Reading Time: 20 minutesLearn how to implement Microsoft Entra PIM with built-in roles, custom roles, and PIM for Groups. Step-by-step guide covering activation settings, access reviews, security alerts, and best practices to eliminate standing access. Note: This is not my typical Intune-focused post. Think of it as a security and identity governance deep dive – though as you…
Reading Time: 26 minutesWindows LAPS with Intune is now the default answer for managing local administrator passwords, and if you set this up more than a couple of years ago, almost none of what you built still applies. A while back we walked through enabling LAPS for our Windows devices. At the time, managing that local admin account…
Reading Time: 4 minutesA free, open-source PowerShell/WPF tool for Intune admins to run Intune bulk actions, reports, and cleanup tasks in minutes instead of hours. If you manage Intune for more than a handful of devices, you already know the pain. The portal is fine for one-off changes, but the moment you need to import 40 devices to…
Reading Time: 18 minutesThis is Part 3, the final part on Azure Function and Intune Automation. In the series on automating Intune device group membership beyond what dynamic rules can express we covered the gap itself on Part 1, Part 2 covered the cloud-only Azure Function Intune automation architecture behind it. This post is the actual implementation: every…
Reading Time: 7 minutesThis is Part 2 in the series on automating Intune device group membership beyond what dynamic rules can express using an Azure Function and Graph API. In Part 1, we covered the gap itself; this post walks through the actual Azure Function Intune automation architecture behind it: a cloud-only design that runs entirely inside the…
Reading Time: 5 minutesEntra ID dynamic groups are powerful, but they can’t query everything – and this is the first post in a series showing how to automate Intune device management tasks that fall outside what dynamic membership rules can express, specifically adding and removing devices from Entra groups based on installed software and other conditions, built entirely…
Reading Time: 5 minutesYou’ve been there. You patched 40 CVEs across your fleet, went back to the dashboard, and the exposure score barely moved. You had to explain that to a manager and it wasn’t fun. That’s not just bad UX – it was a real modelling problem with how Microsoft calculated the score. And on May 31,…
Reading Time: 14 minutesEntra ID Conditional Access policies, Intune compliance, error AADSTS53000 and token flow. Every admin has heard these words but its not always clear how all these work together. It’s 14:30 on a Tuesday. A user calls the helpdesk – Outlook stopped working mid-session. Nothing changed on their device, no prompt appeared, no warning. Just AADSTS53000…
Reading Time: 7 minutesLearn how to pass parameters to a PowerShell script inside an .intunewin package deployed via Intune Win32 app management – with real examples and gotchas. A common question from Intune admins who package PowerShell scripts as Win32 apps is whether you can pass parameters at deploy time rather than hardcoding them inside the script. The…
Reading Time: 10 minutesIn this short post we will explore how to bulk restart Intune devices using PowerShell and the Microsoft Graph API rebootNow action. Includes a production-ready script with multiple targeting modes, logging, and throttling protection Sometimes you just need to restart a fleet of devices — right now. In practice, Windows devices don’t often need a…
Reading Time: 10 minutesLearn how to bulk reinstall Android apps in Microsoft Intune using the changeAssignments Graph API action and PowerShell – with a real-world explanation of why the app comes back after removal. The Observation That Started This A while back Microsoft made a very useful feature available in Intune: the Remove apps and configuration remote action…
