Category: General

  • Using LGPO.exe to apply GPOs to test clients easily OnDemand via Intune

    Using LGPO.exe to apply GPOs to test clients easily OnDemand via Intune

    From time to time, I wanted to have a way to set Policies (GPOs) on my test clients in a non-enforced way, which allows me to locally modify the settings to troubleshoot something, while still having an easy way to re-apply the settings. While this is definitely an edge case and does not apply to…

  • Troubleshooting Intune Endpoint Privilege Management

    Troubleshooting Intune Endpoint Privilege Management

    Today I want to show you how you can troubleshoot issues with Intune Endpoint Privilege Management (EPM) and will try a little deep dive in how it works. Policies Let’s start with the basics, in order to get Intune EPM started, we need to assign at least an EPM Settings policy from Intune to the…

  • Prevent sign-in consent prompt on AVD or Windows 365 Single Sign On (SSO)

    Prevent sign-in consent prompt on AVD or Windows 365 Single Sign On (SSO)

    If you enabled Entra SSO on your AVD or Windows 365 Machines, you are probably familiar with the sign in consent prompt that asks you to allow the RDP connection to your Cloud PC / AVD Host. Your response is saved for up to 15 devices and for 30 days until you have to accept…

  • Intune Endpoint Privilege Management Companion

    Intune Endpoint Privilege Management Companion

    Today I want to introduce you to my Intune EPM Companion Power App. In my first blog post about Intune EPM (Intune Endpoint Privilege Management – Mike’s MDM Blog (mikemdm.de)), I showed you how the then new support approved flow allows your users and admins to get admin rights for a specific application on demand…

  • New Autopilot Companion App for Corporate Identifiers

    New Autopilot Companion App for Corporate Identifiers

    If you played with the new Autopilot V2 Autopilot device preparation profiles in Intune, you pretty fast noticed there is no “registration” with a hardware hash or similar is needed, and it just works with all devices. If you want to limit it, to only allow corporate owned devices using enrollment restrictions, you can now…

  • Collect local logfiles using an Azure Storage Account and Remediations in Intune

    Collect local logfiles using an Azure Storage Account and Remediations in Intune

    Intune has an integrated function to collect Logs that can really be helpful to troubleshoot issues on Windows Clients, but what to do, if the desired log is not part of this? Well, we can collect them pretty easily our self, using a custom OnDemand Remediation script in Intune and an Azure Blob Storage to…

  • Read, Write, Query data from Azure Cosmos DB in PowerShell

    Read, Write, Query data from Azure Cosmos DB in PowerShell

    For a lot of my projects, I needed to read or write Azure Cosmos DB data from a PowerShell script. However, most PowerShell samples only cover creating and modifying the database itself, but not much about interacting with the data itself. So, I want to show you a few sample scripts, that I used in…

  • Time based Group membership for Entra devices – Part 2

    Time based Group membership for Entra devices – Part 2

    As promised last week, here is part 2 of my time-based group membership. In this part, I will show you, how you can use the backend from part 1 to allow admins to add Intune managed devices to the group using a PowerApp. PowerApp Let’s start with importing the PowerApp: You can find the sources…

  • Time based Group membership for Entra devices

    Time based Group membership for Entra devices

    Who don’t know these annoying assigned device groups in Entra used for example in Intune to exclude assignments for specific policies? Once created and assigned we tend to forget to remove the devices. This can lead to issues and security risks, if for example an excluded security policy needed to install a software, stays excluded…

  • Create or set Registry Keys using Intune Remediation scripts – Part 2

    Create or set Registry Keys using Intune Remediation scripts – Part 2

    Today in Part 2 on how to create or set Registry Keys using Intune Remediation scripts, I want to show you how easy you can modify Regkeys for all users or keys that need additional permissions for the currently logged on User. In Part 1: I covered, how you can set a specific Regkey for…

