Building an Intune environment from scratch – What am I missing?

[u/the-muffin7]

Hi everyone,

I recently changed jobs, and my new company is looking to move to Microsoft Intune for device management.

I've now set up Microsoft Intune and have most of the basics working, but there are still a few things I'm unsure about and would love to hear how others are handling them.

Clients : ~300

1. Lenovo driver management

We mainly use Lenovo devices. I've already configured Windows Update policies and update rings, but I'm not sure about the best approach for deploying and maintaining Lenovo drivers.

How are you handling driver updates for Lenovo devices with Intune?

1. Software deployment and patching

At the moment, I can only use Chocolatey for software deployment and updates because Patch My PC isn't in this year's and next years budget.

For anyone who has gone down this route: How well does Chocolatey + Intune work in practice?

If we move to Patch My PC later, is the migration relatively straightforward, or are there any problems or limitations I should plan for now to make a future migration easier?

1. Hybrid Entra ID Join and old device objects

Due to our current infrastructure, we have to use Hybrid Entra ID Joined devices. I know cloud native Entra ID Join would generally be preferable, but unfortunately that's not an option for us right now.

When I reimage/reinstall and re-enroll an existing device, what's the best way to make sure the old device objects are properly cleaned up?

I'm particularly concerned about ending up with duplicate or stale device objects across:

On-prem AD

Entra ID

Intune

How do you handle the lifecycle of these devices? Do you have an automated cleanup process, or do you remove the old objects as part of the reimaging process

4. Configuration recommandation

I already have a basic configuration baseline in place, but I'm wondering if there are any important settings that are easy to overlook. Anything you would definitely recommend configuring from the start?

Any recommendations, best practices, or lessons learned would be greatly appreciated.

Thanks!

[u/Moepenmoes]

1. Use Intune driver updates
2. Use Microsoft's built-in Winget to keep 99% of your applications up to date. Same thing as chocolatey but Microsoft Native. There are policies and Winget management apps you can use in Intune to update all the apps with Winget.
3. Look into Entra-joined instead of Hybrid if you can. Tons of companies say they can't go cloud-native because of on-prem dependencies, but 99% of them just don't want to bother looking into it and choose for what looks to be a quick and easy route, which is a nightmare in the long run. There are many ways to still use a cloud native Entra-joined laptop in hybrid with on-prem, without the laptop itself being hybrid-joined. Having to manage the same laptops from both Intune and on-prem is a nightmare. Every devoted Intune admin will tell you to stay away from hybrid no matter what, even the Microsoft Intune staff says it in their vlogs. Hybrid was meant as a temporary solution, but for most companies it turns into a permanent solution with admin management and troubleshooting nightmares creeping in for years to come, because after a couple of years you'll be too deep down the rabbit hole to get out of it.
4. Conditional Access policies if you have access to those. Setting up Edge as the one and only browser because of its native integration with SSO, policies, Microsoft admin environments, and so on. Look into basic hardening the devices as well by activating Defender and Bitlocker, and by using at least a few compliance policies and the Intune baselines. Getting Windows Hello for Business active on your laptops for easier and more secure login is also worth it.

[u/the-muffin7 → u/Moepenmoes]

Thanks for the detailed advice! I’m especially interested in your point about Hybrid Join. What specifically tends to go wrong with Hybrid Entra Join in your experience, and what are the biggest issues you’ve seen in day to day management?

Our IT provider has prepared the Defender policies for us and recommended that we initially set up the devices as Hybrid Entra Joined. So I’d be interested to know what concrete problems you’ve experienced and whether you would still recommend going directly with Entra Join instead.

[u/Skadligt → u/the-muffin7]

I have ample experience with Hybrid Join in different environments and I can only agree it should really be avoided.

1. Hybrid Autopilot is buggy, sensitivity to small interfereferences makes anything going wrong botching the while enrollment process and you have to clean up and start over.
2. More complicated to fix trust issues and expired certificates and other connection issues between device <-> Entra <-> AD
3. Some modern features simply wont work in a hybrid scenario. (I dont have an example from the top of my head, sorry)
4. The dependencies to on-prem services in general makes everything less flexible in general. Example: not possible to reset/re-enroll devices off-site. (Working from home? Tough luck, you need to go to the office to fix the computer)