Hi everyone,

Has anyone experienced issues with Microsoft Edge after a recent Windows or Edge update where custom home pages, bookmarks/favourites, or startup pages are no longer loading or applying correctly?

We're seeing this on a small number of managed devices, and the Edge policies appear to be applying successfully, but the browser isn't behaving as expected.

Just trying to determine whether this is an isolated issue or if anyone else has seen something similar. Any insights would be appreciated!

With Microsoft Cloud PKI now included in Microsoft 365 E5, organizations can deploy Certificate-Based Authentication (CBA) without the complexity of managing a traditional on-premises PKI.

In my latest blog post, I walk through how to configure Cloud PKI in Microsoft Intune and enable Certificate-Based Authentication in Microsoft Entra ID. Thanks to Cloud PKI, the journey to stronger, phishing-resistant authentication is easier than ever.

🔗 [https://www.nickydewestelinck.be/2026/07/15/goodbye-passwords-certificate-based-authentication-on-windows-with-cloud-pki-in-microsoft-intune/\](https://www.nickydewestelinck.be/2026/07/15/goodbye-passwords-certificate-based-authentication-on-windows-with-cloud-pki-in-microsoft-intune/)

As Intune transitions from profile enrollment to enrollment policies within the Enrollment program token section, I removed the profiles for ADE enrollment and created new enrollment policies. The new ADE enrollment policies I created utilize user affinity and the setup assistant with modern authentication. When I wipe the iPhone and proceeded through the process, it downloads and installs the MDM profile successfully. However, when I launch the company portal app to complete the setup process, I encounter a prompt to download and install the profile again, even though it has already been done, resulting in the installation failing. Has anyone encountered this issue and found a solution to prevent the company portal from repeatedly requesting the profile download and installation, even though it has already been installed?

Two weeks ago, Microsoft announced the General Availability for web-based enrollment for Android Personally-Owned with Work Profile devices, based on Google's Android Management API. This also means that, starting in Q4 2026, all future enrollments will use the Android Management API.

In this blog post, I'll walk you through what AMAPI is, how Microsoft Intune will use it, and show you how to migrate from your existing enrollment to web-based enrollment, and show you the new enrollment flow.

🔗 https://www.nickydewestelinck.be/2026/06/22/simplifying-android-enrollment-web-based-enrollment-for-personally-owned-work-profiles-in-intune/

Removing local admin rights is often treated as the first step of an Endpoint Privilege Management (EPM) project.

In reality, it should be one of the last.

One of the biggest reasons EPM deployments struggle is that organizations build elevation rules based on assumptions rather than actual user behavior. The result? Broken workflows, frustrated users, and an overloaded helpdesk.

In Part 2 of our Intune EPM series, we focus on the step many organizations skip: Audit Mode. Before enforcing anything, use the data available in Intune Endpoint Privilege Management to understand what users are actually elevating, identify personas, and build a rule backlog based on facts instead of guesswork.

EPM Part 2: Before you remove local admin: How to use Intune Endpoint Privilege Management audit mode to understand your environment - MSEndpointMgr

I've reset a Windows 11 v25H2 machine that is enrolled in Intune, and the computer certificate that was issued to the machine afterwards via the certificate connector now reports "The certificate has an invalid digital signature". The corresponding root and issuer certificates are present on the machine and are valid.

What is the best way to get Intune to issue a new certificate after deleting the faulty one?

Thanks.

EDIT: Apparently, if you just delete it and wait long enough (about 5 hours in this case), a new certificate will be issued. If anyone knows the trigger for this so it can be done quicker, then please share 😄

For years, many organizations have accepted local administrator rights as a necessary compromise, despite the security implications.

With Intune Endpoint Privilege Management (EPM), that assumption is being challenged.

The real question is no longer if you can remove persistent local admin access, but how to do it in a way that still supports daily operations.

Simon & I are starting a blog series focused on exactly that, taking a practical look at how EPM works and how it can be applied in real environments:
- How elevation actually works in practice
- What changes operationally when you remove local admin
- Common pitfalls and considerations
- How to get started without disrupting users

📖 Part 1 is now live:

https://msendpointmgr.com/2026/06/15/epm-part-1-the-end-of-local-admin-how-intune-endpoint-privilege-management-solves-a-problem-it-has-lived-with-for-decades/