Reading Time: 26 minutesWindows LAPS with Intune is now the default answer for managing local administrator passwords, and if you set this up more than a couple of years ago, almost none of what you built still applies. A while back we walked through enabling LAPS for our Windows devices. At the time, managing that local admin account…
Reading Time: 4 minutesA free, open-source PowerShell/WPF tool for Intune admins to run Intune bulk actions, reports, and cleanup tasks in minutes instead of hours. If you manage Intune for more than a handful of devices, you already know the pain. The portal is fine for one-off changes, but the moment you need to import 40 devices to…
Reading Time: 18 minutesThis is Part 3, the final part on Azure Function and Intune Automation. In the series on automating Intune device group membership beyond what dynamic rules can express we covered the gap itself on Part 1, Part 2 covered the cloud-only Azure Function Intune automation architecture behind it. This post is the actual implementation: every…
Reading Time: 7 minutesThis is Part 2 in the series on automating Intune device group membership beyond what dynamic rules can express using an Azure Function and Graph API. In Part 1, we covered the gap itself; this post walks through the actual Azure Function Intune automation architecture behind it: a cloud-only design that runs entirely inside the…
Reading Time: 5 minutesEntra ID dynamic groups are powerful, but they can’t query everything – and this is the first post in a series showing how to automate Intune device management tasks that fall outside what dynamic membership rules can express, specifically adding and removing devices from Entra groups based on installed software and other conditions, built entirely…
Reading Time: 14 minutesEntra ID Conditional Access policies, Intune compliance, error AADSTS53000 and token flow. Every admin has heard these words but its not always clear how all these work together. It’s 14:30 on a Tuesday. A user calls the helpdesk – Outlook stopped working mid-session. Nothing changed on their device, no prompt appeared, no warning. Just AADSTS53000…
Reading Time: 7 minutesLearn how to pass parameters to a PowerShell script inside an .intunewin package deployed via Intune Win32 app management – with real examples and gotchas. A common question from Intune admins who package PowerShell scripts as Win32 apps is whether you can pass parameters at deploy time rather than hardcoding them inside the script. The…
Reading Time: 10 minutesIn this short post we will explore how to bulk restart Intune devices using PowerShell and the Microsoft Graph API rebootNow action. Includes a production-ready script with multiple targeting modes, logging, and throttling protection Sometimes you just need to restart a fleet of devices — right now. In practice, Windows devices don’t often need a…
Reading Time: 10 minutesLearn how to bulk reinstall Android apps in Microsoft Intune using the changeAssignments Graph API action and PowerShell – with a real-world explanation of why the app comes back after removal. The Observation That Started This A while back Microsoft made a very useful feature available in Intune: the Remove apps and configuration remote action…
Reading Time: 8 minutesIf you manage shared devices with Microsoft Intune, chances are you’ve run into this frustrating wall: you deploy Windows Hello for Business, everything looks fine in the portal, and then a user sits down at a shared PC and simply cannot enroll. No biometrics prompt, no PIN setup, nothing. The option is just… gone. This…
Reading Time: 7 minutesSo I was trying to find the Intune remediation scripts assignments to perform a cleanup and wanted to avoid the manual check of every single script — going into each one, checking its assignments, filters, and schedules one by one. If you have ever been there, you know how tedious that gets, especially when you…
Reading Time: 5 minutesManaged bookmarks (aka Managed Favorites) in Microsoft Edge are one of those small Intune wins that make a big difference: you give users a clean, consistent set of “company links” in Microsoft Edge, and because they’re policy-driven, they stay there (and users can’t accidentally delete or rename them). In Microsoft Edge, this is done with…
Reading Time: 5 minutesAudit devices by Entra ID, verify if they exist in Windows Autopilot, and export results to CSV using Microsoft Graph—fast, reliable, and admin-friendly. If you manage a large device fleet, you’ve probably faced this question more than once: “Is this device in Intune—and does it also exist in Autopilot?” When you’re troubleshooting provisioning issues, cleaning…
Reading Time: 26 minutesIn this post we will deep dive into ASR (Attack Surface Reduction) Rules of Microsoft Defender and provide all the required information that a System Administrator will need to understand before deploying this amazing security measure. Introduction to Attack Surface Reduction Rules Attack Surface Reduction rules are a critical component of Microsoft Defender for Endpoint…
