Of course, it’s also the Halloween special!

Community Content

We start this week with a look at how to manage AI on your managed Android Enterprise devices from Nicky De Westelinck

https://www.nickydewestelinck.be/2026/10/22/managing-generative-ai-on-android-enterprise-devices-with-microsoft-intune/

Dave Randall has released a lot more posts for the 20 days of RBAC which I would suggest also checking out, but this deep dive into scope tags is definitely worth a read!

https://dave-randall.com/rbac/scope-tags-deep-dive/

On the subject of Scope Tags, Michael Frank looks at the new Scoped Permissions functionality in preview

https://michaelsendpoint.com/intune/ScopedPermissions.html

This post from Michael Meier looks at the Properties Catalog functionality to grab registry keys

https://mikemdm.de/2026/10/25/intune-now-can-collect-registry-keys/

Learn about all Graph App reg permissions, roles and more importantly what has recently changed in this post from Roy Klooster

https://rksolutions.nl/posts/microsoft-graph-is-a-maze-graphlens-gives-you-the-map/

If you’re running AI Agents (or are worried about the ones you don’t know about), try the AI Agent runtime protection available in Defender for Endpoint as covered here by Peter van der Woude

https://petervanderwoude.nl/post/getting-started-with-ai-agent-runtime-protection/

Take your Defender for Endpoint management to the next level with custom data collection rules in this post from Jeffrey Appel

https://jeffreyappel.nl/microsoft-defender-for-endpoint-beyond-default-telemetry-with-custom-data-collection-rules/

For those working in DoD environment, the new STIG audit baselines are going to be of interest. Check out this post from Joost Gelijsteen looking at how they work and how to troubleshoot them

https://joostgelijsteen.com/stig-baseline-intune-audit-whats-on-the-device/

You can finally get unlimited licenses for free Apple VPP apps as covered here by Craig Camacho

https://thedeploymentguy.co.uk/unlimited-vpp-licences-intune/

If you are going fully passwordless, you can now remove the “Current Password” field from SSPR, learn how here with Jan Bakker

https://janbakker.tech/allow-password-change-after-secure-sign-in/

Next, we have an in-depth guide covering best practices when deploying quality updates from Kenneth van Surksum

https://vansurksum.com/2026/10/30/configuring-windows-quality-update-policies-for-your-microsoft-intune-managed-modern-workplace/

Video Content

Now for the video content with a look at the new RDP functionality added to the Windows app here from Dean Cefola

Microsoft Content

Onto the Microsoft content with a guide on how to make a macOS security baseline using custom compliance from Iris Yuning Ye

https://techcommunity.microsoft.com/blog/IntuneCustomerSuccess/establish-a-macos-security-baseline-with-mscp-and-microsoft-intune-custom-compli/4568222

That’s all for this week, have a spooky weekend!

Hopefully everything is now patched and you can enjoy this weeks Intune news

Community Content

We start this week with the first part (of 7 at the time of writing) in a new series from the legend Dave Randall covering all things Intune RBAC. His blog is definitely worth browsing if you want to know the inner workings of Intune and Graph

https://dave-randall.com/rbac/day-01/

Then when you have learned all about RBAC and implemented it, use this excellent script from Jeff Gilbert to document everything

https://www.linkedin.com/pulse/intune-rbac-documentation-script-jeff-gilbert-3ephe/

The final secure boot certificate expires on Monday, check this won’t cause you any issues in this post from Mr T-Bone

https://www.tbone.se/2026/10/16/secure-boot-take-3-the-last-2011-certificate-expires-on-monday/

Lisa Berenberg continues looking at your mobile device management and following on from looking at iOS last week, this weeks post covers Android Enterprise enrollment and enrollment time grouping

https://lisabee.tech/intune-device-enrollment-part-2-android-enterprise-and-enrollment-time-grouping/

If you are licensed for Defender for Endpoint, even if you use 3rd party AV, it is still protecting you in passive mode as covered here by Andrew Blumhardt

https://www.techchat.blog/2026/10/17/the-power-of-mde-passive-mode/

This post from Jannik Reinhard looks at the new AI Agent Runtime protection available in the Intune portal

https://jannikreinhard.com/intune-ai-agent-runtime-protection/

We have an excellent new tool from Simon Hartmann Eriksen to quickly associate your Autopilot Device prep devices without having to mess with CSVs and USB-sticks

https://www.simsenblog.dk/2026/10/18/introducing-autopilotqr-scan-associate-deploy/

We now have two posts from Jonathan FIEVET, starting with a guide for implementing Administrator Protection

https://leblogmodernworkplace.fr/administrator-protection-sous-windows-11-guide-complet-avec-microsoft-intune/

The second post was always a gap in EPM. Some industries have staff who need to be able to change the IP address and it used to require either full admin, or a 3rd party application. Fortunately you can now allow certain settings to be managed by EPM

https://leblogmodernworkplace.fr/intune-epm-laisser-les-utilisateurs-standard-modifier-leurs-parametres-reseau-sans-droits-administrateur/

If you’ve switched to iOS enrollment profiles and are finding your devices keep trying to re-enrol, check out this post from Kevin Malinoski

https://malinoski.me/2026/10/19/company-portal-ghosting-your-ios-ade-enrollment-heres-the-fix-for-the-new-enrollment-policies/

Next, Craig Camacho looks at the often overlooked enrollment restrictions in Intune, how to use them and why you need them

https://thedeploymentguy.co.uk/intune-enrollment-restrictions/

We have an excellent new tool from Oliver Kieselbach to watch your Autopilot deployments in real-time and best of all, it’s free with the community version

https://www.autopilotmonitor.com

Another tool, this one for quickly creating EPM rules directly from the executable itself. This tool is made by Mathias Borowicz

https://zerotruststories.com/epm-rule-creator/

Video Content

Now for this weeks video content with a return to the What’s New video series from Nickolaj Andersen, Mattias Melkersen Kalvåg and Peter van der Woude, looking at the new features in the 2609 release

You may have noticed Autopilot Device Prep doesn’t install updates automatically. Learn how to get around this here from Steve Weiner

Microsoft Content

Not for the Microsoft content, starting with all things Windows release information from Chris Morrissey

https://techcommunity.microsoft.com/t5/windows-it-pro-blog/your-windows-release-information-toolbox/ba-p/4566273

You can now require managed Google accounts on Android Enterprise devices as covered here by Samuel Vara and Mayur Jadhav

https://techcommunity.microsoft.com/blog/IntuneCustomerSuccess/require-google-workspace-authentication-on-android-enterprise-devices-with-micro/4565954

That’s all for this week, have an amazing weekend and for those of you travelling to MMS, have a safe journey

