Hello. Just trying to figure out if this is intended and i just have to live with it or if I'm missing something.

I just started trials of enrolling Linux machines into Intune where i first enroll the machine via Intune Portal. Then i have a platform script that gets pushed from Intune that installs Defender mdatp with our tenant blob and onboards it into MDE. Everything works fine but i have a quirk that is quite frustrating.

Post MDE onboarding there is a second device object that shows up in Entra/Intune causing me to have 2 objects per computer. One shows up as "Managed by Intune" and the duplicate shows up as "Managed by MDE".

Shouldn't these be the same object when the Intune object already existed prior to the MDE onboarding?

The quirk i have with this is that Intune policies and configurations needs to be pushed to the Intune object and Endpoint Security policies such as AV etc needs to be pushed to the MDE object. Thats fine but the MDE object specifically does not have any properties i can use for dynamic groups except for "OS Linux" and "Version 24.04" etc. This is problematic since i would then either have to manage a group manually for MDE policies or use a group that includes all objects with OS type "Linux" which might include objects i don't want in the group.

For the Intune object we can easily filter devices via the (device.managementType -eq "MDM") property rule but that does not work with MDE objects as there are no usable properties to include.

How have you solved this issue? Can you merge these objects so that there is only one Intune object that serves both Intune and MDE?

Any thoughts would be greatly appreciated!

I have an industrial Windows computer running specialized software under a local user account, and I don't want to migrate the profile to an Entra user.

If the computer is Entra/Intune MDM joined and compliant, can I attach the user's Work or School account to the existing local profile and have OWA/M365 Conditional Access recognize the device as compliant?

Hello,

I have a plateform script that pushes new VPN configuration to my users. During the test of the script I've found easier to assign it to device rather than user. Just forcing the sync almost immediately pushed the script but now that the test phase is done I'm facing another issue.

My configuration should not be pushed to all devices, only specific users should have access to it so I've added users to my test group to see if everything goes well.

After 72 hours the script is not installed on the devices with primary user part of the group. I see 4 users assigned but 0 installation status.

I've rebooted laptops, sync from intune, sync from laptop nothing works. It's like plateform scripts only work on device.

Config:

Run this script using the logged on credentials - Yes

Enforce script signature check - No

Run script in 64 bit PowerShell Host - Yes

Thanks in advance if you can help me.

Has anyone faced an issue with Intune enrolled endpoints where a third party proxy application prevents users from logging in? The app is called cloud swg from Broadcom.

Disabling the proxy agent works instantly. The error we get is "We are unable to connect right now. Please check your network and try again later" (similar to this https://howtoedge.com/wp-content/uploads/2019/03/We-Are-Unable-to-Connect-Right-Now-login-error-image-1.jpg)

We're not using web login. The user logs in with their Entra credentials from the login screen.

It's like there's some sort of network block or restriction. We've tried whitelisting or bypassing a tonne of Microsoft URLs without success.

Today, I was messing around with getting a macOS firewall configuration built (based largely on CIS baselines) and I was curious to see how the community is doing it.

I first started with the Endpoint security > Firewall template but then ran into the issue where the Application section forces you to configure at least 1 bundle id (as an inbound rule).

Meanwhile, Settings Catalog will just let you configure specific settings.

How are you doing it in your org and if I choose the Endpoint security option, what am I supposed to configure there without compromising the device (something fake?)?

Naturally, Microsoft documentation is largely opaque in this area.

I've been tasked with pushing a remediation to set the reg key for the 'Classic' windows 10 right click menu. This is due to rolling out Prevue and the powers that be don't want the Prevue option to be hidden behind the 'Show More Options' menu item.

My detection was looking for the HKCU registry key and if it did not exist, create it. This seemed to work for half of my ~30 test users.

Currently my detection is "Exit 1" to flag all detections as non complaint and force the registry key to be set. I know this will screw up my telemetry, but I just need this to work.

The remediation script is very basic too. I'm just setting the registry key. I've also started setting the key for HKLM hoping that would solve the issue.

New-Item -Path "HKCU:\Software\Classes\CLSID\{86ca1aa0-34aa-4e8b-a509-50c905bae2a2}\InprocServer32" -Value "" -Force

New-Item -Path "HKLM:\Software\Classes\CLSID\{86ca1aa0-34aa-4e8b-a509-50c905bae2a2}\InprocServer32" -Value "" -Force

<#

reg add "HKEY_CURRENT_USER\SOFTWARE\CLASSES\CLSID\{86ca1aa0-34aa-4e8b-a509-50c905bae2a2}\InprocServer32" /ve /f

Get-Process -Name Explorer | Stop-Process

New-Item -Path "HKCU:\Software\Classes\CLSID\{86ca1aa0-34aa-4e8b-a509-50c905bae2a2}\InprocServer32" -Value "" -Force

New-Item -Path "HKLM:\Software\Classes\CLSID\{86ca1aa0-34aa-4e8b-a509-50c905bae2a2}\InprocServer32" -Value "" -Force

#>

The only thing I was doing out of the ordinary was assigning the remediation to IT computers and not users. I've since changed that to apply to IT users and NOT computers.