Reading Time: 7 minutesA common operational requirement in Intune is to rename devices at scale, yet Intune does not provide a native bulk rename capability for existing devices. This post introduces a practical, production-ready PowerShell solution that uses Microsoft Graph to safely and consistently rename Intune-managed devices. The script is designed for real-world tenant usage, focusing on correctness,…
Reading Time: 8 minutesTPM and BIOS, but why? As IT Administrators, we are constantly chasing hardware compliance. Whether you are auditing your fleet for Windows 11 readiness, verifying security baselines, or simply trying to identify aging hardware, having visibility into the granular details of your endpoints is crucial. While Microsoft Intune provides a robust web console, clicking through…
Reading Time: 5 minutesCompany Portal may seem like just another app, but it is, in fact, a critically important platform for any modern enterprise. Company Portal’s success, however, is not just about making apps available; it’s about creating an experience that employees actually want to use. So, what does an unsuccessful Company Portal look like? It’s a digital ghost town, or worse,…
Reading Time: 14 minutesIn this post, we’ll look at 2 simple ways to correct the primary user of a device in Intune: All the script can be found in my GitHub page. Always test these scripts on a single, non-production device before applying them broadly. Behavior may vary depending on your environment, Intune configuration, and Graph API changes….
Reading Time: 5 minutesIn this short post we will explore how to block personal devices enrollment and allow only corporate identified devices to enroll in an Intune tenant. In modern device management, securing your environment starts with controlling what types of devices can enroll into your MDM solution. With Microsoft Intune, organizations often want to block personally owned…
Reading Time: 3 minutesIn Microsoft Intune, policy tattooing refers to when a configuration setting applied via a Configuration Service Provider (CSP) remains on a Windows device even after you remove or unassign the corresponding Intune policy. Each Windows CSP decides autonomously whether to “clean up” its settings upon policy removal; CSPs that don’t revert their changes leave those…
Reading Time: 4 minutesDiscover an effective way to remove devices based on serial number from an Entra ID group. Managing device membership in Microsoft Entra ID groups is essential for maintaining security, ensuring compliance, and enforcing organizational policies at scale. Manually removing devices one by one is time-consuming and error-prone, especially when dealing with hundreds or thousands of…
Reading Time: 6 minutesIn this post, we’ll explore how to reliably deploy registry changes under the HKEY_USERS (HKU) and HKEY_CURRENT_USER (HKCU) hive using Microsoft Intune. While Group Policy Preferences have long enabled administrators to target HKCU with ease, Intune’s lack of a built-in HKCU registry deployment feature forces us to adopt alternative methods. We’ll first review Intune’s proactive…
Reading Time: 3 minutesWindows activation status is a critical check for ensuring that your devices are properly licensed and secure. In this post, we’ll walk through a simple PowerShell detection script you can deploy via Intune to automatically verify whether Windows is activated on managed devices. By the end, you’ll have a quick, reliable method for monitoring activation…
Reading Time: 5 minutesForce restart but why? Building on our previous guide to scheduling restart notifications with Intune, this post addresses what to do when users continually ignore the notification or close their lids without rebooting—leaving systems unpatched and vulnerable. We’ll explore how to detect devices’ last reboot time and enforce a forced restart via Intune remediation ensuring…
Reading Time: 9 minutesThe Intune Company Portal serves as your end‑user’s gateway to enrolling and managing devices—whether corporate‑owned or BYOD—across Windows, iOS, and Android. In this ultimate guide, we’ll walk through every aspect: what the portal is, why it’s the simplest deployment path, how to configure your tenant’s settings related to it, branding, monitoring, security integrations, best practices,…
Reading Time: 9 minutesModern device management in Microsoft Entra and Intune hinges on understanding where and how a device is registered or joined. The key states are: …and in Intune: Plus the critical distinction between corporate-owned and BYOD (personal) devices. Each state unlocks different management capabilities—from full policy application and remote wipe to app-only protection. Directory Join &…