  • Configure Dell UEFI Settings using Intune Configuration Profiles

    Configure Dell UEFI Settings using Intune Configuration Profiles

    Today I want to show you, that you can now configure Dell UEFI Settings directly in Intune, using the new “BIOS configurations and other settings” Template. Dell provides a really good guide for this: https://www.dell.com/support/kbdoc/en-us/000214308/dell-command-endpoint-configure-for-microsoft-intune Dell Command Configure Before we can deploy the wanted setting changes to our clients, we have to prepare the UEFI…

  • Intune Endpoint Privilege Management

    Intune Endpoint Privilege Management

    Today I want to give you a first look at the Intune Endpoint Privilege Management that is part of Intune Suite for one year with the March 2023 Intune release. Additionally, I want to show you the new support approved flow, which was added recently and allows for example the Helpdesk approving elevation requests for…

  • Update: Autopilot Companion based on Power Apps

    Update: Autopilot Companion based on Power Apps

    Today I want to show you the updated Autopilot Companion Power App. Check out my initial post to learn about the basics of the Companion App, how it works and how it started: https://mikemdm.de/2023/04/08/autopilot-companion-app/ What has changed since the last version? The biggest change is the possibility to pre-assign a user the Autopilot Device. For…

  • First look at Intune Cloud PKI

    First look at Intune Cloud PKI

    With the Service Release 2402, the Intune Suite got one more exciting feature, Cloud PKI. With Cloud PKI, you can now use Client Authentication certificates on all Intune managed devices without needing to deploy your own PKI Infrastructure or having to deploy the Intune SCEP Connector, everything can be managed within Intune. You basically have…

  • Deploy a WPA3 Enterprise Wi-Fi Profile to Windows Endpoints using Intune

    Deploy a WPA3 Enterprise Wi-Fi Profile to Windows Endpoints using Intune

    If you ever tried to deploy a W-Fi Profile that is secured by WPA3 Enterprise to Windows Clients in Intune, you probably noticed, that this is not possible using the built-in Wi-Fi Template. Don’t worry, the solution is really simple, you can configure the Wi-Fi Profile on a Client, export it and then deploy it…

  • Enterprise App catalog now available in Intune Suite

    Enterprise App catalog now available in Intune Suite

    As announced in October last year: Introducing Microsoft Intune Enterprise App Management | Microsoft Intune Blog, the Intune Suite got a really cool new feature today, the Enterprise App catalog. The Enterprise App catalog allows you to search for your desired apps so you can easily add them in Intune. It will also allow you…

  • New Windows 365 Boot Features available for Windows Insiders

    New Windows 365 Boot Features available for Windows Insiders

    Compared to my blog post from last year about Windows 365 Boot: Windows 365 – Boot directly to your CloudPC – Mike’s MDM Blog (mikemdm.de) Windows 365 is now available in two different modes for Windows Insiders. A shared PC mode which is similar to the existing Windows 365 Boot Feature and a new personal…

  • Awarded as Microsoft Intune MVP

    Awarded as Microsoft Intune MVP

    I am thrilled to share that this week, I have been recognized as an MVP for Microsoft Intune. This is a great honor and I am humbled to be recognized for my contributions to the community. I am grateful for the opportunity to share my knowledge and expertise with others. I would like to thank…

  • Windows 11 23H2 is finally here

    Windows 11 23H2 is finally here

    Windows 11 finally got its well-deserved annual update 23H2. Windows Update History The update comes with a lot of long-awaited new features, like the new windows explorer user interface or the “never group” option for the taskbar. New features One little new option is the setting to disable the grouping of Apps in the Taskbar,…

  • Windows passwordless experience and Web Sign-in

    Windows passwordless experience and Web Sign-in

    Today I want to show you the new Windows passwordless experience and the new Web sign-in feature, which came with the latest Windows Update for Window 11 22H2. The passwordless experience will hide the password credential provider in the logon screen, to make it easier for the user to select a passwordless logon provider like…

