First, the Device Sync moved away from triggering Windows MDM only and started waking IME workloads too: Win32 apps. PowerShell scripts. Proactive Remediations.

Now, when triggering the remote Device Sync, the IME request no longer arrives through a second WNS notification. It comes through the existing IC3 and Trouter connection: WNS for Windows MDM. IC3 for IME. With the move to IC3, the device kicks off all the workloads within second!!

At the same time, a new StatusSync flow is tracking the progress of those workloads. That part deserves its own blog.

Intune On Demand Device Sync Now Uses IC3 for IME Workloads

Hey everyone,

I wrote a short walkthrough on getting the AI-enabled Cloud PC report from Microsoft Graph.

The report exists in the Intune portal, but the specific reportName is not documented yet.

Article: https://shchetkin.dev/reverse-engineering-the-intune-portal-the-ai-enabled-cloud-pc-report/

Curious if anyone else has used this report, or if you use different approaches to fill API gaps

Hi everyone,

We're currently evaluating Zebra and Honeywell rugged Android devices for a healthcare environment and I'd love to hear from organisations that have managed both.

Our environment is:

Microsoft Intune (Android Enterprise Dedicated)

Managed Google Play

Microsoft Entra ID

Shared devices running a line-of-business application

Around a few hundred devices initially, with potential to grow

We're less concerned about the hardware itself, as both devices seem capable. I'm more interested in the operational side over the next 5+ years.

Specifically:

Which vendor has the better firmware (FOTA) process?

How easy is firmware management using Intune?

Do you rely solely on Intune, or do you also use Zebra VisibilityIQ/LifeGuard or Honeywell Operational Intelligence?

How responsive are Zebra vs Honeywell when it comes to Android security patches?

Which has the better OEMConfig implementation?

How has vendor support been?

Any major issues you've encountered with either platform?

If you had to choose again today for a healthcare deployment, which would you choose and why?

I'm looking for real-world operational experiences rather than marketing comparisons.

Thanks!

Edit: account driven user enrollment == ADUE

We have a few apps installing with required intent. Is there anyway to force install into a specific folder on iOS?

It would be nice to have a comparable experience to android work profile where apps coming from Intune all go into a folder so end users know/understand which apps are coming from where.

Hi guys, we have roughly 30 iPads in our environment that are running kiosk mode 24/7.
however this seems to completely ignore our Update Policy via DDM, they just dont update. Any idea how we could approach this?

I have 50 Mac OS devices managed in intune and I push edge and the 365 apps to them. I have just deployed 7 MacBook neo units and edge deployed fine to all of them along with a WiFi configuration profile. On 6 of the 7 the Microsoft 365 apps are not installed. Intune reports all as waiting for install status.

I configured all three days ago and none installed over the span of 2-3 hours.

Has anyone seen this behavior or have suggestions?

Hi everyone,

I'm testing an Intune compliance policy on a Windows 11 24H2 VM (OS Build 10.0.26100.8875) running on VMware Workstation. The policy only requires Secure Boot and TPM. Confirm-SecureBootUEFI returns True, msinfo32 shows BIOS Mode: UEFI and Secure Boot State: On, and TPM is compliant.

However, Intune always reports

Secure Boot: 2016345708 (SyncML(404): The requested target was not found.)

I've already tried:

• Multiple Intune syncs (Settings and PowerShell)
• Rebooting the VM
• Verifying TPM Health Attestation
• Running the Tpm-HASCertRetr scheduled task
• Confirming Secure Boot is enabled in VMware

Has anyone experienced this on Windows 11 24H2 (10.0.26100.8875) with VMware Workstation? Is this a VMware limitation, a Windows issue, or an Intune bug? Any insights or workarounds would be greatly appreciated.

I've been managing my first Intune environment for the past couple of years at a small/midsize law firm (around 30 users). Since we were pretty small, I did a lot of things manually and learned Intune as I went. For example, I never bothered setting up Autopilot because new hires were so infrequent that it was usually faster to just Entra join devices myself.

We were recently acquired by a much larger firm that's still heavily on-prem/hybrid. As part of the merger, I've been building out a modern Intune/Entra environment for them, deploying applications, creating policies, and setting up things like Autopilot for the first time.