Community Content

We start this week with a guide on how to migrate to DDM for your Apple Updates including a useful analysis tool from James Vincent

https://jamesvincent.co.uk/2026/10/09/preparing-intune-apple-update-management-for-ddm/

Stopping users from doing things they shouldn’t be doing seems like a constant battle. The apps which run within cmd are especially tricky because they are signed by Microsoft. If you want to start with blocking ssh (always a risk to leave open), follow this guide from Jörgen Nilsson

https://ccmexec.com/2026/10/block-ssh-using-windows-firewall/

A lot of companies want to implement a Bitlocker startup PIN, but as we all know, it ruins autopilot so we rely on getting the users to configure it after building. If you want to make this a bit easier for them, grab this script from Jorge Suarez

https://www.jorgeasaur.us/bitlocker-startup-pin-after-autopilot

This post from Michael Meier runs through the end to end configuration and use of Autopilot Device Prep Device Association

https://mikemdm.de/2026/10/11/windows-autopilot-device-association/

If you are having problems getting the Cloud Sync Provisioning agent to start, check out this guide from Jan Bakker

https://janbakker.tech/cloud-sync-provisioning-agent-fails-to-start-with-a-gmsa/

We’ve all heard of the horrible security baselines in Intune, but did you know there are also baselines for the rest of M365 which actually work quite well? If you haven’t implemented anything yet, this post from David McWee is worth a look

https://davidmcwee.com/2026/10/12/baseline-security-mode-deployment/

Sysmon is finally included in Windows 11 by default, but you do need to enable it. Learn how here from Peter van der Woude

https://petervanderwoude.nl/post/easily-enabling-sysmon-in-windows-11/

Learn about the new way of enrolling Apple devices into Intune and enrollment time grouping in this post from Lisa Berenberg

https://lisabee.tech/intune-device-enrollment-part-1-apple-enrollment-profiles-vs-policies-what-changed/

For those of you using PEAP, this Windows update is worth watching for as it may break your WiFi authentication. Learn all about it here from Thomas Marcussen

https://blog.thomasmarcussen.com/kb5127648-breaks-8021x-peap-wifi-authentication-windows-11/

Video Content

Now for this weeks video content starting with a PowerShell metering dashboard from Chander Mani Pandey

Chander also runs through how to create an RBAC role just for remote help users here

Microsoft Content

It’s time for another certificate rotation, this one for Windows updates. Get prepared now in this post from Andrew Brown

https://techcommunity.microsoft.com/t5/windows-it-pro-blog/prepare-for-windows-update-certificate-rotation-in-2027/ba-p/4562463

If you are currently using custom CNAME for MDM auto discovery, make sure you read this article from the Intune Support Team (it’s a breaking change)

https://techcommunity.microsoft.com/blog/IntuneCustomerSuccess/preparing-for-end-of-support-for-cname-auto-discovery-in-windows-mdm-only-enroll/4564973

That’s all for this week, have a tremendous weekend!

Community Content

We start this week with a very useful PowerShell script from Philip Jorgensen for all of you managing Lenovo devices. Quickly create assignment filters for your various different models without needing to go and find all of the model codes with this script!

https://blog.lenovocdrt.com/creating-intune-assignment-filters-for-lenovo-models/

If you’re managing personal devices with App Protection, you have no doubt hit the issue where your users need to be able to access something in a non-managed app and either you’re left opening a security hole or getting shouted at. Lucky for you, Kenneth van Surksum has a thorough guide here to make exceptions

https://www.vansurksum.com/2026/10/05/opening-other-apps-and-sharing-data-from-intune-protected-apps-on-apple-mobile-and-android/

For those of you with AVD or Windows 365 machines (or now RDP), learn how to manage the Windows app here from Peter van der Woude

https://petervanderwoude.nl/post/easily-managing-windows-app-on-windows-devices/

Next, James Vincent looks at the new Deployment Plans functionality recently released

https://jamesvincent.co.uk/2026/10/05/intune-deployment-plans-pilot-rollout/

If you’re managing Microsoft Surface devices, learn all about the surface management portal here from Mr T-Bone

https://www.tbone.se/2026/10/05/intune-surface-management-portal-the-hidden-gem/

T-Bone also looks at the new Microsoft hardware announced this week here

https://www.tbone.se/2026/10/08/windows-got-hybrid-intelligence-and-i-neeeed-a-surface-ultra/

Are you wondering how many of the new features in 26H2 you can manage with Intune now? If so, this post from Joe loveless is for you!

https://joeloveless.com/blog/intune-settings-catalog-settings-win11-26h2

You may have noticed there are now two places where you can configure some Windows 365 settings, including setting users as admins (which with the end of dev boxes is a valid use case). If you want to be able to automate it, check out this guide from Aresh Sarkari

https://askaresh.com/2026/10/08/windows-365-local-admin-cloud-pc-configurations-vs-user-settings-powershell-graph-rest-api/

Grabbing logs from Windows devices is just a button press, but what if you want to send your macOS logs to AppleCare? Learn how in this post from Somesh Pathak

https://intuneirl.com/trigger-enhanced-log-collection-on-macos-27-with-intune-tokens-logs-and-fixes/

Assignments are one of these which are very environment specific, but there are always some situations which are best done in a certain way. Learn about some of these in this post from Jorge Suarez

https://www.jorgeasaur.us/intune-assignments-dos-and-donts

If you are managing Apple devices and want to know exactly how DDM is managing your updates, check out this excellent post from Kevin Malinoski

https://malinoski.me/2026/10/08/are-you-managing-your-apple-updates-or-are-they-managing-you/

Video Content

Now for the video content, starting with an in-depth look at what’s available with Security Copilot for Intune here from Saurav Sarkar

Steve Weiner runs through the new deployments functionality here and how best to use it

Entra Risk policies are now retired, learn what it means for you here from Jonathan Edwards

Microsoft Content

Onto this weeks Microsoft content starting with the all important Windows News you can use from Chris Morrissey

https://techcommunity.microsoft.com/t5/windows-it-pro-blog/windows-news-you-can-use-september-2026/ba-p/4552395

Windows app finally has support for RDP connections! Learn more here from Marvin Quinzon

https://techcommunity.microsoft.com/t5/windows-it-pro-blog/remote-pc-connections-in-windows-app-on-windows-is-now-generally/ba-p/4561186

That’s all for this week, have an amazing weekend!