Reading Time: 6 minutesThe Intune remote actions are always a tricky part when managing devices with Intune. Wipe, Delete, Retire, Autopilot Reset or Fresh Start. What to select and when? That’s always an interesting question. Managing Windows devices with Microsoft Intune means having the right tool for every situation. In today’s post, we’ll explore the remote actions available…
Reading Time: 10 minutesDeploying a consistent desktop background across an organization not only reinforces brand identity but also enhances the overall user experience. Traditionally, achieving this through Microsoft Intune has involved methods such as deploying Win32 applications, configuring profiles, or hosting images on the cloud. However, these approaches can introduce complexities and dependencies. In this guide, we present…
Reading Time: 4 minutesIn this post, we explore how to enable location services in Windows devices using Intune—a feature that not only enhances our ability to locate devices in real time but also bolsters overall security and compliance. March 2026: Tested it on a fresh 25H2 machine and it worked. The location services turn to enabled and cannot…
Reading Time: 7 minutesIn this post, we will explore how to block URLs access using Intune in specific browsers. In today’s fast-paced digital environment, managing and securing web access across your organization is more critical than ever. With employees relying on multiple browsers such as Microsoft Edge, Mozilla Firefox, and Google Chrome, IT administrators face the challenge of…
Reading Time: 6 minutesIn this post we will discuss how to block app installations from MS Store and an alternative way to install them using Intune. When managing Windows devices in an enterprise, controlling where users install applications from is a key security and compliance measure. The Microsoft Store is a great source for apps, but unrestricted access…
Reading Time: 3 minutesOne of the critical tasks for administrators is managing and fetching assignments for various profiles in Intune—whether for device configurations, application deployments, or security policies. In this post, we’ll walk through a PowerShell script designed to efficiently retrieve assignments for all your created configuration profiles, compliance policies, applications, scripts, and more within Microsoft Intune. This…
Reading Time: 5 minutesIn this short blog we are going to see some essential configurations to allow the screen projection to external monitors from Intune managed devices. Once Upon a Screen Projection Challenge There was a time when we found ourselves grappling with what seemed like a straightforward task—projecting the screen of an Intune-managed laptop to an external…
Reading Time: 10 minutesIn this blog post, we’ll explore how to retrieve app configuration settings for Android devices managed via Intune, using PowerShell and the Microsoft Graph API. First, we’ll break down what app configuration settings are and their significance in modern device management. Then, we’ll dive into a step-by-step process to fetch these settings programmatically, providing practical…
Reading Time: 3 minutesIn todays post we will discuss about Intune device cleanup rules. One of Intune’s lesser-known but incredibly useful features is the Cleanup Rules functionality. These rules act as the unsung heroes of device management, quietly maintaining the cleanliness and efficiency of your Intune environment. In this article, we’ll demystify Intune Cleanup Rules, exploring how they…
Reading Time: 5 minutesIn this short post we will explore what is Intune MDM Certificate and what are its usages and functionalities. What is an MDM Certificate? The Mobile Device Management (MDM) certificate, also known as the Intune certificate, is a crucial component in the device enrollment and management process within Microsoft Intune. This digital certificate serves as…
Reading Time: 10 minutesIn this post we will explore how to create desktop shortcuts using Intune Remediations and PowerShell. As organizations continue to embrace the benefits of modern workplace solutions, the ability to efficiently manage and configure user environments has become increasingly important. One such task that often arises is the need to create and deploy desktop shortcuts…
Reading Time: 10 minutesFollowing last year’s post, which we’ll call Part 1, about how to force redeployment of a specific application on an endpoint, this blog post will delve into the process of compelling a device to check for all scripts and applications deployed to it. This guide can be incredibly useful for administrators who are testing scripts…
Reading Time: 6 minutesIn today’s digital workplace, efficient disk space management is crucial for maintaining optimal performance and productivity on Windows devices. While Microsoft Intune offers various configuration profiles to manage storage, savvy IT professionals are turning to more dynamic and customizable solutions. Enter the power of remediation scripts – a game-changing approach to automated disk space management….
