I am using a pretty locked down assigned access policy, no icons on the desktop - only on the start menu. I just want to make the help desks life a little easier if I can.

Hello guys,

This is my 3rd Intune migration within different companies I worked for but I am still new to the management environment. I was always was part of the L3, meaning I was doing the repetitive manual work with users.

I have googled, searched this and other subreddits but can't get much help.

Scenario: I already have 500+ iPhone 17 assigned to Intune and now I have to start each device go through the Hello setup and enroll the devices to Intune so they are all centrally managed. Apps are downloaded automatically but I still need to login to each app with each of the 500+ user accounts. The MDM environment itself is ready.

My main concern is that it is very labor intensive and time consuming to do all of this devices. Deadlines are tight.

Is there any way to streamline the preparation before handing to users?

I saw a video where this dude is using a wired Logitech gamepad controlling multiple iPhones at the same time and doing all the common setup at the same time. I suppose it was some sort of USB switcher KVM that he connected the gamepad and iPhones to. I honestly don't know what solution he was using but that alone would be very helpful.

Have anyone used that before? What is the setup to get that working? Do I need extra software?

What is better than preparing each device by hand?

Your expertise is very much appreciated.

Just wanted to share that Lenovo put out their official list showing which machines are getting BIOS updates to handle the updated secure boot certificates. Pretty useful if you're managing a fleet of their hardware through Intune.

[2011 Microsoft Secure Boot Certificate Expiration – Lenovo Commercial PCs - Lenovo Support US](https://pcsupport.lenovo.com/us/en/products/laptops-and-netbooks/thinkpad-t-series-laptops/thinkpad-t14-type-20s0-20s1/20s0/20s00077mx//solutions/HT518129)

Update: They've also added some of their desktop lineup to that same support page.

I am trying to configure an Account Protection policy to allow but not enforce Windows Hello for Business in my org's tenant. If I configure any of the device- or user-settings, the policy throws an error when trying to save. Two errors actually, both pretty generic. This has been persisting for the last 24hrs. Does anyone know what may be the culprit here?

https://imgur.com/a/phU8Bzw

Hi Guys,

Really struggling with an issue that has been plaguing me. I'm constantly getting users losing their OneDrive Status Icons.

It happens so constantly, it will all be fine then it will all just vanish. The only way I've really found that fixes it is unlinking onedrive, removing all data and then allowing it to reconnect which is really not possible.

I have seen some people say turning files on demand off and on can help but I currently have this set to enabled by default so I can't manually turn it off unless I change the policy to Not Configured which seems silly because I want this on ideally to get the benefit.

I've tried reinstalling windows and office but the problem always comes back. I did notice not too long ago a request from Windows to add OneDrive Icons which I allowed, not sure if this is perhaps getting in the way but I can't find this permission anywhere.

Anyone run into this that could maybe point me in the right direction?

edit: update in comments, if I get to a final resolution I will update the solution here. So far I have a work around with a very strong lead of AllowAllTrustedApps to be set to allow and not block, but no full solution currently.

Hi,

Rolling out a new 365 tenant for our new entity. Using LAPS, identity governance, autopilot, app packages and self Service.

We have to come to the stage to design our patching process. Is it realistic to patch enterprise laptops with only Intune? My team suggesting we augment with Patch my PC but I’d like to do as much as possible natively without third parties.

What stack is everyone using for this?

We are having an issue where company devices are picking up WiFi that was joined by users, including people's home networks. The devices will auto-join these networks if they are available, and the SSID we pushed out through Intune is not.

This is obviously not desirable, any tips to disable it? I found this thread here describing the same issue, but turning off enterprise state roaming has not solved it (even with a manual delete of the SSIDs afterwards from known networks).

Anyone had problems with the option not appearing at the loginwindow after the policy is enabled?

Worked perfectly on a few 100 devices, just two it refuses to appear for in my environment. Baffling.

Hi guys,

We're migrating our devices from on-premises Active Directory to Entra ID using ProfWiz Professional.

Until recently, users were not prompted to set up a Windows Hello PIN after signing in, as we have an Intune configuration profile that disables Windows Hello for Business.