Community Content

We start this week with a useful tip from Christopher Mogis on how to convert your macOS dmg packages to pkg at the terminal

https://www.ccmtune.fr/2026/09/how-to-convert-dmg-application-to-pkg.html

If you are looking to get started with Remote Help now it is in your M365 licensing, check out this thorough guide from Michael Frank

https://michaelsendpoint.com/intune/intune_suite/remote_help.html#v2

Michael also looks at the new deployment plans functionality here

https://michaelsendpoint.com/intune/deployments.html

For those of you managing Lenovo devices, learn how to keep the drivers and BIOS updated in this guide from Mads Johansen

https://evil365.com/lenovo/Update-Lenovo-Devices-With-Lenovo-Commercial-Vantage-Using-Intune/

You’ve no doubt heard of the Enterprise App Catalog with your M365 licensing and the “many” apps, but sometimes it’s nice to know which apps are in there, without counting 20 versions of Java as different apps. Fortunately Ben Whitmore has a lovely script here which will tell you exactly which apps and how many versions of each. Plus you can find out how the script works to learn a bit of Graph along the way

https://msendpointmgr.com/2026/09/27/whats-in-the-enterprise-app-catalog/

For all of the Linux users out there (and I’m sure it’s a growing list), if you still want to be able to access Windows 365, try this guide from Niall Brady

https://www.niallbrady.com/2026/09/28/using-windows-365-via-linux-zorinos-to-be-precise/

You may or may not have noticed the deployment plans now available in Intune to apply the same approach taken with updates to policies and apps. It has been a popular topic this week, covered here by Peter van der Woude

https://petervanderwoude.nl/post/getting-started-with-deployments-and-deployment-plans-for-an-automated-staged-rollout/

Jorge Suarez also looks at how to use it here, including some useful PowerShell scripts for those of you who want to automate it (and why wouldn’t you!)

https://www.jorgeasaur.us/intune-deployments-schedule-the-rollout

Another look at deployment plans here from Craig Camacho

https://thedeploymentguy.co.uk/intune-deployment-plans/

Win11 26H2 is here, sadly no Windows 95 style launch video for this one, but I’m sure you’re all very interested to try it. Thomas Marcussen has an excellent run-through of what’s included, what to expect and how to manage the rollout here

https://blog.thomasmarcussen.com/windows-11-26h2-ga-autopilot-intune-reporting/

For the French speakers, Jonathan Fievet looks at how to deploy 26H2 in this post

https://leblogmodernworkplace.fr/windows-11-26h2-ce-quil-faut-retenir/

Laurent Gébeau also looks at 26H2 here (in French)

https://www.toutwindows.com/blogtoutwindows/windows-11-2026-aka-26h2-est-dispo/

This post from Joey Verlinden looks at some of the new security features available in 26H2 as well as how to deploy it

https://www.joeyverlinden.com/upgrade-to-windows-11-26h2-via-intune/

Away from Windows, a lot of new functionality has been added in the 2609 Intune release for Android Enterprise as covered here by Nicky De Westelinck

https://www.nickydewestelinck.be/2026/09/30/whats-new-for-android-enterprise-in-microsoft-intune-2609-september-2026-highlights/

Jeroen Burgerhout completes the series looking at Windows 365 by covering the dedicated Windows 365 Link device and how to manage it with Intune

Jeroen Burgerhout ☁️ | MVP

Windows 365 Wednesday - Windows 365 Link and Intune

So, we’ve made it to the final part of the Windows 365 series…

Read more

a month ago · 3 likes · Jeroen Burgerhout ☁️ | MVP

If you’re looking for ways to manage elevated permissions, or dealing with an estate full of admins, this post from Dustin Gullett is for you. It looks at Admin Protection and EPM, the use cases for each and how they can help

https://zerototrust.tech/administrator-protection-vs-intune-epm-high-noon-for-local-admin/

You can now have some control over app launches on your macOS fleet as covered here in this comprehensive post from Somesh Pathak

https://intuneirl.com/wdac-for-macos-app-control-on-macos-27-with-intune/

Video Content

Now for this weeks video content (and there is a lot), starting with two videos from Liam Robinson, the first covers a few different methods to remove Windows 11 bloatware

Liam’s second video looks at the new deployment plans in Intune and how to get up and running

Dean Ellerby also looks at the new deployment plans here

This video from Steve Weiner also covers the new Deployments functionality

It’s been a popular feature this week, Chander Mani Pandey also looks at deployment plans in the first of two videos this week

Chander has been quick off the mark with the second video, covering how to deploy Win11 26H2

Learn how to setup App Inventory in this video and blog post from Mark Oldham

https://controlaltdeletetechbits.co.uk/microsoft-intune-app-inventory/

If you’re running hybrid and trying to work out which wins between Intune and GPO, watch this video from Jonathan Edwards

Microsoft Content

Onto the Microsoft content we go, starting with the official 26H2 announcement with all of the information you need from Aria Hanson

https://techcommunity.microsoft.com/blog/Windows-ITPro-blog/an-it-pro%E2%80%99s-guide-to-windows-11-version-26h2/4559760

Aria also has a new podcast which I would definitely recommend signing up for here, the first episode covers update management which is something everyone should know about

https://techcommunity.microsoft.com/t5/windows-it-pro-blog/introducing-ctrl-manage-practical-windows-management-in-30/ba-p/4560916

The Intune Support team also cover the new Settings Catalog updates for 26H2 here

https://techcommunity.microsoft.com/blog/IntuneCustomerSuccess/microsoft-intune-settings-catalog-updated-to-support-windows-11-version-26h2/4560815

Learn about all of the latest goodies in Windows 365 here from Sylvia Liu

https://techcommunity.microsoft.com/blog/Windows-ITPro-blog/what%E2%80%99s-new-in-windows-365-september-2026-recap/4558777

That’s all for this week, have an amazing weekend!

I’m always looking for new people to follow so please let me know if I’m missing anyone!

Community Content

We start this week with a look at the different types of (Windows) application available within Intune and where to use which from Mark Oldham

https://medium.com/@m.oldham/microsoft-intune-app-deployment-guide-store-lob-and-win32-apps-explained-1691af0bdc8b

If you have ever wanted compliance to be just that bit quicker, it’s coming soon. Learn about the new Client driven compliance here from Laurent Gébeau

https://www-toutwindows-com.translate.goog/blogtoutwindows/intune-client-driven-compliance-evaluation-mise-a-jour-rapide-de-la-conformite-intune/?_x_tr_sl=fr&_x_tr_tl=en&_x_tr_hl=en-GB

You may have noticed the wipe options have recently changed in the new device view. Find out which method is best for your org in this post from James Vincent

https://jamesvincent.co.uk/2026/09/22/microsoft-intune-windows-wipe-options-which-reset-should-you-use/

A new preview release which appeared in my tenant today, deployment plans so you can stagger your policy and app deployments like you do with Autopatch. Jonathan Fievet takes a closer look here

https://leblogmodernworkplace-fr.translate.goog/deployment-plans-dans-microsoft-intune-le-rollout-progressif-enfin-natif/?_x_tr_sl=fr&_x_tr_tl=en&_x_tr_hl=en-GB

