Hello folks,

We are mostly a windows environment and are getting a iMac for a new hire. We do have intune and ABM setup for company iPhones. Just wondering what the process is like for enrolling an iMac? I did some reading on a few methods, which is only two, the company portal or through Apple Configurator.

Don’t think I want to go through the comp portal route since this is basically like Byod. If enrolling through ABM will the user be able to login through their entra Id account for their local account?

Hi,

I am tasked with providing a solution to the following situation. Before we implemented additional CA policies, our users could see their company calendar on their private phones. Since CA was implemented it is not possible anymore. I tried creating an app protection policy for iOS Outlook but it asks the user to download the company portal and here the "fear" creeps in, because they do not want to have the phone "half-company-monitored". Is it possible to do this without a company portal - I know that the app is the broker. Maybe i understood something wrong, but if the user does not join but only register - I guess this is fine and should be accepted by the user.

User shared the info that he used to download the calendar with .ics file? Or subscription, not sure and the company laptop is turned off at the moment. Will edit the post tomorrow morning.

Is there a guide on the internet on how to do this?

Cheers!

I have been trying to figure out a deny logon plan for our autopilot devices, and for a while I was thinking nothing was working, even when trying to manually make the changes that I want Intune to do.
I decided to try with a configuration that is setup for individual users, rather than using the "shared PC mode" or "Shared multi-user device" setting. During that test the user was blocked from login and I could have been done. My problem is the shared devices are the ones that I want these users blocked from, and none of the traditional ways are working. Is there a setting that can be changed that will help, has anyone else had this problem?

The 2 main methods I tried were adding the SID of the group to the Deny Logon Local Policy, and adding the SID to a Local Group (both self created and built-in) and then denying logon to the Local Group in the Local Policy.

The group I am using is an AzureAD group, and the test device has been a freshly wiped Autopilot device.

Hi guys,

On Lenovo T14 Gen 7’s we have the issue that the Autopilot Hash mismatches after an Intune Wipe.

We assumed it has to do with the „TPM Clear“ screen you receive after wiping.

Anyone else had this/knows a fix or so?

Dell doesn't update their driver packs very often at all so critical driver updates don't come in, which is what I'm currently using. I was exploring Dell Command Update but it seems very basic and you would need to setup a lot of custom scripting to do your own tracking and reporting. SO I've been loading each driver update into Intune manually for every model and it's a pain in my ass.

Hello,

Checking to see if anyone is experiencing this also when utilizing the autopilot for domain joined devices.

I know what the sentiment is for it but unfortunately, we have to domain join our devices.

I am using Out of Office Hours script that Michael Niehaus provided (Thank you). We did modify it to meet our needs. Overall the app works, devices enrolls and joins AD with name Prefix-Random then the script renames it to what we want it and restarts the computer.

Object in AD gets updated, then on Entra the device (original) get renamed as well, but then a few minutes later, a new duplicate devices shows up becomes Enabled with join type Entra Hybrid Join and the original device gets disabled and join type is changed to Entra Join

When I compare the device ID on Entra and Intune, the disabled device (original) is the one that matches.

Device still checks in on Intune, but on Entra the activity doesn't seem to update.

Any suggestions is helpful.

Thank you.

We are testing using Apple Business to migrate MacOS from Jamf to Intune.

The Mac is at MacOS 26.6.2

Is there any option to have this migration run immediately?

If we do not select a deadline, it does not seem to work. It looks like the minimum deadline that ABM allows is 24 hours ahead.

We are testing and we would like to be able to do this immediately and I thought when we first tried this that it was possible to have it force an immediate migration but I don’t see a way to do this now.

Any suggestions would be appreciated.

Thanks.

Anyone use intune for patching?

