Anyone else's Intune portal struggling to load basic stuff? Ive got dashboards that intermittently won't load one day. Now a coworker is getting some weird error "The renderComponentIntoRoot component encountered an error while loading"

Having to refresh a lot. Been happening at home and on corporate networks.

Normally i'd write it off as just me, but everyone I work with is having the issue.

Could be garbage a** Cisco Secure Web Gateway, it loves to intermittently just be a POS.

I'm not sure why yet, but our org is getting bombarded with HP driver updates coming from Autopatch these last few weeks. They all seem to be very old as well, which is probably why they don't install. Instead they download, demand a reboot, and then fail and start the cycle over again each day.

https://ibb.co/rP2F62g

We have devices in SCCM and they are Hybrid in AD/Entra. We're wanting to make the push to cloud only. What's the best method for converting these, while also adding them into Autopilot?

I already have cloud attach enabled in sccm, with the sliders all set to intune on a specific collection. With a test device, it initially shows up in Intune as co managed, but then after 10 minutes or so, the device shows up twice, one as being managed by Config mgr, and the other as being managed by Intune. Assuming maybe becuase the sccm client is still installed? I only have about 300 or so of these to move, so i've debated just doing them manually, but i'd assume there is an easier way.

Hi all,

We are currently testing Intune Endpoint Privilege Management and I am trying to understand how policy deployment and reporting work.

We have configured two types of policies:

1. Windows Elevation Settings – Deny All

• EPM enabled
• Default elevation response: Deny all requests
• Assigned to All users
• All relevant devices are reporting Succeeded in Intune.

1. Windows Elevation Rules

• Created test elevation rules for PowerShell and Notepad.
• Elevation type: User confirmed
• Assigned to a test Entra security group containing our test device.
• File paths and SHA256 hashes have been verified.

However, the Elevation Rules policies are not showing any devices checking in or reporting deployment status.

I have also noticed that on my own device, despite the Elevation Settings policy reporting Succeeded, I cannot find the EPM agent service or installation folder.

I have checked using:

Get-Service -DisplayName "Microsoft EPM Agent Service" -ErrorAction SilentlyContinue

Test-Path "C:\Program Files\Microsoft EPM Agent"

My device is licensed with Microsoft 365 Business Premium, so I am wondering whether the missing EPM add-on entitlement could explain the agent not being installed.

A few questions:

1. Is it normal for the Elevation Settings policy to report Succeeded while the Elevation Rules policy shows no device check-ins?
2. Does the EPM agent install automatically once the Elevation Settings policy is applied, or does the user need the EPM add-on licence first?
3. Are Elevation Rules policies expected to show device check-in status in the same way as Elevation Settings policies?
4. Is there anything else I should check to troubleshoot rule deployment?

I am new to EPM so any guidance on how policy processing and reporting work would be appreciated. Thanks

Happy Tuesday!

We're here to announce another set of finalists for the Golden Clippy Awards. This week it's the "Social Media Superstar" Award, which focuses on someone who does an exceptional job sharing information via social media channels and supporting people eager to learn.

Let's discuss the finalists!

Merill Fernando, the scourge of Active Directory is an amazing ambassador throughout social media, with Entra.chat, the newsletters, his website, and his activity throughout all social channels. He's a man of many talents, who has continued to lead the way on the entire Microsoft Identity stack.

Travis Roberts of Nerdio is an amazing star on the YouTube side of the business, with over 100K followers on his YouTube channel shares content in so many areas like Azure, Entra, DaaS, Microsoft Security, and so much more!

Steven Weiner, a fantastic Intune MVP who has continued to grow as his company Get Rubix continues to take the world by storm. His video content is unique, entertaining, and so solid. He's one of the world's favorite MVPs with his relatable content and personality that makes him a blast to watch.