Mathias Borowicz also looks at the wave deployments here

https://zerotruststories.com/how-to-use-native-wave-deployment-in-intune/

Next, Dustin Gullett looks at the new Entra token protection for browsers and how to use it to protect your admin portals

https://zerototrust.tech/microsoft-entra-token-protection-for-browsers-same-key-wrong-car/

This post from Arno van Dijk looks at what Autopilot Device Prep Device Association adds to your deployment strategy

https://www.xplorethecloud.nl/l/windows-autopilot-device-preparation-explained-what-device-association-really-adds-to-the-oobe-experience/

If you are finding you are hitting 401 walls in Graph when using your unlicensed admin account, this post from Roy Klooster should help you out

https://rksolutions.nl/posts/thought-global-reader-could-read-everything-intune-says-401/

By now I’m sure you all know how I feel about browser extensions! If you want to track them in your tenant and have defender licensing, try this post from Jeffrey Appel

https://jeffreyappel.nl/how-to-track-browser-extension-installations-with-microsoft-defender/

When dealing with kiosks, the order of configuration is critical, you don’t want a config to hit before the app has arrived. If this sounds familiar, try this post from Peter van der Woude

https://petervanderwoude.nl/post/making-sure-the-multi-app-kiosk-configuration-is-applied-after-the-installation-of-the-applications/

With the imminent retirement of SMS and Voice MFA, check how you are impacted and what happens to your SSPR config here with Rahul Jindal

https://rahuljindalmyit.blogspot.com/2026/09/microsoft-entra-sms-and-voice.html

Learn how to use Windows point in time restore in this post from Driek Desmet

https://blog.interian.be/2026/09/23/windows-11-point-in-time-restore/

For those of you managing surface devices, see how DFCI can work for you, but with the right config in this post from Mr T-Bone

https://www.tbone.se/2026/09/24/dfci-on-surface-intune-reaches-below-windows-and-one-checkbox-combo-can-cost-you-an-ssd/

Delve into the murky world of app control for business here with Andrew Blumhardt

https://www.techchat.blog/2026/09/23/app-control-for-business-looking-beyond-the-surface/

If you want more control over how Edge updates (and informs your users), try this guide from Kevin Malinoski

https://malinoski.me/2026/09/24/your-edge-updates-have-no-deadline-and-how-to-set-one-with-intune/

Video Content

Onto this weeks video content, starting with a look at hybrid joined devices, how they work, how to join your devices and why they are a perfect stepping stone from Jonathan Edwards

For those who prefer a video, Mark Oldham has a video run-through to follow the blog post earlier covering apps in Intune

Learn how to grab Bitlocker keys with PowerShell in this video from Liam Robinson

This video from Steve Weiner covers how to opt out of passkeys in Entra with the end of SMS and Voice MFA

Microsoft Content

Now for this weeks Microsoft content starting with an excellent addition to Windows 365 Reserve where you can allow users to provision machines themselves. Learn more here from Logan Silliman

https://techcommunity.microsoft.com/t5/windows-it-pro-blog/general-availability-user-initiated-provisioning-for-windows-365/ba-p/4557248

Users can now select which desktop apps can access the camera and microphone rather than a catch-all as covered here by Rohit Kurup

https://techcommunity.microsoft.com/t5/windows-it-pro-blog/giving-you-more-control-over-camera-microphone-and-location/ba-p/4559374

Find out what the release of Apple OS 27 brings to Intune in this post from the Intune Support Team

https://techcommunity.microsoft.com/blog/IntuneCustomerSuccess/microsoft-intune-and-apple-os-27-new-settings-support-and-platform-changes/4559764

That’s all for this week, have an amazing weekend

This weeks newsletter is being written in Amsterdam airport between flights so apologies if I’ve missed anything, or it’s just a load of gibberish :)

Community Content

We start this week with a look at what your options are when Microsoft deprecate slmgr.vbs and why this is important to you in this post from Mads Johansen

https://evil365.com/windows/intune/VBScript-Deprecation-Replacement-for-slmgr/

Mads also has a useful tip here on monitoring your EPM client versions

https://evil365.com/intune/Add-Microsoft-EPM-Agent-version-to-your-software-inventory/

Autopilot Device Prep is getting better with each release and I’m sure many of you are probably starting to look at it, but the lack of a naming template is often a blocker. Jóhannes Geir Kristjánsson has a script here to solve this issue for you

https://johannesblog.com/2026/09/12/applying-a-specific-hostname/

On the subject of Device Prep, Niklas Tinner looks at if now is the time to switch here

https://www.oceanleaf.ch/is-autopilot-device-preparation-it/

Edge extensions, the modern day browser toolbars! But how can you tell if anyone is actually using them? Leaving unused extensions seems a huge security risk. Fortunately Sebastian F. Markdanner runs through how to monitor them here

https://www.chanceofsecurity.com/post/are-your-microsoft-entra-extensions-actually-being-used

iOS (and iPadOS) finally support token protection to add an extra layer of security to your admin portals. Learn how to implement in this post from Jan Mulder

https://wolkenman.wordpress.com/2026/09/16/token-protection-for-apple-devices/

If you are looking at zero trust across your connectivity layer as well, Entra Internet Access is probably on your list. This post from Michael Frank runs through what it is and how it works

https://michaelsendpoint.com/entra/InternetAccess.html

Video Content

Now for this weeks video content and it’s been a popular week for Autopilot Device Prep. This video from Dean Ellerby looks at how it works with Device Assosication

If you are running E5 licenses, you may be looking at Remote Help to replace any existing remote support solutions now you are receiving it for free. Learn how to set it up from scratch in this full walkthrough from Steve Weiner

Microsoft Content

Onto this weeks Microsoft content and we start with the sad news that Unpacking Endpoint Management has concluded, but all episodes are available on catch-up at the link below

https://techcommunity.microsoft.com/blog/IntuneCustomerSuccess/unpacking-endpoint-management-episodes-available-on-demand/4514599

If you have looked at all of the content on device prep and decided now is the time to switch, this in-depth post from Maggie Dakeva is definitely worth reading, it covers how to migrate from Autopilot to Device Prep

https://techcommunity.microsoft.com/blog/IntuneCustomerSuccess/moving-from-windows-autopilot-to-windows-autopilot-device-preparation/4557269

That’s all for this week, have a fantastic weekend!