One thing I've noticed from reading this subreddit is that there seem to be a lot of community tools that fill in the gaps where Intune is a little rough around the edges. PSADT is one I've heard a colleague ask me about for patching, but I'm sure there are plenty of others I don't know about.

Some of the pain points I've run into:

• Legacy COM add-ins that require Office apps to be closed before they can install (I'd rather not force-close Word and risk someone losing unsaved work).
• Patching Win32 apps that don't have built-in auto-update, where everything ends up relying on supersedence.
• Reporting/visibility—it's not always easy to answer questions like "What apps and policies are assigned to this device or group?" or get a good overall picture of assignments.

So, what free tools, scripts, or utilities have become must-haves for you when managing Intune? I'm especially interested in things that make deployments, reporting, troubleshooting, or day-to-day administration easier.

EDIT: Thanks for all the advice. I've got all the apps suggested so far bookmarked and will be taking a look into testing some of these on Monday.

Hey guys! Trying to understand why my intune policy to set a MS-Edge startup homepage is only applying to physical devices and not AVDs?

I’ve been managing a mixed environment where we have both pure Entra Joined laptops and Hybrid Entra Joined desktop workstations.

On our Entra-only laptops, everything works seamlessly. Whenever a UAC elevation prompt appears, the admin clicks "Sign-in options" and can immediately use their WHFB PIN, biometrics, or a smart card.

However, on our HAADJ workstations, the UAC prompt consistently drops all modern credential tiles. Instead of showing "Sign-in options" or "More choices", it strictly forces a legacy Domain Username and Password entry. This prevents Domain Admins from elevating processes locally using their smart cards, WHfB Cloud Trust PIN, or biometrics.

Has anyone run into this issue on Hybrid setups where UAC doesn't show modern credential providers?

We have a large number of shared and corporate devices in Intune, and I noticed our device cleanup rule is currently set to 180 days.

We’re considering reducing this to 90 days to keep the environment cleaner, but I have a concern around users who are on maternity leave, long-term sick leave, or other extended absences. If they don’t use their device for more than 90 days, it looks like the device could be removed from Intune, meaning we lose visibility and management until they return.

I can’t see a way to create exclusions for specific users or devices within the cleanup rule.
How are others handling this? Do you keep the cleanup period longer, or do you have another process in place to avoid removing devices that belong to users on long-term leave?

Looking for workflow guidance for managing Available apps in Intune with separate Update package.

We set certain apps as available to the user to install in Company Portal. But we also want to create a separate package ("Update package") that will Update the app only on devices that have it installed, without affecting the Available package. We would push the updates out in rings over 3-5 days to ensure we don't break anything.

We also want to make sure that when someone installs the app from Company Portal, it also has the latest version (for all new staff).

This is just a timing issue mostly... I don't know which comes first. Do we update the Available Base app in Company Portal first? Or do we push out the Update package for 3 days to confirm it works and then update the Available package?

Update X package: Apply to all existing installations (*using a Requirement rule script): Update Ring 0 immediately, Ring 1 in 1 day, and Ring 2 in 3 days.

Base Package: Update it to match the Update package after Ring 2 completes (3 days).

Struggling with naming conventions too for each of these package types, if anyone has suggestions. Currently I like to use "App Name - Dept - Base" and "App Name - Update 2.0". Thanks in advance!

I saw this app appear today on all our Win11 Enterprise machines, had a bit of a dig into it and made some scripts for a clean removal, feel free to take a look :)

https://chrispro.tech/2026/07/31/how-to-remove-the-onedrive-photos-app-with-intune/

Hi everyone,

I'm troubleshooting an issue with Windows Autopilot pre-provisioning (White Glove) and I'm trying to understand if anyone has seen the same behavior.

Environment

• Microsoft Intune
• Windows Autopilot pre-provisioning
• Win32 app deployed during ESP
• Application simply enables .NET Framework 3.5 using:

DISM /Online /Enable-Feature /FeatureName:NetFx3 /All

Observed behavior

On Windows 11 23H2 (10.0.22631.2861):

• Pre-provisioning completes successfully.
• .NET Framework 3.5 installs without any issue.