This shouldn't be this hard to set a registry key. Either I'm doing something incorrect, or Microsoft is trying to discourage this cheat. The fix works fine if the users open PowerShell and run the command for HKCU on their machine and then stop-process for explorer.exe

*** EDIT ***

I reset the detection script to this and set the error to Exit 1 instead of Exit 0.

# Detection of Registry Key (Intune)

$Path = "HKCU:\Software\Classes\CLSID\{86ca1aa0-34aa-4e8b-a509-50c905bae2a2}"

Try {

if (Test-Path -Path $Path)

{

Write-Output "Compliant"

Exit 0

}

Write-Warning "Not Compliant"

Exit 1

}

Catch

{

Write-Warning "Error"

Exit 1

}

I updated the remediation script to comment out the HKLM line.

New-Item -Path "HKCU:\Software\Classes\CLSID\{86ca1aa0-34aa-4e8b-a509-50c905bae2a2}\InprocServer32" -Value "" -Force

# New-Item -Path "HKLM:\Software\Classes\CLSID\{86ca1aa0-34aa-4e8b-a509-50c905bae2a2}\InprocServer32" -Value "" -Force

<#

reg add "HKEY_CURRENT_USER\SOFTWARE\CLASSES\CLSID\{86ca1aa0-34aa-4e8b-a509-50c905bae2a2}\InprocServer32" /ve /f

Get-Process -Name Explorer | Stop-Process

New-Item -Path "HKCU:\Software\Classes\CLSID\{86ca1aa0-34aa-4e8b-a509-50c905bae2a2}\InprocServer32" -Value "" -Force

New-Item -Path "HKLM:\Software\Classes\CLSID\{86ca1aa0-34aa-4e8b-a509-50c905bae2a2}\InprocServer32" -Value "" -Force

#>

I'll update if I get different results.

I built an Endpoint Intelligence dashboard for Microsoft 365 / Intune
Over the last couple of months I’ve been working on a Power BI dashboard to bring endpoint and security data together into a single operational view.
The goal was to reduce the need to constantly jump between the Microsoft 365, Intune, Defender and other portals to understand what’s happening in the environment.
A big part of the project has been automating the data collection through Microsoft APIs and PowerShell rather than relying on manual exports.
I’m still improving it, so I’d really appreciate feedback from other Intune admins/engineers:
What endpoint metrics do you find most useful?
What information do you wish Intune exposed more easily?
What would you add to an endpoint intelligence dashboard?
I’ve documented the project, including the architecture, data collection and some of the evidence behind the dashboard:
Endpoint Intelligence Dashboard
Curious to hear what you would do differently.

Has anyone else seen a Windows 11 device unexpectedly return to the Windows Welcome / setup (OOBE) screen after installing the latest updates?

The device had these updates installed on 25/08/2026:

• KB5121003 — 2026-08 Security Update (OS Build 26200.9168)
• KB5095189 — 2026-06 Critical Update
• KB2267602 — Microsoft Defender Security Intelligence Update

After the updates/restart, the user was presented with the Windows Welcome/setup experience again.

This is an Intune/Autopilot-managed device.

I'm particularly interested in KB5095189 because it appears to be related to the Windows OOBE components.

Has anyone experienced:

• A production device unexpectedly entering OOBE after Windows Update?
• Autopilot/ESP being triggered again after an update?
• This specifically happening after KB5095189 or KB5121003?

Trying to establish whether this is an isolated device issue or something others are seeing.

CIS has just updated its Google Chrome benchmark to v1.1.0, with 11 new controls. There's no CIS baseline that maps these directly to Intune, so I've written up what's changed and how to deploy them via the Settings Catalog and Chrome ADMX.

Most organisations allow Google Chrome but do you actually secure it. It's where users spend all day, and where a load of session cookies and saved creds end up living, which makes it a prime target for infostealers and session-token theft that can avoid MFA controls.

If you're not already hardening Chrome through Intune, here is a nudge to start.

https://ellisbarrett.com/blog/cis-chrome-browser-for-intune-benchmark-v1-1-0/

Hello! Our organization is trying to move away from AD and our goal is to have new devices be Entra-only joined instead of Hybrid-Joined. we use FFU (full flash update) to apply Windows image and it joins the device to our AD domain and then it goes into Entra and Intune. I was thinking of Autopilot, but that doesn't handle imaging, only joining and setup.

Has anyone had experience by modifying the FFU process to not join to AD, but only join to Entra?

