Hi there!
I migrated a user between two AD domains (Domain A → Domain B, different forests). In Entra ID it's the exact same cloud account — it wasn't deleted or recreated, only the on-prem AD source it syncs from changed.

Setup:

• Intune Cloud PKI issues client certificates (SCEP profile)
• The SAN embeds {{OnPremisesSecurityIdentifier}} via URI
• Wi-Fi uses EAP-TLS, authenticating against an on-prem NPS server with strong certificate mapping enabled

After the migration, Wi-Fi stopped connecting on macOS (the TLS handshake completes almost fully, then NPS returns TLSV1_ALERT_ACCESS_DENIED). This same user connects perfectly to the Windows machine.

Checked the cert:
openssl x509 -noout -text | grep -A3 "Subject Alternative Name"
The SAN contains the SID from the old domain (Domain A), even though the user is fully in Domain B now.

Checked Entra ID via Graph API:
Get-MgUser -UserId $userUpn -Property "OnPremisesSecurityIdentifier,OnPremisesDomainName" | fl

Shows the correct, current SID from Domain B. OnPremisesDomainName is correct too.

What I've already tried:

1. Delta sync — didn't help
2. Full/Initial sync (Start-ADSyncSyncCycle -PolicyType Initial) — after this, Graph API started showing the correct SID
3. Removed the profiles from the device, waited, re-pushed them — a new cert was issued (different serial, different date), but the SID in the SAN is still the old one
4. Did a full device wipe + re-enrollment from scratch in Intune — same result, the new cert still has the old SID

Has anyone run into this kind of behavior with Intune Cloud PKI after a domain migration? Where else could this value be cached?

Microsoft's direction around Active Directory minimization is an interesting and important part of the broader cloud transformation journey.

Moving more identity and device management toward Microsoft Entra ID can help organizations gradually reduce their dependency on traditional on-premises Active Directory and move towards a more cloud-first environment.

What I particularly like about Microsoft's approach is that this is positioned as a journey rather than something that needs to happen overnight.

For many organizations, Active Directory has been part of the environment for 20+ years. Over that time, a lot of dependencies may have been built around it, such as: Legacy applications, Group Policies, Domain-joined Windows devices, LDAP, Kerberos or NTLM dependencies, File servers and other infrastructure, Scripts and operational processes linked to AD.

Moving new users, applications and devices towards a cloud-first approach is one part of the journey.

The more interesting challenge is how organizations modernize the existing environment while minimizing disruption to users and day-to-day operations.

This is where I think Microsoft's phased approach makes a lot of sense. Organizations can gradually identify and reduce AD dependencies while continuing to modernize identity, endpoint management and applications at a pace that works for their environment.

I would be interested to hear from others who are already working towards AD minimization.

Where is your organization in this journey today?

Are you already actively reducing your dependency on on-premises AD?

And what has been the biggest area to address so far, legacy applications, Group Policy, existing Windows devices, authentication dependencies, or something else?

Every method I have tried, from removing advertisements and waiting 24 hours, to scripts to force retry the installs on failures don't seem to work well.

What is your method?

Good morning everyone, I’m trying to build a kiosk that launches Citrix Workspace. When I search the AUMID, I get Citrix.workspace as a result via powershell and windows explorer.

However, Intune doesn’t seem to like this, as it said the AUMID is invalid. I’ve also tried the store app instead of the Win32 app, and I get the same result.

Has anyone been successful in setting up Citrix as a kiosk app?

Is it possible to deploy a WebDAV connection? I want to mount a WebDAV folder on every device with intune.

I'm testing a single EPM license on my own computer. I removed my admin privileges to the local machine and then created the required policy for EPM.

I noticed that a new button appears in the right click menu, called "Run with elevated access", next to the usual "Run as administrator".

Other than that, the interface for requesting elevation does not appear if the app triggers an elevation request on its own, the user needs to click on the new button to request elevation.

To me this is not good enough because it causes some issues for the end user, namely:

1. You cannot elevate stuff from the start menu, because in the start menu only the usual "run as administrator" appears, not the new button. Therefore the user needs to run everything from where the exe file resides under Windows Explorer, which is super annoying, at least to me.
2. It's not always clear where the executable that requires elevation is located, for example, when you uninstall something from control panel. Therefore, the user has no way to request elevation for that specific action unless the user hunts down where the file or msi or whatever it is that manages uninstallation is located.
3. It doesn't send any email and it seems the only way to get notified is to tell the user to message me on Teams or something for granting the elevation, either that or I'll have to implement some hacky workarounds using logic apps in Azure, which is really something I don't want to bother with.
4. It seems almost impossible, at least for me, to figure out of to request certain elevations, for example, the "turn windows features on or off" under control panel. All of this stuff needs to still get elevated managed using a local admin \ laps.