Reading Time: 5 minutesLearn how to bulk import users to Entra ID group using PowerShell and Microsoft Graph API. Import from a text file, skip existing members and ready. Why Automate This? If you have ever had to onboard a wave of users into an Entra ID group manually – whether it is for a migration, a new…
Reading Time: 8 minutesIf you manage shared devices with Microsoft Intune, chances are you’ve run into this frustrating wall: you deploy Windows Hello for Business, everything looks fine in the portal, and then a user sits down at a shared PC and simply cannot enroll. No biometrics prompt, no PIN setup, nothing. The option is just… gone. This…
Reading Time: 7 minutesSo I was trying to find the Intune remediation scripts assignments to perform a cleanup and wanted to avoid the manual check of every single script — going into each one, checking its assignments, filters, and schedules one by one. If you have ever been there, you know how tedious that gets, especially when you…
Reading Time: 5 minutesManaged bookmarks (aka Managed Favorites) in Microsoft Edge are one of those small Intune wins that make a big difference: you give users a clean, consistent set of “company links” in Microsoft Edge, and because they’re policy-driven, they stay there (and users can’t accidentally delete or rename them). In Microsoft Edge, this is done with…
Reading Time: 5 minutesAudit devices by Entra ID, verify if they exist in Windows Autopilot, and export results to CSV using Microsoft Graph—fast, reliable, and admin-friendly. If you manage a large device fleet, you’ve probably faced this question more than once: “Is this device in Intune—and does it also exist in Autopilot?” When you’re troubleshooting provisioning issues, cleaning…
Reading Time: 26 minutesIn this post we will deep dive into ASR (Attack Surface Reduction) Rules of Microsoft Defender and provide all the required information that a System Administrator will need to understand before deploying this amazing security measure. Introduction to Attack Surface Reduction Rules Attack Surface Reduction rules are a critical component of Microsoft Defender for Endpoint…
Reading Time: 6 minutesIn this practical, enterprise-grade guide we will explore how to tag devices for pilots, rings, and dynamic targeting using extension attributes. When you manage a large device estate in Microsoft Entra ID, the hardest part of “safe change” isn’t creating policies—it’s targeting the right subset of devices without turning group membership into a manual, error-prone…
Reading Time: 7 minutesA common operational requirement in Intune is to rename devices at scale, yet Intune does not provide a native bulk rename capability for existing devices. This post introduces a practical, production-ready PowerShell solution that uses Microsoft Graph to safely and consistently rename Intune-managed devices. The script is designed for real-world tenant usage, focusing on correctness,…
Reading Time: 8 minutesTPM and BIOS, but why? As IT Administrators, we are constantly chasing hardware compliance. Whether you are auditing your fleet for Windows 11 readiness, verifying security baselines, or simply trying to identify aging hardware, having visibility into the granular details of your endpoints is crucial. While Microsoft Intune provides a robust web console, clicking through…
Reading Time: 5 minutesCompany Portal may seem like just another app, but it is, in fact, a critically important platform for any modern enterprise. Company Portal’s success, however, is not just about making apps available; it’s about creating an experience that employees actually want to use. So, what does an unsuccessful Company Portal look like? It’s a digital ghost town, or worse,…
Reading Time: 14 minutesIn this post, we’ll look at 2 simple ways to correct the primary user of a device in Intune: All the script can be found in my GitHub page. Always test these scripts on a single, non-production device before applying them broadly. Behavior may vary depending on your environment, Intune configuration, and Graph API changes….