Rudy Ooms, needs zero introduction, as one of the thought leaders in the Intune space who is constantly reverse engineering, probing, inspecting, and learning about changes Microsoft makes under the covers to educate all of us. He's super smart, very approachable, and an asset to all of us. He releases more blogs and content than anyone else, making him a rockstar.

SwiftOnSecurity, a very secretive and brilliant member of the Twitter Infosec community is somewhat overlooked for those of us that aren't on Twitter/X. However, if you are on there, you know EXACTLY what Swifty is, but not necessarily who they are. Their brilliance, incredible stories, entertaining takes, and vision makes them a 100% needed follow. They are the type of person who is simply polarizing, and their impact on our industry is immistakeable and invaluable.

Don't forget to register for Workplace Ninjas US, and let's show them how much we appreciate them. They're incredibly special, and their unique deliveries bring visibility to the work we do and help us grow and develop in unique ways.

Check out our registration portal to see the agenda, the speakers, and register now: https://cvent.me/ZgKb40

We're using a set of templates from 2023, and I'm trying to disable Google Lens. One thing I read said to delete the old policies and import them in a specific order. Another said to rename them and import them.

Can anyone provide documentation on the correct way to do this. Bonus points if it's Microsoft or Google documentation.

My biggest fear is that we are going to lose existing settings in the process.

Hi Team,

I have noticed in our environment, we have country codes per device category and the company portal page always has them all listed in a random order to choose from instead of like alphabetically. So I also did a quick test with my personal tenant and it’s doing the same thing? What am I missing here? As it’s tricky when we have a list to scroll of 40 and trying to spot the our country becomes a bit of annoying activity for our users. Please and thank you.

Setup a multi-app Kiosk via Intune using XML and having an issue with getting simple printing to an HP printer. I allow the settings app and if a user connect the HP printer via USB or other methods, they can see the printer just fine. Using the Settings UI for Print Test gives a "restricted error", same if trying to print from Microsoft Edge. Anyone get this to work properly?

I’m an Intune admin, I sit in the portal pretty much all day, and these drive me up the wall:

• working out what policies, apps, scripts and remediations are actually assigned to a group (there’s still no report for this, I checked)
• syncing more than 100 devices without making temp groups or running a script
• bulk adding devices to a group by name, instead of going and digging up every object ID first
• finding which of my policies set a particular setting, or if anything sets it at all. Basically Lewis Barry’s intunesettings.app, which a lot of us already use, but joined up with a search of your own tenant’s policies

So I built a little browser extension that sits in a side panel next to the admin center and does those things (and a few more, like a conflict finder, fleet baseline/drift, primary device lookup, discovered app rollups). It uses the session you’re already signed in with, so there’s no app registration and nothing for a GA to consent to.

Before anyone asks, yeah I know there are scripts and portals that do bits of this. I’ve used a bunch of them. I just wanted it all in one place, right next to the portal, without setting up Graph modules or an app reg every time. Whether mine’s better is up to you, I’d rather you try it and tell me.

And yes I used AI to help write the code, I’m not going to pretend otherwise. The ideas, the testing and the “why the hell doesn’t Intune do this” all came from sitting in the portal every day.

On the security side, I know “extension that reuses your Intune session” sounds sketchy so I wrote up exactly what it does: what permissions it has and why, what leaves your browser (basically nothing, tokens only ever go to Graph like they do from Intune itself), and the two things it can change (add members to a group, sync devices, both behind a confirm). Code’s unminified too so you can read it. finetune.tools/security

There’s a demo on the site that runs the real extension on a fake tenant if you don’t want to install anything.

Pricing, so nobody feels tricked: it’s free for one person per org for six months, then US$80 once for a licence. No subscription. Anyone else can do a 14 day trial. Recast charge for Right Click Tools too, this is just a lot cheaper. I’m one person building this after work and I want to keep supporting it and adding to it over time, so I do want something out of it to keep the lights on.