Unless I don’t have them enabled correctly the reporting seems very vague

I am considering using it for drivers but I’m having hard time not having a hard time lol

The reporting seems mediocre and tedious I.e. I cannot tell what devices a driver is for only the amount of devices the driver is applicable for any suggestions would be helpful

After noticing the new Sync Status window in Intune, I started wondering where the information in that pane actually comes from... (.. i still can't fully explain it :P)

So I traced the sync through Graph, SyncML, the Windows MDM debug logs and the IME logs. The interesting part is that the Numbers and information are coming from different places.

Applications: the offered count maps to the required Win32 apps Intune returns to the IME for evaluation.
Scripts: They come from the HealthScripts side, including Remediations and custom compliance. As regular platform scripts are only executed once (so only new ones are added to the count)
Policies: That one is the odd one, i can't explain....yet

The normal Device Configuration view can be traced back to the Graph reporting data, but the new Sync Status window can show a slightly different total. That extra number does not appear in the SyncML trace or the device side MDM debug logs, so there is still some service side aggregation happening that we cannot see.

It would be interesting to know whether anyone has identified exactly what Intune is adding to that Policies count :) ... something magic?

Inside Intune's New Sync Status Window - Patch My PC

​

Is there a way to automatically sign in to Managed IDs when the enrollment happens?

We’re currently using SCCM for patch management. IT has set the expectation with employees that computers always get patched and rebooted at 7PM on the 4th Tuesday of each month. Patches become available on the 3rd Tuesday for users to self-install, but an email notice goes out on the 4th Tuesday telling everyone to log out of their computers and leave them running overnight if they haven’t taken that month’s updates yet. Anybody who misses the window is in for a rude awakening the next time they turn their computer on.

SCCM allows this degree of control which Intune seems incapable of.

We have a volunteer group of canaries that get forcibly patched and rebooted on the 3rd Tuesday in case Microsoft botched any updates that month. I’ve enrolled this group into Intune as a pilot, but here we are on the 3rd Tuesday of the month and only some of them are showing updates available.

I have an update ring configured with a deferral of 7 days, a scheduled install of the 3rd Tuesday at 7PM, and a hard deadline of 14 days. One machine checked for updates at 11:17 AM and includes drivers that I’ve explicitly set to require approval and have not approved. There’s no verbiage about when the install will happen or what the deadline is.

On another machine, it last checked for updates at 9:04 AM and isn’t showing any updates available at all. I’m assuming because a 7-day deferral means 10:30 Pacific time, which is when Microsoft actually publishes updates on Patch Tuesday. So with a default 22-hour check interval, that machine won’t even see updates until tomorrow morning, which is a day late.

On a 3rd computer, I freshly imaged it and deliberately withheld patches to see what update behavior is like when the deadline has already passed. It correctly offered me July’s patches, but not August’s (I did this yesterday before the 7-day deferral expired). However, it warned me that it would reboot on the 26th, which is next Wednesday — for last month’s patches.

I’m having a hard time figuring out how to set employee expectations in light of Intune’s fuzzy update logic. I’m accustomed to being able to schedule the exact update/reoot timing with SCCM and guarantee that my entire fleet will by compliant by the end of each month. But Intune doesn’t offer that kind of precision. How do you folks do it at your company?

Hello, need some insight. We are planning a phased migration of roughly 300 Windows users from traditional on-prem AD/domain-joined devices to Microsoft Entra joined + Intune managed devices using Windows Autopilot.

For new devices/users, Autopilot is pretty straightforward. The part I'm trying to plan is our existing users and their Windows profiles.

Our goal is to make the migration as hands-off as possible for the user. Ideally, IT handles the migration in the background or during a scheduled cutover, and when the user signs into the Entra joined device their existing environment is preserved as much as possible.

We want to preserve things such as:

• Desktop/Documents/Pictures
• Browser profile/bookmarks
• Outlook/M365 configuration
• User-specific application settings
• Shortcuts
• Relevant AppData/settings where possible
• Printers/mapped resources where still needed

We are looking at OneDrive Known Folder Move for user data, but obviously KFM doesn't migrate the entire Windows profile.