Reading Time: 5 minutesIn this short post we will explore how to block personal devices enrollment and allow only corporate identified devices to enroll in an Intune tenant. In modern device management, securing your environment starts with controlling what types of devices can enroll into your MDM solution. With Microsoft Intune, organizations often want to block personally owned…
Reading Time: 3 minutesIn Microsoft Intune, policy tattooing refers to when a configuration setting applied via a Configuration Service Provider (CSP) remains on a Windows device even after you remove or unassign the corresponding Intune policy. Each Windows CSP decides autonomously whether to “clean up” its settings upon policy removal; CSPs that don’t revert their changes leave those…
Reading Time: 4 minutesDiscover an effective way to remove devices based on serial number from an Entra ID group. Managing device membership in Microsoft Entra ID groups is essential for maintaining security, ensuring compliance, and enforcing organizational policies at scale. Manually removing devices one by one is time-consuming and error-prone, especially when dealing with hundreds or thousands of…
Reading Time: 6 minutesIn this post, we’ll explore how to reliably deploy registry changes under the HKEY_USERS (HKU) and HKEY_CURRENT_USER (HKCU) hive using Microsoft Intune. While Group Policy Preferences have long enabled administrators to target HKCU with ease, Intune’s lack of a built-in HKCU registry deployment feature forces us to adopt alternative methods. We’ll first review Intune’s proactive…
Reading Time: 3 minutesWindows activation status is a critical check for ensuring that your devices are properly licensed and secure. In this post, we’ll walk through a simple PowerShell detection script you can deploy via Intune to automatically verify whether Windows is activated on managed devices. By the end, you’ll have a quick, reliable method for monitoring activation…
Reading Time: 5 minutesForce restart but why? Building on our previous guide to scheduling restart notifications with Intune, this post addresses what to do when users continually ignore the notification or close their lids without rebooting—leaving systems unpatched and vulnerable. We’ll explore how to detect devices’ last reboot time and enforce a forced restart via Intune remediation ensuring…
Reading Time: 9 minutesThe Intune Company Portal serves as your end‑user’s gateway to enrolling and managing devices—whether corporate‑owned or BYOD—across Windows, iOS, and Android. In this ultimate guide, we’ll walk through every aspect: what the portal is, why it’s the simplest deployment path, how to configure your tenant’s settings related to it, branding, monitoring, security integrations, best practices,…
Reading Time: 9 minutesModern device management in Microsoft Entra and Intune hinges on understanding where and how a device is registered or joined. The key states are: …and in Intune: Plus the critical distinction between corporate-owned and BYOD (personal) devices. Each state unlocks different management capabilities—from full policy application and remote wipe to app-only protection. Directory Join &…
Reading Time: 6 minutesThe Intune remote actions are always a tricky part when managing devices with Intune. Wipe, Delete, Retire, Autopilot Reset or Fresh Start. What to select and when? That’s always an interesting question. Managing Windows devices with Microsoft Intune means having the right tool for every situation. In today’s post, we’ll explore the remote actions available…
Reading Time: 13 minutesLearn how to utilize sign-in audit Logs and Get-MgAuditLogSignIn to get information related to users, devices, sign-ins and many more. In today’s cloud-driven world, user sign-ins happen almost every second—across different devices, applications, and locations. Yet, for many IT teams, sign-in audit logs remain an underutilized resource, quietly capturing critical details about who’s accessing what,…
Reading Time: 10 minutesDeploying a consistent desktop background across an organization not only reinforces brand identity but also enhances the overall user experience. Traditionally, achieving this through Microsoft Intune has involved methods such as deploying Win32 applications, configuring profiles, or hosting images on the cloud. However, these approaches can introduce complexities and dependencies. In this guide, we present…
Reading Time: 4 minutesIn this post, we explore how to enable location services in Windows devices using Intune—a feature that not only enhances our ability to locate devices in real time but also bolsters overall security and compliance. March 2026: Tested it on a fresh 25H2 machine and it worked. The location services turn to enabled and cannot…
Reading Time: 7 minutesIn this post, we will explore how to block URLs access using Intune in specific browsers. In today’s fast-paced digital environment, managing and securing web access across your organization is more critical than ever. With employees relying on multiple browsers such as Microsoft Edge, Mozilla Firefox, and Google Chrome, IT administrators face the challenge of…
Reading Time: 6 minutesIn this post we will discuss how to block app installations from MS Store and an alternative way to install them using Intune. When managing Windows devices in an enterprise, controlling where users install applications from is a key security and compliance measure. The Microsoft Store is a great source for apps, but unrestricted access…