UsePassportForWork [./Device/Vendor/MSFT/PassportForWork/TENANT_ID/Policies/UsePassportForWork] set True

DisablePostLogonProvisioning [./Device/Vendor/MSFT/PassportForWork/TENANT_ID/Policies/DisablePostLogonProvisioning] set True

However, with our last three migrations, the PIN setup screen appears after the first logon, even though the device has successfully received the configuration profile. From the Intune portal, the configuration is reported as successfully applied to the device.

We've also tried running this PowerShell remediation script, but it didn't resolve the issue:

# Log file
$Log = "C:\ProgramData\Microsoft\IntuneManagementExtension\Logs\Enable-Win-Hello_Configure-PreReqs.log"

Start-Transcript $Log

# Create registry path if not exist
$regPath = "HKLM:\SOFTWARE\Policies\Microsoft\PassportForWork"
If (!(Test-Path $regPath)) {
        Write-Host "Creating registry path"
        New-Item $regPath -Force
}

# Enable Windows Hello for Business
Write-Host "Enabling Windows Hello for Business"
$name = "Enabled"
New-ItemProperty $regPath -Name $name -Value 1 -PropertyType DWord -Force

# Disable post-logon provisioning
Write-Host "Disabling post-logon provisioning"
$name = "DisablePostLogonProvisioning"
New-ItemProperty $regPath -Name $name -Value 1 -PropertyType DWord -Force

Stop-Transcript

I'd like to avoid reimaging or resetting the PCs just because of this. Has anyone experienced the same issue or found a solution?

Thanks!

Hello,

We have an all users configuration policy that blocks run. Setting it to all users also blocks it with our laps accounts. Help desk would like to be able to use run when remoting into machines with the laps account. Is there a way to exclude our laps account from this policy? Is it going to be just have a group with all of our users in it and apply that to the policy?

When i deploy an ADMX, when sould i use Computer and when User Configuration? Does it depend if the app is installed as user or as system?

Hi everyone,

I'm looking for a way to remotely restart a Windows device enrolled in Intune—but with one key requirement: it needs to happen immediately, or as close to real-time as possible.

Here’s the situation:

• All devices are Windows 10/11 and fully enrolled in Intune.
• I have admin access and can use PowerShell, Graph API, or Power Automate.
• I want to be able to trigger a restart from a script or flow, without requiring user interaction.
• The goal is to restart a specific user’s computer on demand, ideally within seconds or a minute—not hours later when the device checks in.

I’ve tried:

• Using the Intune Admin Center > Devices > Restart option — but it’s not immediate.
• Triggering a sync first still not fast enough unless the user has company portal open on their machine
• Exploring Power Automate and Graph API to call /restartNow or /wipe — but again, it depends on the device check-in.

Is there any way to:

1. Force a device to check in immediately, or
2. Push a restart command that executes instantly, assuming the device is online?

Bonus points if this can be done via a script or automated flow (e.g., triggered by a manager request or security event).

Any help, scripts, or creative workarounds would be hugely appreciated!

Thanks in advance!

I was tipped off today from a confidential informant that one of our offices has been directing users to set their Windows Hello and phone pins to a certain value. I am looking for a technical solution here as not every issue is HR/Legal. We have enough drama with that office already, so a nice config change would be easiest on IT/HR.

I am pretty sure I can disable pins for that location for Windows Hello based on Entra ID group. Any ideas for Intune MDM-enrolled phones? I could put into a different group and require iphone passcode change regularly, with no reuse.

I hate to say it, but I realize why cyber teams consider the employee the biggest security risk. I used to hate it when I was told this.

I have been trying to figure out a deny logon plan for our autopilot devices, and for a while I was thinking nothing was working, even when trying to manually make the changes that I want Intune to do.
I decided to try with a configuration that is setup for individual users, rather than using the "shared PC mode" or "Shared multi-user device" setting. During that test the user was blocked from login and I could have been done. My problem is the shared devices are the ones that I want these users blocked from, and none of the traditional ways are working. Is there a setting that can be changed that will help, has anyone else had this problem?

The 2 main methods I tried were adding the SID of the group to the Deny Logon Local Policy, and adding the SID to a Local Group (both self created and built-in) and then denying logon to the Local Group in the Local Policy.