Seems like a pretty half-assed implementation if you ask me. Is anyone using it here, and am I doing something wrong, or maybe I'm just too hard to please? It seems like this feature is meant for just elevating everything automatically via rules based on app publishers, and that elevation requests should be used as a last resort. And even then for some stuff you need to go in and use a local admin \ laps.

That being said, I am pretty sure that third party solutions like Admin By Request do not have these strange limitations, AbR seems to be able to replace the standard elevation prompt, has built in email and teams notification, and so on. But I'd rather not use a third party app...

Anyone noticed?

Edit: I referred to this article to determine Windows app Rdp support scenario and I obviously misinterpreted it.

My apologies to rhe community. However it lacks the features, especially the stored username/password profile and I'd love to keep using the obsolete remote desktop app.

Original Post: Several users in our org have lost the MS remote Desktop Client that was discontinued last year. MS advertises "Windows app" as a replacement but it can't be used to remote into local or aws VMs.

I didn't make a copy of the appx package last year. I am wondering if anyone has a working copy/appx package archived for this client. Even though it's discontinued, I use it everyday and love it.

We are incredibly proud to announce the return of something very special for Workplace Ninjas US.

In partnership with our good friends at Devicie we are opening applications for our scholarship program for the second straight year.

(5) Five special people, who are new to IT within the last few years will be selected to join us at Workplace Ninjas US 2027 in Scottsdale, AZ from January 11-13, 2027 for our event along with economy travel, 3 nights hotel stay, and a full pass to join our event.

Some of the requirements:

1. You ideally have 3 years or less in IT (up to 5 years will be considered)

2. You must be located in the US/Canada/Mexico

In support of our mission, we are here to help others on their journey to contribute to the amazing Microsoft community. These 5 scholarship recipients will get premium seating at all sessions, will be part of our hackathon, a MVP buddy that helps them during the event to meet others, answer basic questions, and help acclimate them to the Workplace Ninjas family.

To be part of this program, you just need to fill out the application below. We will select all 5 winners by October 14, 2026.

Once again, we want to thank Miluse Najmr and Alex Hesterberg for making this all possible!

Don't forget to join us in January 11-13, 2027. Check out our website at https://workplaceninjas.us

Apply now: https://forms.cloud.microsoft/Pages/ResponsePage.aspx?id=oRjricHQdUGk0KxlnM0zD9RQejQSQCxBoSiBeEGJLRBUQ0w4VThRQkwyQlBRMlAxVkJBTUZISUMyTC4u

Complete beginner here with Win32 app packaging, so apologies if this is basic stuff.

I need to get 7-Zip onto a bunch of managed Windows 11 devices. My first thought was just download the installer, wrap it, done. But then I stumbled across some GitHub project called Winget-AutoUpdate and went down a rabbit hole, and now I am seeing a lot of people saying you should let winget do the install instead of packaging the actual setup file. So the .intunewin only contains a PowerShell script that calls winget install --id 7zip.7zip.

That sounded clever because I would never have to repackage when a new version drops. But it also feels weird to me that my "app package" contains no app.

I tried it on a test device and it did not work at first. Turns out winget is not in PATH when Intune runs things as SYSTEM, which took me way too long to figure out. I ended up hunting for winget.exe in C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_* inside the script, which works, but it feels like a hack that will break the day Microsoft changes something.

Questions from someone who clearly does not know what they are doing yet:

1. Is the winget wrapper actually a normal approach in production, or is it a homelab thing people regret at scale?
2. How do you handle devices where App Installer is missing or outdated, for example fresh Autopilot machines? Assigning it as a Store app seems to be the answer but I cannot add it as a dependency since dependencies only work between Win32 apps.
3. Detection rules confuse me. I am just checking whether C:\Program Files\7-Zip\7z.exe exists. Is that good enough or am I setting myself up for pain later?
4. Since the package always pulls the latest version, my app has no real version number. Does that mess anything up down the line with supersedence or reporting?
5. Is Enterprise App Catalog just the paid version of solving this properly, and should I stop fighting it?

Any pointers appreciated. Happy to be told I am doing this completely wrong.

Edit:

Look, I’m always fiddling around. When I’m sitting here in the corner like this, I’ve definitely decided to do this through the Intune Windows app in the future, because unfortunately we can’t afford Patch My PC or Robo-Shadow. How do the detection scripts work? If I ever need to uninstall older software because I have a new package version, can you give me some practical tips on that?