Reading Time: 3 minutesOne of the critical tasks for administrators is managing and fetching assignments for various profiles in Intune—whether for device configurations, application deployments, or security policies. In this post, we’ll walk through a PowerShell script designed to efficiently retrieve assignments for all your created configuration profiles, compliance policies, applications, scripts, and more within Microsoft Intune. This…
Reading Time: 4 minutesIn this post, we’ll walk through a PowerShell script that leverages Microsoft Graph and Get-MgUser cmdlet to retrieve essential user details, such as display name, email, job title, and more, directly from Entra ID. This simple yet powerful script can be a valuable tool for administrators looking to automate user information retrieval. Get-MgUser Cmdlet The…
Reading Time: 5 minutesIn this short blog we are going to see some essential configurations to allow the screen projection to external monitors from Intune managed devices. Once Upon a Screen Projection Challenge There was a time when we found ourselves grappling with what seemed like a straightforward task—projecting the screen of an Intune-managed laptop to an external…
Reading Time: 10 minutesIn this blog post, we’ll explore how to retrieve app configuration settings for Android devices managed via Intune, using PowerShell and the Microsoft Graph API. First, we’ll break down what app configuration settings are and their significance in modern device management. Then, we’ll dive into a step-by-step process to fetch these settings programmatically, providing practical…
Reading Time: 9 minutesIn this blog post, we’re going to explore an easy yet incredibly powerful detection script for applications on Windows devices. If you’ve ever tried to detect whether an application is installed on a Windows machine—whether you’re deploying a new app, troubleshooting an update, or just auditing your environment—you’ve likely faced some challenges. Finding a reliable,…
Reading Time: 6 minutesMicrosoft Teams has become ubiquitous in our professional lives, but sometimes you need a clean slate. Whether you’re troubleshooting issues, migrating to the new Teams client, or managing enterprise deployments, proper uninstallation is crucial. Although with the upgrade to new Teams client the classic Teams is uninstalled automatically, this isn’t always the case. In this…
Reading Time: 3 minutesIn todays post we will discuss about Intune device cleanup rules. One of Intune’s lesser-known but incredibly useful features is the Cleanup Rules functionality. These rules act as the unsung heroes of device management, quietly maintaining the cleanliness and efficiency of your Intune environment. In this article, we’ll demystify Intune Cleanup Rules, exploring how they…
Reading Time: 5 minutesIn this short post we will explore what is Intune MDM Certificate and what are its usages and functionalities. What is an MDM Certificate? The Mobile Device Management (MDM) certificate, also known as the Intune certificate, is a crucial component in the device enrollment and management process within Microsoft Intune. This digital certificate serves as…
Reading Time: 10 minutesIn this post we will explore how to create desktop shortcuts using Intune Remediations and PowerShell. As organizations continue to embrace the benefits of modern workplace solutions, the ability to efficiently manage and configure user environments has become increasingly important. One such task that often arises is the need to create and deploy desktop shortcuts…
Reading Time: 10 minutesFollowing last year’s post, which we’ll call Part 1, about how to force redeployment of a specific application on an endpoint, this blog post will delve into the process of compelling a device to check for all scripts and applications deployed to it. This guide can be incredibly useful for administrators who are testing scripts…
Reading Time: 6 minutesIn today’s digital workplace, efficient disk space management is crucial for maintaining optimal performance and productivity on Windows devices. While Microsoft Intune offers various configuration profiles to manage storage, savvy IT professionals are turning to more dynamic and customizable solutions. Enter the power of remediation scripts – a game-changing approach to automated disk space management….
Reading Time: 12 minutesManaged Home Screen (MHS) is an innovative feature within Microsoft Intune that revolutionizes the way organizations control and customize the home screen experience on corporate-owned Android devices. By leveraging MHS, IT administrators can lock down devices to a single app or a set of specific apps, ensuring that employees have streamlined access to the tools…
Reading Time: 4 minutesOne of the critical components of Intune’s device management is the Global Reevaluation Schedule (GRS). This blog post aims to provide a comprehensive overview of Intune GRS, detailing its functionality, usage, troubleshooting, and key registry settings that IT administrators need to know. What is Intune GRS? The Global Reevaluation Schedule is a mechanism within Microsoft…
Reading Time: 5 minutesThe “MG Cmdlets Cheat sheet” post serves as a vital resource for administrators aiming to harness the full potential of Microsoft Graph PowerShell cmdlets. While Microsoft’s official documentation offers excellent instructions on utilizing these cmdlets, it often falls short in revealing the complete array of fields returned upon execution. This gap can lead to missed…