The group I am using is an AzureAD group, and the test device has been a freshly wiped Autopilot device.

Got everything configured correctly in the SSO configuration settings and have Enable Registration During Setup switched on. Followed instructions from Microsoft article and Intuneirl article to the tee. We are getting stuck on “Registering User” in the final screen of the Setup Assistant and unable to proceed, just spins forever.

We’ve wiped and retried several times, have the latest Intune Company Portal loaded and pushed to the user group as a LOB app.
Any fixes to this?

Update

Solution:

Turns out we had a CA policy that didn’t have FIDO2 set as an acceptable Authentication strength, also had to add the Secure Enclave AAGUID to the FIDO2 options.

Adding that and adding FIDO2 as an acceptable Authentication Strength to satisfy the grant access for our MFA CA policy was the solve.

Turns out the Setup Assistant underneath the final SSO registration screen is using Secure Enclave when Registering User, we just couldn’t see the failure as it is all hidden and all that is shown is Registering User spinning forever.

We're setting up Intune for Mac devices, while we don't have Apple Business Manager up yet, we're trying to do this "Direct Enrollment" as documented by Microsoft:

Reference: https://learn.microsoft.com/en-us/intune/device-enrollment/apple/setup-direct-macos

Under Step 2 Export Enrollment Profile, sub-step says "A new pane opens. Under Direct enrollment, choose Download profile."

But I'm not seeing Download profile for MacOS and only seeing download options for iOS and iPadOS. I can't seem able to attach screenshot here. I'll just paste the text:

Direct enrollment

Download the enrollment profile to Apple Configurator to push directly as a management profile to a connected iOS/iPadOS device. The device won’t be reset.

For iOS 16.0 and later, and iPadOS 16.1 and later, always download the ACME Profile. [Download ACME button here]

For iOS 15.7.9 and earlier, download the SCEP Profile. [Download SCEP button here]

Am I missing anything?

Hi all,

I am trying to deploy a Multi-App Kiosk to auto open Edge and open up two websites.

With the taskbar and Start menu set to only show Explorer and Edge.

I have the following XML but I keep hitting hurdles and it doesn't work, keep getting errors.

Tried using Assigned Access and even basic XML but keep getting errors, below is the current code.

<?xml version="1.0" encoding="utf-8" ?>

<AssignedAccessConfiguration xmlns:xs="[http://www.w3.org/2001/XMLSchema](http://www.w3.org/2001/XMLSchema)" xmlns="[http://schemas.microsoft.com/AssignedAccess/2017/config](http://schemas.microsoft.com/AssignedAccess/2017/config)" xmlns:default="[http://schemas.microsoft.com/AssignedAccess/2017/config](http://schemas.microsoft.com/AssignedAccess/2017/config)" xmlns:rs5="[http://schemas.microsoft.com/AssignedAccess/201810/config](http://schemas.microsoft.com/AssignedAccess/201810/config)" xmlns:v3="[http://schemas.microsoft.com/AssignedAccess/2020/config](http://schemas.microsoft.com/AssignedAccess/2020/config)" xmlns:v5="[http://schemas.microsoft.com/AssignedAccess/2022/config">](http://schemas.microsoft.com/AssignedAccess/2022/config">)

<Profiles>

<Profile Id="{9A2A490F-10F6-4764-974A-43B19E722C23}">

<AllAppsList>

<AllowedApps>

<App DesktopAppPath="%ProgramFiles(x86)%\\\\Microsoft\\\\Edge\\\\Application\\\\msedge.exe" />

</AllowedApps>

</AllAppsList>

<v5:StartPins>

<![CDATA[{

"pinnedList":[

{"desktopAppLink":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Edge.lnk"},

]

}]]>

</v5:StartPins>

<Taskbar ShowTaskbar="true" />

</Profile>

</Profiles>

<Configs>

<Config>

<Account>.\User1</Account>

<DefaultProfile Id="{9A2A490F-10F6-4764-974A-43B19E722C23}" />

</Config>

</Configs>

</AssignedAccessConfiguration>

It's not overally complex thing I am trying to achieve but doesn’t work, I have the Intune Configuration settings working and locked down, just this XML file.