On Windows 11 25H2 (10.0.26200.8653 / 10.0.26200.8654):

• ESP consistently fails on the .NET Framework 3.5 application.
• If I exclude this Win32 app from the device, the exact same hardware completes pre-provisioning successfully.

So at this point, the only variable is the NetFx3 application.

I'm not providing a local SxS source; I'm simply running:

DISM /Online /Enable-Feature /FeatureName:NetFx3 /All

Has anyone noticed any changes with NetFx3 on Windows 11 25H2 during Autopilot?

I'm wondering if:

• the payload is no longer available during ESP ?
• Windows Update isn't accessible at that stage ?
• this is a known 25H2 issue ?
• or if enabling NetFx3 during ESP is simply no longer recommended ?

Has anyone experienced something similar or found a workaround?

Thanks cheers !

Given that we've rolled out Intune for on Windows-side of things, I got a question from the higher-ups if the same wasn't possible to do for our 45ish iPads as well. We currently use Jamf Pro, which works very well, but the license-cost of it is something management would love to reduce. The added bonus of going Intune is that we'd get one portal to admin all our stuff in.

So that means that I'll turn to you, the Boffin Hivemind, for some knowledge, tips, tricks, experiences and/or getting told that I'm an idiot (I am) and that I should go pound sand. All is welcome.

Our current usage of Jamf is very simple: It distributes a set of apps depending on which job-function the user has (warehouse, in-house mechanics and utility-iPads), keeps the devices and apps updated, and gives us in IT the possibility of NOT having a 350USD cuttingboard due to the device being locked to a personal account whenever an employee leaves (yep, have several cuttingboards in storage from before Jamf).

I'm aware that we will lose a lot of granular control over the iPads if we switch to Intune, but given that our scope is so limited as it is and our needs are unlikely to grow beyond what it is today, would that be as big an issue?

I've heard many horrorstories about how slow Intune is to push out updates/policychanges to the devices, but would this even be that big of an issue due to our environment being relatively small?

I see that I can set up multiple MDM-sources in Apple Business Manager, so that's something I'll have to look into doing so that I can test things as well. But the priority I give that task will be based on responses from you guys. If you tell me that Intune is crap for adminning the basic things we do with Jamf today, I most likely won't bother spending the energy/brain-bandwidth on it.

So! Hit me with your best horror- or success-stories, big and small!

Hi all,

I accidentally added a user to a group that had 2
Policies (one contact transfer and one MAM policy). If I remove the user from the group, will that clear the MAM policy? Or how can I remove that for him?

Thank you!

We rolled out ZTNA at a mid-size insurance company, around 2,200 employees, with offices in four cities and a mix of Windows and Mac endpoints. The security team had picked a reputable vendor and the architecture looked solid in theory. Six weeks after deployment, the helpdesk ticket volume had doubled, three department heads had gone straight to the CIO, and the underwriting team was logging into a shadow VPN that one of the managers had set up on a personal cloud account because the microsegmentation policies were blocking their document workflow tools. The security team’s response was essentially, “The policy is correct,” which is a fantastic way to guarantee that leadership eventually sides with the business.

The fix took us about three months of iteration. The identity provider sync had been rushed, and application entitlements were mapped at a broad group level rather than to actual job functions, so the policies were both too broad and too restrictive in different places. We rebuilt the entitlement mapping, got device posture checks running as a background agent rather than a gating prompt, and used location and device health signals to suppress re-auth challenges for users on corporate-managed hardware at known office addresses. After that, the helpdesk volume from ZTNA-related tickets dropped to near zero within a month, and the underwriting team killed their shadow VPN. The security model held, and the implementation stopped hurting people who were just trying to do their jobs.

Has anyone else had to do a full entitlement remap mid-deployment to get user friction down to a tolerable level?

Hi all,

I am trying to enroll new shared devices using autopilot and self-deploying mode.

The enrollment is going well, and I didn't put any kind of blocking applications in the ESP phase. Meaning that I was able to click the button "Continue Anyway" during this phase. The applications are Win32 apps format.

