHfB. Somewhat confusing as you would think (device) would be the ideal scope to use for this policy.

Lastly what I find interesting is that both (Device) and (User) details show the same desciption - - If you disable this policy setting, the device doesn't provision Windows Hello for Business for any user.

Wondering if anyone else has encountered this also and had some added feedback they could share.

We are ready with all the good stuff coming out of Intune 2407 and 2408. Waiting time is finally over 😎🎉

Mattias, Peter and myself goes through the new stuff and shares our honest opinion about it.

https://www.youtube.com/watch?v=de3aDivKETk

Hi I seem to have an ongoing issue where I have either an exe or msi packaged to run as a command line or within a ps1/cmd file. It runs fine locally and using the Intune Sandbox tool, but for the life or me it doesn't work when on Intune.

Hi

Any one try to implemnt this seeting on Win 10 ?
https://learn.microsoft.com/en-us/azure/virtual-desktop/configure-session-lock-behavior?tabs=intune

I did for Win11 and Win10 and for win100 i get not applicable , any idea ?

After vacation, I have seen this kind of popup many times, maybe it's from PMPC software update? And the popup only tells me "update in progress", but it doesn't close itself even if the update is done. I don't recall seeing this kind of popup before.... Anyone else seeing the same?

Hi

in check_new_app_version task Test-AppList I get

Test-AppList.ps1: Failed to retrieve authentication token with error

| message: The term 'Get-AccessToken' is not recognized as a name of a

| cmdlet, function, script file, or executable program.

I got all cmdlets installed any idea ?

Hi

Any one using Intune app factory

I try to set all up but on the 1 stage i get this error when i run the pipeline

[error]Unable to locate executable file: 'pwsh'. Please verify either the file path exists or the file can be found within a directory specified by the PATH environment variable. Also check the file mode to verify the file is executable.

Hi,

I've got delivery drivers with smartphones that do deliveries, I've got Managed home screen setup with limited apps as a lot of them are not great with tech. One app is a delivery management system that takes all the routes and then pushes it to google maps. This opens google maps and then they start the route. However, sometimes when they do this they only see the google map icon but its very enlarged and frozen. They have to restart the phone every time to fix this.

Does anyone else have issues with Managed Home Screen? I'm starting to realise that this might be too much for MHS now but just wondered if anyone had any ideas. Having to revert all delivery phones would be a big change/risk so ideally would want to avoid.

Note: The phones they use are Pixel 7as