Community Content

We start this week with a look at the new registry collection in Properties Catalog from Mr T-Bone

https://www.tbone.se/2026/09/04/finally-a-supported-method-to-inspect-hklm-on-intune-managed-devices/

Next, Simon Skotheimsvik has updated the excellent 1PhoneMirror tool, a great way for screenshots when documenting and so much more

https://msendpointmgr.com/2026/09/05/1phonemirror-levels-up-webcam-stats-better-screenshots-and-signed/

If you are thinking it’s time to take the plunge into the world of Autopilot Device Prep, this end-to-end guide from Joery Van den Bosch is well worth checking out

https://intunestuff.com/2026/09/07/device-association/

This is one which has always caused issues, App Protection used to only work with a single account, not ideal for those who need accounts in multiple tenants (or just like security at home and work). Fortunately you can now use it with multiple accounts as covered here by Peter van der Woude

https://petervanderwoude.nl/post/using-multiple-managed-accounts-with-app-protection-policies/

Expanding on the excellent part 1, Dustin Gullett continues delving into the murky world of app control for business, this time looking at the all-important exceptions and how not to fall too far down the rabbit hole

https://zerototrust.tech/app-control-for-business-part-2-how-to-avoid-the-exception-factory/

If you are using the OSVersion assignment filter, I would strongly suggest checking out this post from Jeroen Burgerhout with the new filter you need to use

Jeroen Burgerhout ☁️ | MVP

osVersion in assignment filters is dead. Here's what replaces it.

A quick note this time over property changes is worth knowing. I was building a new assignment filter and noticed both osVersion and a new operatingSystemVersion property sitting in the list. It turns out that in service release 2608 (week of August 25, 2026…

Read more

2 months ago · 2 likes · Jeroen Burgerhout ☁️ | MVP

Video Content

Now for the video content, starting with a script from Chander Mani Pandey to grab live app inventory from your devices.

Microsoft Content

Onto the Microsoft news from this week, starting with some FAQs for the upcoming NTLM retirement from Mariam Gewida

https://techcommunity.microsoft.com/t5/windows-it-pro-blog/retiring-ntlm-frequently-asked-questions/ba-p/4550522

With VBS on the way out, I hear a lot of people wonder what to do about slmgr.vbs. Fortunately you can find the PowerShell alternatives in this post from Monika Kumar

https://techcommunity.microsoft.com/blog/windows-itpro-blog/keep-windows-activation-automation-working-with-powershell/4540459

That’s all for this week, have an amazing weekend!

Community Content

With the end-of-life of the Dev Boxes in Azure, Microsoft announced a developer special Windows 365 image at Build 2026. This post from Aresh Sarkari looks at what it includes and also has a useful script to quickly provision a machine!

https://askaresh.com/2026/09/02/windows-365-cloud-pc-for-developers-developer-configuration-image-powershell-provisioning/

Michael Frank continues diving into the world of security copilot, this time looking at the new vulnerability agent, what it brings and how to use it

https://michaelsendpoint.com/intune/SecurityCopilot/VulnerabilityAgent.html

We have the third part of the excellent series from Michael Meier looking at automating your custom VM images. This part looks at a limitation on editing your templates after deployment and how to work around it with DevOps pipelines

https://mikemdm.de/2026/08/30/using-azure-image-builder-to-build-your-custom-vm-images-part-3/

On the subject of AVD, you will want a secure landing zone in place before you start building anything. This comprehensive guide from Dieter Kempeneers is a great starting point

https://kempeneers.eu/2026/08/31/building-a-secure-azure-landing-zone-for-avd-and-windows-365/

If you are also managing Entra environments, you probably know the pain of managing custom extensions. Luckily for you, Sebastian F. Markdanner has a new application to help you

https://www.chanceofsecurity.com/post/introducing-entra-extensions-manager

Now point in time restore is GA on Windows, learn how to manage it and use it here from Peter van der Woude

https://petervanderwoude.nl/post/configuring-point-in-time-restore-in-windows/

Newly minted MVP Nicky De Westelinck looks at all of the new goodies available for Android Enterprise in the 2608 Intune release

https://www.nickydewestelinck.be/2026/09/01/whats-new-for-android-enterprise-in-microsoft-intune-2608-august-2026-highlights/

You have until November to remove any MemberOf rule within Entra dynamic groups before they simply stop working. Use this script from Tobias Eriksson to rapidly fix them

https://tob-it.se/how-to-find-and-bulk-replace-every-memberof-rule-in-entra-id-before-the-november-2026-retirement/

You can now use token protection to protect your key web apps (Intune, Entra etc.) Learn how to implement these to further increase your security in this post from Jan Mulder

https://wolkenman.wordpress.com/2026/09/02/how-to-use-token-protection-for-web-apps-in-windows-11/

If you are switching to Device Prep with Device Association, you probably want things to run a bit quicker than the backwards and forwards with CSV files. Rudy Ooms has created a new script to run during OOBE and sort it all for you here

https://call4cloud.nl/autopilot-get-device-association/

If you are worried about AI running on your devices, check out this guide from Jannik Reinhard to get you underway

https://jannikreinhard.com/intune-shadow-ai-openclaw/

If you have been having issues with Company Portal on your Apple devices, check out this post from Jeroen Burgerhout

Jeroen Burgerhout ☁️ | MVP

Getting Company Portal back after the new ADE Policy quietly drops it

A colleague asked me to investigate why iPad registration stopped working. Didn’t stop completely, devices went through Setup Assistant without any issues, we had a JIT registration policy, Company Portal was even sent to the device. But every time someone opened Company Portal after that, they were asked to register the devi…

Read more

2 months ago · 2 likes · Jeroen Burgerhout ☁️ | MVP

Next, this post from Mecken Swyter is great for taking your Windows compliance to a whole new level

https://meckenswyter.com/intune/custom-compliance-policies-intune

Video Content

Now for this weeks video content starting with two videos from Chander Mani Pandey looking at the new Autopilot Device Association functionality. The first video runs through how to bind a device to your tenant.

Chander’s second video looks at how to pre-associate devices to the tenant

A quick but very useful video from Mark Oldham showing how to block personal devices from enrolling into your Intune tenant.