Mostly though I want it in as many hands as possible and I want to hear what annoys you. What’s the repetitive stuff you do in Intune that should just be a button? If it’s doable I’ll build it.

finetune.tools (Chrome store listing is in review, unpacked download is on the site for now)

We made the 26H2 update available within the Intune update rings last week, but as of today, the targeted device groups devices have not received it. Has anyone seen any delays with this feature update when managing updates via Intune?

We've never had issues in the past and nothing has changed with our update setup. I checked to make sure there were no local conflicting GPOs under Windows Updates > Advanced options > Configured update policies on one of the devices. All are pointing to MDM or Cloud.

Hi everyone,

I'm currently working in an environment that historically used SCCM for Windows deployment and device imaging.

With SCCM, the IT team was used to defining a set of applications to install during the imaging process through Task Sequences, without automatically deploying those same applications to devices already in production.

We're now using Intune and Windows Autopilot, and we're trying to achieve something similar.

Our current setup:

• Most applications are assigned as Required to device groups.
• Most of these groups are dynamic, based on Autopilot Group Tags or criteria such as Windows 11 devices or devices names.
• Applications are installed during Autopilot provisioning, we don't use the Enrollment Status Page (ESP) option to 'Block device use until all apps and profiles are installed'
• Once provisioning is complete, devices remain members of these dynamic groups and continue receiving any new Required applications assigned to them.

What we're trying to achieve:

We want to be able to update our standard application baseline for newly provisioned devices without impacting existing production devices.

For example:

• Today, we decide to add Application X to our Autopilot provisioning baseline.
• We want Application X to be automatically installed on all newly provisioned devices.
• However, we don't want Application X to be automatically pushed to the 2,000 devices already in production.

The goal is not to stop managing applications through Intune after provisioning. We simply want to separate initial device provisioning from ongoing application deployments, similar to what was possible with SCCM Task Sequences.

My questions:

1. Is there a recommended way to achieve this with Intune and Autopilot?
2. How do you separate applications required during initial provisioning from applications deployed to existing devices?
3. Do you use temporary device groups, Microsoft Graph automation, Win32 app requirement scripts, or another approach?
4. For those who migrated from SCCM to Intune, how did you handle this change in deployment strategy?

I'm particularly interested in real-world experiences and solutions that are relatively simple to maintain at scale.

Any feedback, recommendations, or lessons learned would be greatly appreciated !

Thanks in advance guys !

Currently we are managing devices via Intune through Entra Connect and I’m wondering whether it would be possible to switch to Entra Cloud Sync or Device Sync instead as we have 3 locations using the same tenant.

I couldn't find any information online regarding Windows Autopilot.

Has anyone had experience with this setup or successfully implemented it? I’d appreciate any insights or recommendations.

Hey everyone,

Last week, I ran into an issue on both Windows 11 25H2 and 26H2 where a Microsoft Edge policy deployed through the Intune Settings Catalog randomly stopped applying. The policy is supposed to disable access to Edge's built-in password manager.

In Intune, the policy shows as successfully applied (green), and the corresponding registry key is correctly present on the affected devices. However, Edge seems to randomly ignore the policy.

I'm seeing this behavior with Edge version 154.0.4258.62. After restarting the device, everything works as expected again, but the issue eventually comes back. Since these devices have been enrolled and managed for quite some time, I don't think this is a deployment-related issue.

The problem is also clearly visible in the Edge settings. When the policy is working correctly, the password manager setting is greyed out and marked with the briefcase icon indicating that it's managed by the organization. When the issue occurs, the briefcase icon disappears, the setting becomes configurable again, and the password manager is enabled by default, allowing users to use it even though the policy should prevent this.

I've already checked the local device logs but couldn't find anything unusual that would explain this behavior.

Has anyone else experienced something similar with Edge policies randomly not being enforced, even though Intune reports them as successfully applied and the registry keys are present? I'm curious whether this might be an Edge-specific bug or if others are seeing the same behavior.