Reading Time: 12 minutesManaged Home Screen (MHS) is an innovative feature within Microsoft Intune that revolutionizes the way organizations control and customize the home screen experience on corporate-owned Android devices. By leveraging MHS, IT administrators can lock down devices to a single app or a set of specific apps, ensuring that employees have streamlined access to the tools…
Reading Time: 4 minutesOne of the critical components of Intune’s device management is the Global Reevaluation Schedule (GRS). This blog post aims to provide a comprehensive overview of Intune GRS, detailing its functionality, usage, troubleshooting, and key registry settings that IT administrators need to know. What is Intune GRS? The Global Reevaluation Schedule is a mechanism within Microsoft…
Reading Time: 5 minutesThe “MG Cmdlets Cheat sheet” post serves as a vital resource for administrators aiming to harness the full potential of Microsoft Graph PowerShell cmdlets. While Microsoft’s official documentation offers excellent instructions on utilizing these cmdlets, it often falls short in revealing the complete array of fields returned upon execution. This gap can lead to missed…
Reading Time: 7 minutesIn the ever-evolving landscape of device management, system administrators play a pivotal role in ensuring that devices are used efficiently and securely within their organizations. A key part of this role involves monitoring who is accessing which devices and when. Specifically, for those managing devices with Microsoft Intune, identifying the last logged-in user on a…
Reading Time: 6 minutesThe ability to find and manage local administrators on Intune-managed devices in essential to ensure effective management and protection of endpoints. Why is this so crucial? Local administrators wield significant power over their devices, from installing software and changing settings to accessing all files on the system. While this level of access is necessary for…
Reading Time: 9 minutesIn today’s fast-paced and technology-driven world, managing and securing devices within an organization can be a challenging task. One crucial aspect of this is ensuring that devices are regularly updated and restarted without causing major disruptions to workflow. This is where Microsoft Intune steps in as a game-changer. In this blog post, we will focus…
Reading Time: 3 minutesEmbarking on the journey of Windows Autopilot management? Buckle up as we unveil a nifty script that’s about to become your secret weapon for a seamless bulk update of group tags on Windows Autopilot devices. Say goodbye to tedious manual adjustments and wave hello to efficiency at its finest! Script Logic To seamlessly change the…
Reading Time: 3 minutesIn this short post, we will explore how to view discovered apps on Intune devices. In addition, we will develop a script to obtain the above apps. Discovered apps via Intune Portal Discovered apps in Intune are a list of all the apps that are detected on Intune-enrolled devices in a tenant. This includes both…
Reading Time: 3 minutesIn this post, we will explore how to obtain the hardware specifications of Intune devices using a Remediations script. Device Hardware Specs In the context of this post, we will define ‘Hardware Specs’ as specific attributes of an endpoint, such as memory and CPU information. While Intune provides information about various specifications, such as memory…
Reading Time: 3 minutesIn this post we will write a PowerShell script that gets the assigned groups per application in Intune. Script Logic This script will be used to get the assigned groups for each application in Intune. Initially it will query all the application created and then search for all the groups assigned to these applications. We…
Reading Time: 4 minutesIn this short post we will see an easy hack to find a desired query to be used in graph explorer using the Intune portal. Scenario Many times administrators want to query information regarding Intune data from Graph explorer itself. They may want to see the data directly in the Graph Explorer, which includes sometimes…