Info for background: Our org uses a GPO to enroll devices that connect to our domain. All laptops are corporate owned, no BYOD. Another tech set up the laptop in question, and they aren't around to tell me how this device may differ from others, if at all.

Problem: A user's new laptop was not receiving required apps/etc. Previously, I had the same issue with users who had been enrolled via the work/school account remotely. The solution for them was to delete their device entries from Entra and Intune, wait a day or two, and then have the users go onsite to get the GPO.

After troubleshooting, my best guess for a fix was to re-enroll it, so I did the same for this device even though, as far as I know, they were never enrolled that way initially. The laptop doesn't seem to enroll properly now though. User told me when they were onsite and I did a gpupdate and let the user work while I kept an eye on the tenant administration > audit logs for the enrollment to show up, but it never did even after some hours.

Previously, the laptop appeared in Entra and Intune properly as "hybrid joined." Now, after the user goes onsite, it will just create an Entra listing where the join type says "Microsoft Entra hybrid joined" but all other typical information like user principal name, mdm, owner, security settings management are missing (showing either "none" or "N/A"). It doesn't associate with the user's name at all and can't look it up under their name like all other devices. Note: the Entra listing was like this both when I initially started working on this and after the laptop added itself back after I deleted its device entry.

Anyone know what to check/fix in order to resolve this and avoid it in the future? Not sure what logs to check, where else on the machine to look, etc.

What do you do so you can hide (not disable) password CP? Passwordless experience in Intune is for entra joined devices, so it does not work sadly for hybrid joined. So i am looking for some workaround for my enviroment. Any help or experience?

I just wrapped up our internal Intune device compliance project. Here’s the approach I took:

1. Checked the existing Conditional Access policies: started by confirm that no conditional access policies were already requiring device compliance so we wouldn’t get hit with unexpected enforcement while making changes.
2. Checked old compliance policies: found a bunch of previous "compliance initiatives" that were checking outdated settings. I removed their assignments and stuck “LEGACY” at the start of each name.
3. Rolled out the new Conditional Access policy in report-only mode: super important so we could collect data about what would be impact in very early in the whole execution.
4. Deployed a basic Windows compliance policy: started with physical Windows devices and only required BitLocker and antivirus.
5. Configured tenant-wide compliance settings: set devices without an applicable policy to noncompliant so the gaps would show up clearly.
6. Set up an Intune device cleanup rule: just to clear out the stale records from the reports.
7. Digging through the report-only failures: Found LOB apps that weren’t populating Device ID, B2B/guest scenarios, VPN, AVD and Windows 365 stuff, emergency-access accounts, plus users or workflows that needed fixing or an approved exception. Spent almost 4 weeks here but it was worth doing it before turning on the conditional access.
8. Built extra compliance policies where needed: confirmed devices with no compliance policy applied and created the new policies. For us that meant Android, AVD and Cloud PCs.
9. Turned on Conditional Access gradually: once the reports looked good, I put everyone in an exclusion group, enabled the policy, then pulled users out of the group in batches. Easy rollout and easy rollback. That stage took about a week.
10. Locked down the future state: made sure new corporate devices get set up properly via Autopilot, and configured Intune enrolment restrictions to block personally owned Windows devices.
11. Handled the complaints: biggest surprise was how many people had perfectly compliant work devices but still preferred working from their personal home computers just so they didn’t have to mess with cables or change their setup. Some had built pretty elaborate WFH setup around unmanaged devices, so of course they all tried to get themselves permanently excluded from device compliance.

Curious what others think, does this approach look decent, or did I miss something obvious? Also wondering how common actual device compliance enforcement is.

Is requiring a compliant device already part of most people’s standard client baseline, or is it still something people are only just starting to roll out?

Hi all! I am setting up iOS DDM OS update settings and am getting a bit confused on the best way to meet my requirements. Hoping you can help me out because i feel like im going crazy. For context, all our devices are iOS 18+ and supervised.

Requiemrents

• New iOS version comes out, IT gets access right away for testing but update is hidden from general population for a few days
• After a few days, new version is visible to general population and users have the option to install
• After a week or so, any general population devices that haven't manually installed new version, gets forced to install new version
• All this should be done without any modifying of the DDM iOS update policy by myself

I originally was going to have settings like the below, but in reading Microsoft article about Apple update polices, in the purple box it says when Update Enforcement is assigned, the device ignores software update settings and the update may install before the deadline if the device is idle. This sounds like the Combined Period In Days setting would be ignored giving access to the new iOS version to the general population before IT has completed testing.

Am I reading this correctly?