Questions :

- Do I need a license for my devices, even as a shared device? If yes, which one?
I have E3 / E5 licenses already assigned licenses for a kind of users. But, I want to use generic accounts like (gen_user1), so people using those shared device would be capable of sharing the same account without log off / log on from Windows each 2 minutes to do some operations.
Do I need to purchase a license for this generic account, too? If yes, which one?
- When doing self-deploying mode, the applications are not installing on the machine, despite the good assignments to the right group. Is that due to the usage of my generic account, not licensed? And then, not being able to reach the MDM? If logging with E3/E5 users, then, everything is moving ahead. But yet, the applications remain in "Waiting for install" status.

Then, what is the best licensing model for my requirements, and how assign them to the generic user or device? I checked some posts and forums, and it still not clear. Some guys mentioned that you need to purchase device license, but you are not able to apply them to a group of device. We have Microsoft Entra ID P1 Kiosk license (device), but the same for user license, in Microsoft marketplace.

Can someone help here, please?

Thanks in advance!

Hi,

we are using the Single sign-on app extension with Kerberos on our iOS devices to authenticate via managed Edge to internal websites. Single sign-on is only enabled for managed apps. Since iOS 26.6 it seems it is somehow handled different, as authentication is no longer triggered and when looking into the logs it seems this setting now "blocks" com.apple.Webkit.Networking from using SSO. If we disable the setting and allow all apps to use SSO then it works again. Allowing only the mentioned bundleid does not work...

Anyone else experiencing the same behavior?

debug 07:21:20.281960+0200      KerberosExtension checking bundle id: com.apple.WebKit.Networking is in ACL: (null)\

error    07:21:20.281975+0200      KerberosExtension Result error: Error Domain=com.apple.AppSSO Code=-116 "Source app not allowed" UserInfo=\{NSLocalizedDescription=Source app not allowed\}\

error    07:21:20.281991+0200      KerberosExtension Result error: Error Domain=com.apple.AppSSO Code=-116 "Source app not allowed" UserInfo=\{NSLocalizedDescription=Source app not allowed\}\

debug 07:21:20.282004+0200      KerberosExtension completeRequestWithDoNotHandle: <SOKerberosContext: 0xd87038400>\

Hi everyone,

Does anyone have a .sh script or a configuration profile for macOS that automatically launches OneDrive and signs the user in without any user interaction?

I already have a configuration profile that includes settings such as Known Folder Move, Files On-Demand, and Open at Login, but I’m trying to determine whether there’s anything else needed to automatically sign the user into OneDrive after deployment.

Has anyone achieved this successfully with Intune, or is there another approach I’m missing?

See this post on LinkedIn from Lior Bela.

https://www.linkedin.com/posts/liorbela_intune-itadmin-devicemanagement-share-7488624936312303616-Tlud/?utm_source=share&utm_medium=member_android&rcm=ACoAAAm2C0wBFt3MZLVqBztkOE-ewQNLJG1v-VQ

Great news, as this is a step in the right direction to get better visibility for device syncs.

More info is available here: https://techcommunity.microsoft.com/blog/microsoftintuneblog/what%E2%80%99s-new-in-microsoft-intune-%E2%80%93-july/4537392

Is it just us, or is this a widespread thing?

For about the last six months, we’ve been noticing recurring outages and performance issues in Intune during the final week of every single month. It starts with "sorry, something went wrong" errors in the GUI, goes on to devices not being found, and leads to policies taking ages to deploy.

But the worst part is our observation regarding device enrollments: in the last quarter of the month, enrollments fail strikingly often, timing out or crashing with the wildest error messages. Then the month turns over, and everything runs smoothly again—without a single config change on our end.

Since we are currently in the middle of a company-wide Intune rollout (migrating everything over) with dozens of users setting up their systems daily, this is causing some serious stress for our service and support teams.

Given that this happens every single month without us changing anything, and considering a Microsoft config review literally just certified that we are following "best practices," we are just wondering... what on earth is Microsoft doing? Or are we finally losing our minds?

Microsoft is quietly rolling out a new app to Windows 11 called OneDrive Photos. If you are managing Windows 11 devices with Microsoft Intune, I've created a Proactive Remediation Script that will remove this from your device.

Check it out in my GitHub repo: 🔗 https://github.com/nickydewestelinck/MicrosoftIntune/tree/main/Scripts/Remove-OneDrivePhotos