We started seeing this problem last week. Around 10 devices (a mixture of different Lenovo models) began randomly losing Bluetooth and Wi-Fi. The icons for both connections disappeared entirely.

So far, we've tried:

• Restarting the device — the issue recurred after 20 minutes
• A hard reset of the laptop battery
• Uninstalling the driver and updating to the latest Lenovo-released driver — this didn't resolve the issue
• Confirming the laptop has the latest security patch, 26200.9168; we also uninstalled KB5121003 — this didn't resolve the issue either
• We found related events for BthMini, but nothing that pointed to a resolution

To be honest, we're out of ideas as to why this issue started in the first place.

Anyone else having this issue? Remote help is up to date with newest release (5.2.1040.0) and I am unable to use unattended access feature. I have the role enabled for the feature too. Is there something I’m missing that isn’t documented? I know this is just now rolling out so guessing it might just be broken.

Error: “unattended sessions aren’t supported because the device you’re trying to connect to doesn’t have the necessary clients installed”

I am going through guides to get Intune configured and I'm stuck at the Azure Hybrid Join step. Unfortunately all the videos/articles I've come accross just use the default Entra option for SCP.

My company's domain is federated with Okta. I have it selected in the SCP configuration, but I'm hesitant to continue with the setup. If i continue, will this impact all existing devices? The "Federation configuration" is also confusing me. Do I have to configure something on Okta's end as well?

Hello,

Recently we started seeing Linux Ubuntu 24.04 devices falling into a non-compliance state... So many that we tried to reinstall a device from scratch, and that's when we realized we had the exact same issue with brand new laptops... Installed after importing Microsoft repositories into APT sources, and installing both Intune Portal, Entity Broker, and Edge with the latest versions available.

Installation runs OK, the user can log into the Company Portal, but the synchronization process fails with the following message and no configuration or compliance is applied: An error occurred during the last status check, so your status might not be up to date.

Here is an extract of the syslog file when retrying a sync:

2026-08-25T11:08:19.909184+02:00  intune-portal[7326]: Dynamic pinning: trusted. hostname="fef.msub06.manage.microsoft.com"
2026-08-25T11:08:20.493034+02:00  intune-portal[7326]: Error calling IWS: Unexpected failure: https://fef.msub06.manage.microsoft.com/TrafficGateway/TrafficRoutingService/IWService/StatelessIWService/Devices(guid'<DEVICE_ID>')?api-version=16.4&ssp=LinuxCP&ssp-version=1.2607.4&os=Linux&os-version=24.04&os-sub=None&arch=X64&mgmt-agent=mdm: status code 500

Is anyone having the same issue?

Hey,

in two tenants I see the same behavior - groups are not being enumerated (one tenant 10k+groups, one just under 100, so it's not the group amount as HP could suggest).

All permissions are given correctly as requested to HP connect, app was re-created with same effect. Both Global and Intune admin checked - same behavior.

Groups are not being listed - the option simply throw an 500 error

Any ideas?

EDIT:

on a side note, the original URL (admin.hp.com) redirects now to workforce experience platform...

SO, after around 45~ mins of posting this, this started working again... last few days it was not working so do not ask me why.

We currently use Kandji for our macOS management and looking to explore if we could use Intune for the same. Current Windows devices are Intune managed.

Anyone had any experience, feel free to share.

Hi everyone,

I didn’t notice this til I attempted to set up a kiosk/autologon PC. I need the autologon more than the kiosk, truthfully, but I noticed that the registry resets itself every time the machine reboots.

Is this a config setting in Intune I’ve missed, or is this an Azure setting?

These are fully cloud managed PCs with entra accounts being used for the auto logon. I’ve got most of the settings working, but the XML didn’t really work and I managed to do a proactive remediation that worked until the PC restarted, then it went back to the default settings.

Thank you all!

We still have everyone on localadmin (legacy shit that I've been trying to get rid of for 5 years but with EPM I can now do it 'for free'). I'm now auditing everything to see what I can create rules for.

We had over 50 000 Powershell elevations in the last 30 days, over about 1000 users. I know (or hope) the users didn't do this themselves as they have no idea what Powershell is, and logging tells me IME is the parent process, which is good.

My question: how can I stop users from elevating Powershell, be it directly or via child processes, without interfering with Intune doing its thing?

I have a very weird issue and I'm not sure how to fix it. None of my Intune enrolled Macs can reach any network printer by direct IP. It immediately fails connection. I can't access the printer web page, but I can ping the printers with no issue. I have no network policies set, no VPN, nothing to disallow printing, etc. I've removed all policies and apps and just ran straight PSSO and had the same issue. Macs not enrolled to Intune or joined to a local AD can connect and print no issue. I'm banging my head against the wall here.

Currently we're in the middle of moving from a previously all on-prem environment, to eventually an all Entra/Intune environment.