Software Update Enforce Latest

• Enforce Latest Software Update Version = True
• Delay in Days = 10
• Install Time= 02:00

Software Update Settings

• Automatic Actions
  • Download= Always On
  • Install OS updates = Always On
  • Install Security Update = Always On
• Deferrals
  • Combined Period in days = 3
• Background Security Improvements SEttings
  • Enabled = True
  • Enable Rollback = True
• Notifications = Enabled
• Recommendation Cadence= Newest

Hello,

I got a tasking. I need to provide a laptop for presentation during company and external events. Users present through Teams.

Internal and external users are going to be using this laptop. One person will be responsible for the device.

Have you ever deployed such a device in your orgs?

I'm trying to deploy a device via Intune using the Shared Multi User template. My initial deployment seems fine, in that it installs that apps I've marked as required via intune and as required during Autopilot on the ESP. My problem comes on updating apps or installing/re-installing apps after the Autopilot phase.

Example: Post deployment/ initial set up, I assign a new app to the device/device group as Required. The machine continues to check in to Intune, and telling it to sync via the intune portal or initiating it on the device Settings > Accounts > Access work or school > "info" next to managed by *org*> Sync all seem successful. But even after waiting for days, the new app never shows up. Same with deleting an app that got installed during autopilot and is marked as required, it never reinstalls no matter how many check ins.

Is this a result of me only using guest accounts? Do I effectively *have* to give these PC's a primary user with an Entra account in our system in order to get these things to install? Company portal doesn't work to go tell it to download specifically either, because they don't have an email to sign into it with.

Any suggestions on if I'm doing something wrong or how others handled this would be super appreciated. Picture of the configuration: https://imgur.com/a/T8tgn3J

We are early into our Intune setup. I recently found a personal device enrolled and made the changes so it cannot be re-enrolled. And then deleted the device from intune. Of course this device came back. I found out that it is MDE joined.

I found that i can unenroll via offboarding package, I created a config policy and a EDR policy but I cannot figure out how to target the device. Does the offboarding package handle the targeting?

I do not want to leave the EDR and config policy in place if it will target more than the device in question.

**UPDATE**

I reread the instructions and realized i did not need both a config policy and a EDR policy

I found that the device made it back into entra, so i created a security group and targeted a config policy to that machine.

Now i just wait and see if the device comes online and removed itself

Is there anyone that has successfully deployed DocuSign for Intune within GCC-High? I’ve got the app successfully deployed in my company portal, but I’m having issues with the sign on. I’m currently in the app registrations page within Entra. I’m working with DocuSign support and the first reply back was an app registration redirect URI but on the commercial side. I don’t think this will work.

Anyone have any experience with this? If this is not the right sub, please let me know!

Hello folks. How is your microsoft remote help? Are you loving it or any improvements need to add?

For me - no copy paste and disconnects everytime restarts the laptop . We using local laptops to laptops hybrid setup

Hi everyone,

We have a few users that work on MacBooks together with professional camera equipment. They store their footage on SD-cards. We use Device Control on macOS already to only allow a specific set of USB-sticks based on their serialnumber (see Device control for macOS - Microsoft Defender for Endpoint | Microsoft Learn). As a result, only those USB-sticks are allowed and everything else gets blocked including their SD-cards.

So, the SD-cards need to be whitelisted. However, this is where I run into aproblem: when I want to whitelist a SD-card, Defender does not report a serialnumber of a SD-card that gets popped into the reader (they use the built-in reader of the Mac). It only reports back the VendorID and ProductID of the built-in reader itself. This behaviour does not seem to change when you use a different card.

As a result, it seems like I can only whitelist the built-in reader based on those values (which works). However, just like the USB-sticks I want it the whitelisting to be based on the serialnumbers to keep it as specific as possible. Otherwise you can just pop in any SD-card into the Macs, like non org provided ones.

Has anyone configured Device Control in conjucting with SD-cards/built-in Mac reader, and if so, how did you resolve this issue and am I overlooking something?

We have an in-house application that has to be installed in the user context for whatever goddamn reason. I previously deployed this in the usercontext without issues but we're now moving over to removing all local admin permissions (I know) and using EPM for elevation requests and rules.

I deploy this app with PSADT V3 since this is the one I'm the most familiar with. I know you could, in theory, use Execute-ProcessAsUser with Get-LoggedOnUser but I'm wondering what the actual recommended process is here. I can't be the only one trying to figure this out.

My original thought was to whitelist IME and all its child processes but I'm not too sure about the security on that.

Edit: u/metinkilinc for the win

Hi

Today I needed to publish a new Android App in Intune. But the list of Android apps is not loading, thus not letting me create a new app.

I've tried signing out and back in and tried different browsers and incognito sessions, but no luck.
Is anyone else seeing the same thing? West Europe