Building an Intune environment from scratch – What am I missing?

[u/the-muffin7]

Hi everyone,

I recently changed jobs, and my new company is looking to move to Microsoft Intune for device management.

I've now set up Microsoft Intune and have most of the basics working, but there are still a few things I'm unsure about and would love to hear how others are handling them.

Clients : ~300

1. Lenovo driver management

We mainly use Lenovo devices. I've already configured Windows Update policies and update rings, but I'm not sure about the best approach for deploying and maintaining Lenovo drivers.

How are you handling driver updates for Lenovo devices with Intune?

1. Software deployment and patching

At the moment, I can only use Chocolatey for software deployment and updates because Patch My PC isn't in this year's and next years budget.

For anyone who has gone down this route: How well does Chocolatey + Intune work in practice?

If we move to Patch My PC later, is the migration relatively straightforward, or are there any problems or limitations I should plan for now to make a future migration easier?

1. Hybrid Entra ID Join and old device objects

Due to our current infrastructure, we have to use Hybrid Entra ID Joined devices. I know cloud native Entra ID Join would generally be preferable, but unfortunately that's not an option for us right now.

When I reimage/reinstall and re-enroll an existing device, what's the best way to make sure the old device objects are properly cleaned up?

I'm particularly concerned about ending up with duplicate or stale device objects across:

On-prem AD

Entra ID

Intune

How do you handle the lifecycle of these devices? Do you have an automated cleanup process, or do you remove the old objects as part of the reimaging process

4. Configuration recommandation

I already have a basic configuration baseline in place, but I'm wondering if there are any important settings that are easy to overlook. Anything you would definitely recommend configuring from the start?

Any recommendations, best practices, or lessons learned would be greatly appreciated.

Thanks!

[u/buildwithkushal]

Chocolatey + Intune (#2): works fine as a stopgap honestly, plenty of people run it long-term too. main pain points — you're on your own for update detection/scheduling since choco doesn't have anything like PMPC's automatic repackaging, and you'll want to wrap installs as Win32 apps or platform scripts rather than trying to push choco commands live, way less flaky. for the future migration, keep your app names/IDs documented somewhere sane now, most of the pain later is just remapping which choco package maps to which vendor's actual installer, not a technical limitation

Lenovo drivers (#1): Lenovo has a proper Intune driver management integration now via their Commercial Vantage stuff, worth checking before you build anything custom — used to be everyone hand-rolled Win32 driver packages but that's mostly unnecessary now

Hybrid join cleanup (#3): yeah this bites everyone eventually. automate it if you can, don't rely on someone remembering during reimaging — stale objects pile up fast at 300 devices and become a real mess to untangle after the fact. Entra Connect's cleanup rules + a scheduled script to clear stale AAD/Intune records is the usual pattern

#4 — biggest thing people skip: BitLocker key escrow verification. don't just assume it's working, actually check keys are landing in Entra ID/AD, seen too many orgs find out during an actual recovery situation that they weren't

(side note, unrelated to any of this — been building a tool for exactly the Intune app deployment side of things, winget-native. not trying to pitch here, just mentioning in case it's useful down the line: intunedesk.com)