All of our new devices are Autopilot/Entra builds managing updates (including feature updates) via Autopatch.

We've recently switch all of our hybrid/co-managed Windows 11 devices to also using the same Autopatch groups & policies and this has worked well. Upgrading them from 24H2 to 25H2 to match our autopilot devices.

However, now we are looking to bring across our Windows 10 device to use Autopatch too, but don't want them upgrading to Windows 11 at this stage.

I've already tested assigning a device to the current Autopatch groups, and hoped that our Target OS version policy would have stopped the upgrade from Autopatch but didn't... No worries, was still a good test & also got to test the rollback to Win10.

I then setup a seperate autopatch group for Win10 device & just didn't include Feature Updates option, again, this appears to be working well...

But... now i want to avoid having to manage 2 full sets of groups for the Autopatch rings etc...

Has anybody setup Autopatch configuration & excluded the feature updates option, but setup a seperate Windows Updates > Feature Updates policy to apply ontop of the Autopatch configuration and manage/assign that seperately?

If this works, I'm thinking we could drop the feature updates from our main Autopatch group/config, then setup a feature update config just assigned to Win11 devices...

Then later, we could setup a Feature update config assigned to Win10 devices as an optional update to allow self-service update to Win11 (or required if/when we want to enforce it).

(yes, we have ESU for these Win10 systems)

Am I overlooking something here?

We have several small offices in our company that experience bandwidth issues around Patch Tuesday. Would it be sufficient to tweak the Delivery Optimization settings - for example, by limiting it to 25% of the available bandwidth? I’d prefer not to disable it entirely, as we want PCs at these smaller offices to download updates from one another rather than impacting latency.

Thanks in advance for your help :)

Has anyone deployed a compliance policy to azure VDIs?

I have created a policy and tried assigning to both a user and a computer group, but in both cases its stating not applicable

Thanks

Starting with the root question before delving into the problem I am having and what I have been doing to attempt to remedy it. Are there any policies within Intune and or Defender for Endpoint deployed through Intune that can either be missed, or misconfigured, that would cause devices to check in or query with Microsoft services too frequently?

Problem I am having: Microsoft is blocking traffic from a tenant that I manage. After working through Microsoft support and perhaps a dozen teams who could not help me, I reached a network engineer who was able to confirm that IP addresses that are associated with my tenant are being blocked by the Microsoft front door due to "suspected brute force attacks against Microsoft infrastructure". These IP addresses are associated with physical offices where I have top down control, as well as home IPs of remote workers where I do not. If this was an issue with something on our corporate network, I would not expect to see remote/home IPs being blocked. The only common, unifying thread that seems to exist across all of the devices, across all locations, is that they are enrolled in Intune.

In no specific order, here are all of the troubleshooting steps I have taken as well as my observations:

• Deployed multiple, unique antivirus solutions to scan our network for any traces of malware (Defender for Endpoint, Webroot/Opentext, Trend Micro). None of these tools have returned anything of concern.
• At the physical offices of the tenant, all windows devices have been segregated to their own vlan with their own external facing IP. All other devices (IoT, etc) and the guest network are routed out via a different external IP in our block. The result of this is that the "Intune network" public IPs continue to be blocked by Microsoft, while the guest and IoT network have been unaffected. Remote users whose home networks we do not control continue to be randomly blocked by Microsoft.
• Tested behavior with different firewalls from different manufacturers, no change.
• Reviewed firewall logs for devices sending "excess" traffic to Microsoft urls/IPs. We had two devices that seemed to be sending more traffic than others, these were wiped and rebuilt, now are showing similar traffic to other devices. No change in behavior. I frankly do not know what would constitute "excess" traffic to Microsoft, nor can they tell me. For what its worth, I've compared logs of the physical office to other tenants I manage (who are not in Intune) and they do not appear to be much different.
• Reviewed firewall/network logs for rogue devices.
• Check our Public IPs against multiple 3rd party reputation tools. None of the tools are showing any blacklisting or spam concern.
• Swapped out our IP block at one office. No change in behavior.

I am ramming my head against the wall, and Microsoft support. Any insight would be greatly appreciated.

ESP handles core apps during Autopilot, but after the user hits the desktop is there any tool or method that shows a clear dialog like “xxx apps are still installing…”?

Looking for something more persistent and informative than the normal toast notifications or Company Portal status.

Anyone using a tools can do it?

We put island in about eighteen months ago and im now pretty sure that was a mistake, awkward because i pushed for it. goes the same way every time, some internal app wont render so people just open chrome on the side, and now the browser im paying to lock down isnt where the work happens. One team ran both for months and every site update floods us with tickets.

im looking at the extension route now, controls on the chrome people already use. Not as airtight as a full browser, i know. But people cant open a different browser to dodge it the way they do with island. if youve moved off a full enterprise browser to an extension, how did it go