Microsoft Content

Onto the Microsoft content, starting with a guide on how to plan your GPO to Intune migration from Per Larsen

https://techcommunity.microsoft.com/blog/IntuneCustomerSuccess/from-gpo-to-microsoft-intune-a-practical-guide-to-cloud-first-policy-management/4551946

You will soon have VBS backed kernel-level protection on your Windows devices as covered here by Peter Waxman

https://techcommunity.microsoft.com/t5/windows-it-pro-blog/expanding-memory-integrity-protection-across-windows-devices/ba-p/4551984

The all important Windows news you can use is here for August from Chris Morrissey

https://techcommunity.microsoft.com/blog/windows-itpro-blog/windows-news-you-can-use-august-2026/4552394

That’s all for this week, have an amazing weekend

Community Content

Whilst not strictly Intune related, I’m sure most of you spend a lot of your time in the security console. If you have E5 licensing, you get the Hunting Agent now which you can learn about here from Michael Frank

https://michaelsendpoint.com/security/SecurityCopilot/HuntingAgent.html

A new addition to Windows recovery, you can now do a point-in-time restore on your devices. Find out how to configure it with Intune and use it in your environment in this post from Jan Mulder

https://wolkenman.wordpress.com/2026/08/21/how-to-manage-point-in-time-restore-with-microsoft-intune/

Did you know you can do a device-bound passkey on macOS for Edge and Chrome? Me neither! If this sounds interesting, Jan Bakker has you covered here

https://janbakker.tech/how-to-create-a-microsoft-365-device-bound-passkey-on-macos/

We have the second part of the AVD automation series from Niels Kok here, this one covers (and includes scripts) on building your machines using Terraform and PowerShell!

https://www.nielskok.tech/azure-virtual-desktop/automate-avd-hybrid-part-2/

Now custom compliance is here for macOS, you can use this script from Nick Benton to check Defender is running properly as part of your compliance checks

https://www.oddsandendpoints.co.uk/posts/macos-custom-defender-compliance/

For those of you on Business Premium licensing, you may have noticed Defender for Business is lacking some features of the full-fat MDE. Learn what is missing and some options for you here with Rahul Jindal

https://rahuljindalmyit.blogspot.com/2026/08/defender-for-business-understanding.html

If you manage devices in the EU, I imagine this SSO blocking pop-up has caused you many issues! Fortunately you can now manage it with Intune as covered in this post from Mr T-Bone

https://www.tbone.se/2026/08/24/central-accept-of-continue-to-sign-in-dialog-now-a-supported-way-with-intune/

I imagine you want control over AI on your managed devices and no reason why this shouldn’t extend to your iOS/iPadOS devices as well. This post from Peter van der Woude shows how to manage Apple Intelligence via Intune policies

https://petervanderwoude.nl/post/managing-apple-intelligence-on-ios-and-ipados-devices/

There is still no easy way to control your applications on Intune. I personally prefer AppLocker, but it isn’t native and WDAC is a nightmare. The best native option is App Control for Business, but it’s still risky business. Fortunately Dustin Gullett has you covered with this comprehensive post

https://zerototrust.tech/app-control-for-business-hope-is-not-a-deployment-strategy/

As mentioned earlier, unattended access for Remote Help (Windows) is finally here. Mads Johansen looks at it here

https://evil365.com/intune/RemoteHelp-UnattendedAccess/

OS Compliance is great in theory, but it’s such an overhead most people just end up with a minimum OS version which went end of life 5 years ago. What if there was a way to automate it? You’re in luck, Jeroen Burgerhout has you covered here

Jeroen Burgerhout ☁️ | MVP

Automating Intune OS Version Compliance with Azure Automation

Anyone managing Intune compliance policies across iOS, macOS, Windows, and Android already knows this one. Apple, Google, or Microsoft ships a new major OS version, and now someone has to go through every compliance policy and every conditional launch setting in every App Protection Policy and bump…

Read more

2 months ago · 2 likes · 1 comment · Jeroen Burgerhout ☁️ | MVP

McAfee remains a nightmare on your OEM images and it feels like a constant battle to remove it. Kevin Malinoski has an updated post on removing it with Intune here

https://malinoski.me/2026/08/25/mcafee-the-shadow-it-that-ships-from-the-factory-and-how-to-remove-it-with-intune/

Next, after some thorough testing, Niall Brady gives some final thoughts on Windows 365 reserve

https://www.niallbrady.com/2026/08/27/final-thoughts-on-windows-365-reserve/

On the subject of Windows 365, Jörgen Nilsson looks at what to do if you need to preserve a machine for an investigation here

https://ccmexec.com/2026/08/windows-365-placing-a-cloud-pc-under-review/

Sander Rozemuller covers how to troubleshoot a device without a compliance policy assigned in this post

https://rozemuller.com/why-does-this-intune-device-have-no-compliance-policy-assigned/

Video Content

Now for the video content, starting with a look at how to review, manage and remediate your security vulnerabilities using Intune and MDE from Chander Mani Pandey

A regular thing I hear is people not wanting to use Defender and Intune because they don’t want to rely on just one vendor. Learn why this isn’t something you should worry about here from Jonathan Edwards

Jonathan also looks at the upcoming end-of-life of the memberof attribute in Entra dynamic groups

Microsoft Content

As mentioned earlier, we start this weeks Microsoft news with the official announcement of Unattended Support for Remote Help on Windows from Rodolfo Bermudez and Kara Wang

https://techcommunity.microsoft.com/blog/IntuneCustomerSuccess/remote-help-on-windows-unattended-support-with-remote-sign-in-is-here/4549772

If you’re using Managed Home Screen and noticed the exit PIN has gone missing, here is the fix from the Intune Support Team

https://techcommunity.microsoft.com/blog/IntuneCustomerSuccess/support-tip-restore-the-managed-home-screen-exit-pin/4549102

Some exciting news, device association for device prep is now here! Learn all about it here with Maggie Dakeva

https://techcommunity.microsoft.com/blog/IntuneCustomerSuccess/introducing-device-association-for-windows-autopilot-device-preparation/4550603

That’s it for this week, have a tremendous weekend!

Community Content

We start this weeks newsletter with a useful post for those of you on E5 licensing. Now you get Remote Help for free, just what can it do for you? Find out here with Simon Skotheimsvik

https://msendpointmgr.com/2026/08/14/intune-remote-help-the-deep-dive-now-that-its-included-in-your-e5/

With the upcoming retirement of SMS MFA, learn how to modernize your whole Entra auth flow in this comprehensive post from Kenneth van Surksum

https://www.vansurksum.com/2026/08/14/from-ist-to-soll-a-field-guide-to-modernizing-entra-id-authentication/

We have part two of the excellent series on automating your AVD builds here from Michael Meier. This one covers installing applications into your new base image

https://mikemdm.de/2026/08/16/using-azure-image-builder-to-build-your-custom-vm-images-part-2/

On the subject of AVD, this guide from Niels Kok runs through using PowerShell to automate your AVD Hybrid deployments

https://www.nielskok.tech/powershellautomation/automate-avd-hybrid/

If you have ever wondered how to automate Win32 app creation using Graph, it is unexpectedly complicated. Learn exactly what is going on behind the scenes in this in-depth guide from Ben Whitmore

https://msendpointmgr.com/2026/08/16/win32-app-intune-powershell-graph/

Edge Extensions are rapidly becoming the browser toolbars of the early 2000s (hands up if you are old enough to remember those!). Fortunately you can at least monitor extensions using the free Edge Management UI. Learn how here from Jörgen Nilsson

https://ccmexec.com/2026/08/edge-management-service-extension-monitoring/

Many people excited about this one, using Properties Catalog to grab registry information from your devices remotely as covered here by Peter van der Woude

https://petervanderwoude.nl/post/collecting-windows-registry-data/

Do you really know what AI agents are running in your estate? If you’re not sure, this post from Dustin Gullett runs through how to use MDE to find out exactly what’s happening out there.