  • Intune Remediation to verify BitLocker keys are uploaded to Entra ID

    Intune Remediation to verify BitLocker keys are uploaded to Entra ID

    Today I want to show you how you can check if the BitLocker Key Backup to Entra ID (AzureAD) was successfully done. We have configured BitLocker encryption in Intune to silently encrypt the system drive and automatically upload the recovery key. Usually these Settings should ensure, that the device is only encrypted if the Recovery…

  • Modern OS Provisioning for Windows Autopilot using OSDCloud

    Modern OS Provisioning for Windows Autopilot using OSDCloud

    Today I want to talk about modern OS Deployment for Windows Autopilot Enrollments using OSDCloud. Also, I will show you where we came from with regards of OS Provisioning and which customizations we made to OSDCloud to make it fit our needs even more. OSD using a SCCM Task Sequence When we started using Windows…

  • Windows 365 – Switch to your CloudPC via TaskView

    Windows 365 – Switch to your CloudPC via TaskView

    Today I want to talk about Windows 365 Switch, which is now available as public preview to Windows Insiders. With Windows 365 Switch you can access your CloudPC just like a second Desktop in Task View. Let’s start with the Prerequisites to start testing and I will go over, how it looks and my personal…

  • Windows 365 – Boot directly to your CloudPC

    Windows 365 – Boot directly to your CloudPC

    Today I want to talk about a cool new feature that Microsoft recently released as public preview, Windows 365 Boot. With Windows 365 Boot, you can convert every Windows 11 Client into a Thin Client like experience, that let you access your Windows 365 CloudPC super easy. Prerequisites Configuring the Guided scenario in Intune To…

  • Using Intune driver and firmware management to update your devices

    Using Intune driver and firmware management to update your devices

    Today I want to talk about a really cool feature, which came with Intune Release 2306, driver and firmware management in Intune. While the backend service using Windows Update for Business Deployment Services (WUfB-DS) was available earlier, you had to create the policy’s manually via Graph API. Now with the seamless integration in Intune, it’s…

  • Run Applications in Intune Company Portal on Demand

    Run Applications in Intune Company Portal on Demand

    Have you ever wondered, if you can run an application or script on Demand with Intune Company Portal, like you could do in SCCM / ConfigMgr when choosing Packages instead of Applications? Currently this is not possible out of the Box with Intune, but today I want to show you, what you can do to…

  • Organizational messages in Microsoft Intune and custom messages via Powershell

    Organizational messages in Microsoft Intune and custom messages via Powershell

    Today I want to talk about Organizational messages in Microsoft Intune, what you can do with them and what you can do, if you need a more customizable notification area message, than what is currently possible in Intune. Organizational messages Let’s start with what are Organizational messages. They are a really cool new feature, that…

  • Deploy a basic WDAC Policy with Intune as managed Installer

    Deploy a basic WDAC Policy with Intune as managed Installer

    Today I want to show you, how you can deploy a basic WDAC (Windows Defender Application Control) Policy that uses the Intune Management Extension (IME) as managed Installer to allow only Apps that are deployed via Intune. WDAC Policy At first we start creating a basic WDAC Policy, using the officia WDAC Wizard from: https://webapp-wdac-wizard.azurewebsites.netWe…

  • Create or set Registry Keys in Intune using (Proactive) Remediations

    Create or set Registry Keys in Intune using (Proactive) Remediations

    Today I will show you, how you can create or set Registry Keys using Intune (Proactive) Remediations. For (Hybrid) Domain joined Clients we used Group Policy Preferences to set these RegKeys, but as there is no such thing for Azure AD joined Clients, we will use a small remediation script for this. As an example,…

  • Verify and replace Files with Proactive Remediations in Intune

    Verify and replace Files with Proactive Remediations in Intune

    Today I will show you how you can verify (small) files like configuration files with (Proactive) Remediations in Microsoft Intune. We can use this to replace Group Policy Preferences File rules, as long as the files are smaller then 200KB, if they are bigger i would suggest to wrap it in a Win32 Application, then…