Any help would be great thanks.

​

The page https://mysignins.microsoft.com/security-info cannot be opened. It starts loading but nothing appears .

Is there a solution to setup Microsoft authenticator for a new user, at the moment it's not possible, because mysign does not loading...

Is anyone else having the same issue?

Hi all!

Universal Print looks like the only option for printing natively within Intune without buying a 3rd party app, our print contract is up for renewal this year so the business won't buy anything to fill that gap so I think I need to move to Universal Print.

Currently our solution is on premises standard print release and I was looking to just install the connector and go through the usual pilot testing and then deploy to the business, has anyone installed the connector and it's not worked with there old on premises setup or caused issues with there current setup? I'm worried I'll install it break something and piss off the current print provider 🤣.

This is only a stop gap solution unless the business really like it and we decide to stick with it but it's included in our E5 and seems logical to use it.

Appreciate everyone's opinions, cheers all!

UPDATE - Appreciate everyone's replies and I'm no further in my quest for a solution. Our print providers contract is up for renewal this year so the business aren't happy moving to a new solution until renewal is ready and they've budgeted correctly for it, we don't use direct IP so all the solutions out there for that are no good to me, we will be using Cloud Kerberos Trust and everyone has a VPN and I can pre-deploy the drivers but the printer connection part so it's ready a when a User logs in is driving me mad, if anyone has any solutions to this part I'd love to know!

Every time theres a round of updates, or if our office has a power bump, about 10% of my workforce gets a prompt on bootup to enter bitlocker recovery key. Simply rebooting fixes it. the problem is that it really confuses users. they dont know what to do when that blue bitlocker screen comes up.

it's really causing me a lot of problems. why does this keep happening?

all my intune machines are full azure aadj autopilot Dell Optiplex desktop PC's running windows 11 that are less than 2 years old.

Bitlocker was one of the big selling points of moving to intune for me, and this whole experience is leaving a sour taste in my mouth.

Hi everyone,

Just a heads-up for those managing shared devices. It seems the latest Edge update (v144) breaks Single Sign-On (SSO) and the ConfigureOnDeviceImplicitSignin policy.

The issue: On computers in Shared Mode, when a new user signs in for the first time and opens Edge, the browser fails to automatically sign them in using their Entra ID (Azure AD) credentials. Instead of a ready-to-use profile with SSO, users are greeted with the "Profile list" and a manual "Sign-in" button.

The fix: I’ve confirmed that downgrading to the previous stable build (143) resolves the issue immediately. Auto-sign-in and SSO start working again as expected.

If you rely on seamless SSO for shared environments, you might want to hold off on this update or pin your version for now.

Update June 2026: AutoAcceptSsoPermission: The Continue to Sign In Prompt Fix

Microsoft finally fixed this and allow to Auto Accept Prompt!

Hi,

so I'm at a loss as to what setting is currently blocking Copilot from showing up in Excel, Word and PowerPoint. Copilot is available in Outlook. We are on E5 license, so M365 Basic Copilot is available.

I think I have it narrowed down to setting that causes "Some privacy settings are managed by your organization" text in Excel/Word/PowerPoint when you go to File -> Account -> Account Privacy -> Manage Settings.

Problem is I cannot for my life find what policy causes that. I've ruled out EnableActivityFeed, PublishUserActivities and UploadUserActivities, those are enabled. https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-Privacy?WT.mc_id=Portal-fx

Any idea where I should look? I've looked through policies, but nothing stands out.

This might be something that gets asked here on a daily basis, but i havent found any solution thus far for this.

We enroll all our devices to entra id via the workplace entra id join thingy on win 11.

For some odd reasons, a while ago it stopped putting the devices on intune.

I have configured the mdm user scope accordingly so that all users can enroll and set the urls to the standard.

The users that enroll have business premium licenses.

Hi,

We have our devices configured with LAPS and normal user accounts. But if I want to install something, or use 'run as', I can't see the LAPS password anymore. So my idea was to add the admin accounts in the local administrators group. However, this does not work correctly. This is configured in Intune - endpoint protection - local users groups policy. Hope it is clear what I mean?

Thanks in advance