https://zerototrust.tech/discover-local-ai-agents-microsoft-defender-endpoint/

Using memberof is being deprecated in Azure so now is the time to check just where you are using it before your groups stop working. Find out more in this post from Driek Desmet

https://blog.interian.be/2026/08/18/microsoft-entra-memberof-retirement/

This post from Jeffrey Appel looks at how to use Defender Logging and hunting to look at what has changed across your environment

https://jeffreyappel.nl/auditing-microsoft-defender-and-intune-configuration-changes/#respond

Video Content

Now for the video content, starting with a method to bulk onboard your devices into MDE using Intune from Chander Mani Pandey

A script you should all be using for your autopilot devices to check they are ready to be deployed. Learn all about it here from Steve Weiner

Microsoft Content

Onto this weeks Microsoft content with a delivery optimization theme going on. We start with a look at the delivery optimization troubleshooting PowerShell module from Andy Rivas

https://techcommunity.microsoft.com/t5/windows-it-pro-blog/collecting-delivery-optimization-logs-the-easy-way/ba-p/4547884

If you haven’t yet configured Delivery Optimization, learn why you should in this post from Carlos Diaz and Jason Sandys

https://techcommunity.microsoft.com/blog/IntuneCustomerSuccess/configure-delivery-optimization-for-windows-to-save-bandwidth-and-speed-up-deplo/4547592

That’s all for this week, have an amazing weekend!

Next weeks newsletter will probably be scheduled, I’m over at a Robopack company event planning the exciting functionality we will soon be bringing to your favourite Intune companion apps! If I miss anything, I’ll make sure to include it in the week after.

Community Content

We start this week with two posts from Nicky De Westelinck, the first looking at all of the exciting new features for Android Enterprise Intune users.

https://www.nickydewestelinck.be/2026/08/07/whats-new-for-android-enterprise-in-microsoft-intune-2607-july-2026-highlights/

Nicky’s second post covers end-to-end integration of Samsung Knox E-FOTA and Intune, very useful for the no doubt many of you managing Samsung devices.

https://www.nickydewestelinck.be/2026/08/11/samsung-knox-e-fota-integration-with-microsoft-intune-complete-configuration-guide/

We finally have a better overview of the black box behind the sync button with the new Device Action Status. Find out more about it here with Craig Camacho

https://thedeploymentguy.co.uk/microsoft-intune-device-action-status/

A change which happened more quietly than expected. Microsoft are retiring the Windows 365 User Settings to move instead to Cloud PC Settings. If you are managing Windows 365 devices, check out this guide from Dieter Kempeneers to migrate them

https://kempeneers.eu/2026/08/08/windows-365-user-settings-are-being-retired-migrate-now/

If you are still managing AVD with golden images and want to move to something more modern, learn how to use Azure Image Builder in this first part of a new series from Michael Meier

https://mikemdm.de/2026/08/09/using-azure-image-builder-to-build-your-custom-vm-images-part-1/

For those of you deep in Graph, you’ll no doubt have noticed the new WAM option when connecting. Learn all you will ever need to know about it here with Ben Whitmore

https://msendpointmgr.com/2026/08/09/microsoft-graph-sdk-wam/

Next, Rahul Jindal looks at what the move to passwordless authentication means for your zero trust journey

https://rahuljindalmyit.blogspot.com/2026/08/microsoft-entra-makes-passwordless.html

With the removal of legacy auth methods in Entra, Jon Towles looks at how to transfer to passkeys in your tenant

https://mobile-jon.com/2026/08/11/farewell-sms-passkeys-are-the-new-standard-getting-ready-to-ditch-legacy-authentication-methods/

Another week, another change to the start menu (bring back Windows 95 list please). Fortunately Peter van der Woude shows how to customize the new folders using Intune here

https://petervanderwoude.nl/post/customizing-the-pinned-folders-in-start-layout/

Learn how to configure Autopatch with Windows 365 here from Jeroen Burgerhout

Jeroen Burgerhout ☁️ | MVP

Windows 365 Wednesdays - Windows 365 and Windows Autopatch

In the previous part of this series, we looked at managing Cloud PCs after they have been provisioned…

Read more

3 months ago · Jeroen Burgerhout ☁️ | MVP

This post from Dustin Gullett takes a deep dive into the Intune Vulnerability agent included in your E5 SCUs

https://zerototrust.tech/intune-vulnerability-remediation-agent-what-it-really-does/

Video Content

Now for the video content starting with Dean Ellerby testing M365 Copilot Cowork to see how it works and more importantly what it costs here

Steve Weiner covers how to configure and use PIM in Entra here

Microsoft Content

This weeks only Microsoft content comes from Lia Vargas and covers how to use how to use Windows device recovery

https://techcommunity.microsoft.com/blog/windows-itpro-blog/windows-device-recovery-in-2026-a-guide-for-it-pros/4541207

That’s all for this week, have a great weekend!

Community Content

Have you ever wanted to automatically generate filters for every Windows version including dealing with those which just don’t match the standard numbering scheme? You’re in luck, check out this post and script from Ben Whitmore

https://msendpointmgr.com/2026/08/01/intune-assignment-filters-windows-builds/

If you have seen the new AI enabled cloud PC report in the portal and want to know how it’s working in Graph, try this post from Andrei Shchetkin

https://shchetkin.dev/reverse-engineering-the-intune-portal-the-ai-enabled-cloud-pc-report/

This post from Jan Mulder digs deep into the new Shadow AI detection now in preview and how it all works

https://wolkenman.wordpress.com/2026/08/03/intune-and-ai-shadow-ai-detection/

macOS has finally caught up with Windows compliance and now supports custom compliance. This post from Somesh Pathak runs through how to use it

https://intuneirl.com/custom-compliance-comes-to-macos-going-beyond-the-built-in-policy/

Entra password policies are, well, basically non-existent. So what do you do if you want to force password restrictions? Enter device lock policies within Intune as covered in-depth here by Nicky De Westelinck

https://www.nickydewestelinck.be/2026/08/04/strengthening-endpoint-security-with-device-lock-policies-in-microsoft-intune/

Jannik Reinhard looks at all of the functionality currently available in Security Copilot

https://jannikreinhard.com/security-copilot-agents-intune/

Passkey is soon to be the preferred auth method and the end of SMS as MFA. Learn more about this change here from Shehan Perera

https://emsroute.com/2026/08/06/system-preferred-authentication-and-passkeys/

Video Content

Now for this weeks video content, starting with part 1 in a new series from Manish Bangia covering Intune Compliance policies. This one looks at the baseline features in a Windows Compliance Policy

Microsoft Content

Onto this weeks Microsoft content with the all-important Windows News You can Use for July from Chris Morrissey

https://techcommunity.microsoft.com/t5/windows-it-pro-blog/windows-news-you-can-use-july-2026/ba-p/4543588

Windows 10 Enterprise LTSC 2021 is going EOL in January. Find out what this means for you here with Jason Leznek

https://techcommunity.microsoft.com/blog/windows-itpro-blog/plan-for-windows-10-enterprise-ltsc-2021-end-of-support/4539866

That’s all for this week, have a great weekend!