  • Update Intune Win32 Apps using Applicability Rules

    Update Intune Win32 Apps using Applicability Rules

    today I want to show you how to update Win32 Apps using Applicability Rules in Intune. Let’s pretend all Apps are brought to the User as an Available assignment via Company Portal. This way every user can install all Apps that he needs by himself and still has only the Apps installed that he wants.…

  • Kiosk Mode / Digital Signage with Windows 11 Shell Launcher

    Kiosk Mode / Digital Signage with Windows 11 Shell Launcher

    If you have to deploy many devices as Digital Signage or in Kiosk Mode where nearly all devices have to show something, I maybe have a solution for you today. When we were in the same situation that we wanted to use the Shell Launcher v2 part of Assigned Access: Use Shell Launcher to create…

  • Use Microsoft Connected Cache for your own downloads

    Use Microsoft Connected Cache for your own downloads

    A while ago i posted an article, that showed, how you can add custom URLs to your Microsoft Connected Cache Server, but I never showed you, why you would want to do something like this: Add Custom Sources Microsoft Connected Cache – Mike’s MDM Blog (mikemdm.de) DO-Downloader Today I will show you, what you can…

  • Autopilot Companion based on Power Apps

    Autopilot Companion based on Power Apps

    A few years ago, when we started to use Windows Autopilot to enroll our first devices, we quickly saw the need for a Companion App to handle GroupTags for our different Enrollment types like “normal” user-driven enrollments or different Pre-provisioning scenarios (formerly White Glove). So we started with the official App from Michael Niehaus: microsoft/WindowsAutopilotCompanion:…

  • User driven Device Group Membership

    User driven Device Group Membership

    Today I want you present my solution to allow your end-users to add their device to an AzureAD Group on their own. We are using something like this, to allow our users to select which devices should for example receive the Windows 11 Upgrade earlier then others, but I think there are way more possible…

  • Install Win32 Apps visible via Intune

    Install Win32 Apps visible via Intune

    Have you ever wondered if it is possible to install Apps as system interactively like it is possible in SCCM / MECM with the “Allow users to view and interact with the program installation” Option enabled? Unfortunately this is no possible with built-in methods, but there is a really easy solution for this in the…

  • Add Custom Sources Microsoft Connected Cache

    Add Custom Sources Microsoft Connected Cache

    Ever wondered if it is possible to add custom sources to a SCCM based Microsoft Connected Cache? It is absolutely possible as long as we talk about HTTP and not HTTPS, we can simply add the additional Server URL as a ServerFarm to IIS and add the needed URL Rewrite Rule Lets start with the…

  • Automate Autopilot Uploads with Azure Automation Runbooks

    Automate Autopilot Uploads with Azure Automation Runbooks

    Based on an old Article from Oliver Kieselbach about automating Autopilot Uploads, I wanted to share you my solution to this, slightly modified and improved: Automation of gathering and importing Windows Autopilot information – Modern IT – Cloud – Workplace (oliverkieselbach.com) In his Article he described a way, where the Hash was collected in form…

  • Custom ADMX Templates in Intune

    Custom ADMX Templates in Intune

    Ever wondered, if and how you can set a Registry Key via Intune without having to deploy a PowerShell Script? You totally can do this now relatively easy via ADMX Ingestion like described here: Import custom and third party partner ADMX templates in Microsoft Intune | Microsoft Learn In my example I wanted to set…

  • Can you create a Autopilot Hash from WinPE? Yes!

    Can you create a Autopilot Hash from WinPE? Yes!

    Have you ever wondered if you can harvest the Windows Autopilot Hardware 4k Hash from WinPE like used in MDT/SCCM or similar Deployment Systems? Yes, it is absolutely possible, when you keep an eye on a few details that i will describe here. First thing that you may notice, you can’t use the official Microsoft…