For same-device migrations, I've been looking at ForensiT User Profile Wizard Corporate Edition to potentially reassociate the existing domain profile with the user's Entra identity. I've also looked into USMT.

For those who have actually done an AD/domain joined → Entra joined + Intune migration at scale:

1. How did you handle existing Windows user profiles?
2. Did you wipe/reprovision devices or convert them in place?
3. Did you use ForensiT, USMT, OneDrive KFM, or another solution?
4. If you used ForensiT, were you able to automate it successfully at scale?
5. What profile data/settings did NOT survive that you expected to?
6. How much user interaction was required?
7. Would you use the same approach again?
8. Any major gotchas with credentials, AppData, Outlook, browser profiles, mapped drives, printers, or application settings?
9. If you had to do ~300 users today, what approach would you use?

The end goal isn't necessarily a perfect 1:1 clone. We're trying to avoid making users manually move files, reinstall applications, or rebuild their working environment after the migration.

I'd especially appreciate experiences from anyone who has done this with existing production users rather than only new Autopilot deployments.

Main Q: After the migration, when the user signed in with their Entra account for the first time, did Windows load their original domain profile directly, or did you still have to manually repair/reconfigure parts of the profile?

Blocked the public AI sites in the browser policy months back, ticked shadow AI off the board, moved on.

This week Im on a laptop for a printer ticket and the ChatGPT desktop app is right there in the tray, signed in. I checked five more machines, its on four of them. With installs per user, no admin and app control never saw a thing. The ones not on desktop are on their phones.

The block only ever worked on the people who were never the problem, and Ive spent months telling my manager this was handled.

What are you running that shows you who's touching what on managed devices? Not another block. Something I can point at usage with.

Hi everyone,

I’m trying to figure out an intermittent issue we’re seeing with Intune app deployments on reused laptops.
We regularly receive returned laptops and re-provision them for new users. Our process is generally:
Perform an Intune/Wipe on the device without retaining user data.

Re-provision the device through Autopilot.
During ESP, required applications such as SentinelOne and Whalebone are supposed to install.
Once everything is installed and verified, we hand the laptop over to the new user.

The issue is that sometimes when we wipe and reprovision a device on the same day, some of the required apps fail to install.
For example, we may see:
“Downloading and installing SentinelOne failed”
“Downloading and installing Whalebone failed”

Another behavior we’ve noticed is that after ESP finishes, SentinelOne may be installed but the other required apps don’t seem to sync/install for quite a while. Eventually Whalebone starts downloading, but then fails during installation.

What’s interesting is that if we wipe the same laptop again a few days later, the exact same apps often install successfully.

This makes me wonder if we’re dealing with some kind of timing/sync issue between Autopilot, Intune, and the Intune Management Extension (IME), rather than an issue with the application packages themselves.

Has anyone experienced something similar when reusing/reprovisioning devices shortly after an Intune wipe?

If so:
Did you find that waiting a certain amount of time after the wipe helped?
Could stale device/Autopilot/Intune state be causing this?
Is there anything specific with IME sync/check-in that we should be checking?
Are there particular IME logs you recommend looking at for these failures?
Could SentinelOne/Whalebone themselves be causing installation conflicts during ESP?

Any troubleshooting suggestions or similar experiences would be really appreciated.

Pre-provisioning started failing yesterday. We tracked down the issue to one specific agent that we install through Intune.

Oddly, we don’t have Autopilot set to stop if an App install fails. Has anyone else ran into this type of behavior?

I’m also curious how we can keep pushing the App to All Device, but only after pre-provisioning has finished. I considered scoping the app to All Users, but the App should be on All Devices regardless of the logged on user.

Hi,

So this year we have users that are using their own laptops but they still need access to available software

How can I set this up without Being device bound?

Or do I not comprehend Company portal fully?

We are seeing multiple accounts from previous logins on the windows screen.

Is there anyway I can hide it through the settings catalog? I tried searching this online but google is giving me non related solutions.