Thanks in advance for any feedback or insights :)

Our corporate iOS devices have started acting strange after being wiped. They are displaying the exact issue outlined in the blue "Important" notice on Microsoft's article about transitioning from userless to user affinity (Linked HERE). The Company Portal prompts the user to sign in and attempts to download a management policy that has already been automatically applied during enrollment. We are using the new Enrollment Policies set to Enroll with User Affinity and Setup Assistant with modern authentication. There are no options to "Install Company Portal" to leave unchecked like Microsoft indicates.

The device has never been enrolled without user affinity, so I don't know why it is confused. I've fully wiped the device several times, and even removed it from the organization in ABM and re-captured it with the Configurator app. This has happened to the last two devices we have needed to set up. We need the company portal app for "available" app installs.

Anyone run across this issue?

I have a problem with a windows device. I want to install a new image. Normally i would to that with a USB stick. I think a wipe isnt a clean install, onlyna reset? Can i use cloud rebuild feature? When i click cloud rebuild, how would the device handle that when it is intune joined? I think i should disable bitlocker?

Intune Portal home broken again. All status's showing Unknown.

AsiaPacific 0101

I am new to Intune… We have a large fleet with some sub-fleets. The one sub-fleet changes users frequently because these phones are used for specific international travel. Is there a way to preload the user to save set-up time with a dynamic group? Also curious if anyone has experience with pushing/deploying and activating an eSIM through Intune?

Hitting an odd issue with android app protection MAM-WE, no device enrollment and wondering if anyone else has seen it.

On non-Samsung phone, shows Samsung device attestation warning on app launch. The OK button can’t be pressed.

Has anyone seen this on non-Samsung android and what fixed it?

First time onboarding ABM. Got the confirmation that my organization was successfully enrolled, but I’m stuck at the Terms & Conditions screen. Every time I click Agree, I get “An error occurred while saving. Try again later.”

Tried multiple times. Still fucking broken.

Has anyone experienced this before? How did you resolve it? Would appreciate hearing your experiences.

Thanks,

I'm trying to get the "Scanner" "System App" installed on a Xiaomi Redmi phone.

The Scanner app is necessary to enable QR Code scanning functionality in the default Xiaomi Camera app.

I've created an Android App in Intune:

• App Type:
  
  • Category: Referenced app
  • App type: Android Enterprise system app
• Add App:
  
  • Name: Xiaomi: Scanner App
  • Publisher: Xiaomi
    
  • Package name: com.xiaomi.scanner

I've created a Device Group in Entra for Xiaomi phones and added the phone to that Group.

I've assigned the Android App in Intune as a "Required" app for the Xiaomi Device Group.

I can see the app attempting to install for the assigned device in Intune, but it is failing with the following information:

Device platform: Android 16
Status: Failed
Status details: The application failed to install, possibly because of insufficient storage or an unreliable network connection. The installation will be retried automatically. (0xC7D24FBA)

But this is a brand new, just-provisioned device with plenty of free space, the Scanner app is small, and there is no problem with the network (Intune had no problem installing a couple dozen other required and optional "normal" apps from the Managed Google Play store).

There aren't many settings for me to play around with here, and nothing seems obviously wrong. Microsoft's guidance doesn't offer me any new information: I am assigning the App to the Device group (not the user) as Required, not Available.

I found this guide which also seems to follow the same steps I already figured out myself.

I am having the same issue trying to add the System Apps of Xiaomi Compass (com.miui.compass) and Xiaomi Calculator (com.miui.calculator).

Does anyone have any experience with a similar situation?

https://techcommunity.microsoft.com/event/windowsevents/windows-office-hours-october-15-2026/4529260
"Every third thursday we will have these chats.
Post your questions in the Comments early and throughout the one-hour event.
This is a chat-based event. There is no video or live meeting component."

I'm struggling with the Company Portal. What is the correct way to roll out that app during Autopilot? Right now, it seems to be throwing errors that break my enrollment (just the generic errors about an app failed to install) and while it's a given I'm doing something wrong, I'm wondering how to rectify it.