A slightly quieter week this week for content, hopefully everyone is enjoying the weather and the holidays (or busy trying to entertain bored children). We do have an exciting Microsoft announcement at the bottom though.

Community Content

We start this week with a look at the new Web Based enrollment for Android Work Profile devices here from Rahul Jindal

https://rahuljindalmyit.blogspot.com/2026/07/demystifying-android-web-based.html

We now have three posts from Joey Verlinden who has had a very busy week! The first post covers an always tricky one to manage, removable devices. Learn how to use Device Control to properly manage what people can and can’t do with them

https://www.joeyverlinden.com/block-access-to-removable-storage-while-allowing-exceptions-device-control-to-the-rescue/

The second post is an update to the excellent Conditional Access Framework which is a great way to get your tenant secured quickly and easily

https://www.joeyverlinden.com/conditional-access-framework-6/

Joey also has a new tool to visualise your existing CA policies and also deploy a secure baseline rapidly.

https://www.joeyverlinden.com/conditional-access-visualizer-deployer-tool/

If you’re running E5, you now have access to the Security Copilot Agents (especially with your free SCUs). In this post, Michael Frank looks at the Change Review agent

https://michaelsendpoint.com/intune/SecurityCopilot/ChangeReviewAgent.html

If you’re doing anything in Graph, this is one you definitely need to be aware of. Multi-Admin approval now also hits your Graph calls. Learn what it means for you in this post from Jannik Reinhard

https://jannikreinhard.com/intune-multi-admin-approval-graph-api/

For those of you running Global Secure Access, this post from Dustin Gullett is a must-read. It shows how you can drop your logs, review, monitor and make sure everything is running as expected

https://zerototrust.tech/global-secure-access-sentinel-workbook/

Microsoft are shortly going to retire SMS and Voice calls for MFA. Find out what this means to you, who is effected and your options in this post from Thomas Marcussen

https://blog.thomasmarcussen.com/entra-sms-voice-mfa-retirement-playbook/

Following on from the initial look at Windows 365 Reserve, Niall Brady continues testing after the initial 10 day window has passed

https://www.niallbrady.com/2026/07/30/following-up-on-windows-365-reserve/

If you have noticed a new OneDrive Photos app appearing on your devices which only works with a personal OneDrive account (well done Microsoft), here is a remediation script from Nicky De Westelinck to remove it (I’ve also added it to my debloat script, thank you Nicky!)

https://github.com/nickydewestelinck/MicrosoftIntune/tree/main/Scripts/Remove-OneDrivePhotos

Video Content

Now onto the video content, starting with a look at why you should be using Autopilot and how to do so properly in this video from Jonathan Edwards

Jonathan also covers one I mention a lot, why trusting your Office IP to exclude from MFA is a bad idea

Learn how to configure and deploy Remote Help using the Enterprise App Catalog in this video and post (below) from Mark Oldham

https://controlaltdeletetechbits.co.uk/microsoft-remote-help-intune/

We also have the first two episodes of a full Defender for Endpoint course from Chander Mani Pandey starting with an overview of what it is

Followed by an onboarding guide for the different platforms

Learn how Intune Device Intentory works in this video from Steve Weiner

Microsoft Content

Onto this weeks Microsoft content, starting with a look at the new Export API for bulk jobs from Daniel Gerrity

https://techcommunity.microsoft.com/blog/IntuneCustomerSuccess/from-hours-to-minutes-rethinking-microsoft-intune-compliance-reporting-with-the-/4540554

A very exciting announcement, Registry Inventory is coming to Properties Catalog to quickly check reg keys on your devices. Learn more here from Madison Cooks

https://techcommunity.microsoft.com/blog/IntuneCustomerSuccess/registry-inventory-in-microsoft-intune-verifying-what%E2%80%99s-on-your-devices/4541312

That’s all for this week, have an amazing weekend!

Community Content

We start this week with the next 2 parts of the excellent Intune Agents series from Gerry Hampson with part 4 looking at the Vulnerability Remediation agent

http://gerryhampsoncm.blogspot.com/2026/07/my-first-look-at-intune-agents-part4.html

And part 5 looking at obtaining agents from the marketplace in the Microsoft Security Store

http://gerryhampsoncm.blogspot.com/2026/07/my-first-look-at-agents-part5-security.html

This remediation from Jorge Suarez will help keep your VS Code extensions managed

https://jorgeasaur.us/manage-vs-code-extensions-with-intune-remediations

We also have two posts from Michael Meier starting with a quick notice about a Microsoft rename (that’s unusual), but worth checking in case it hits your filters

https://mikemdm.de/2026/07/10/windows-365-frontline-was-renamed-to-windows-365-flex/

Michael also looks at how AVD Hybrid unlocks VDI on all hypervisors

https://mikemdm.de/2026/07/19/avd-hybrid-allows-for-vdi-on-any-hypervisor/

For those of you with SCUs to use, Michael Frank looks at the CA Agent now included in Security Copilot

https://michaelsendpoint.com/entra/SecurityCopilot/CAAgent.html

Niall Brady looks at the new Windows 365 Reserve option available now (a very useful one for everyone)

https://www.niallbrady.com/2026/07/13/first-looks-at-windows-365-reserve/

Learn how to use Cloud PKI and Cert Based Authentication here with Nicky De Westelinck

https://www.nickydewestelinck.be/2026/07/15/goodbye-passwords-certificate-based-authentication-on-windows-with-cloud-pki-in-microsoft-intune/

Nicky also looks at certificate based authentication for your Android devices

https://www.nickydewestelinck.be/2026/07/23/beyond-passwords-certificate-based-authentication-for-android-enterprise/

Some very important news for anyone in the EU, you can now configure the settings to automatically accept SSO permissions which will make things so much better for your users. Many people covering this one, starting with Jóhannes Geir Kristjánsson, setting it via Remediation

https://johannesblog.com/2026/07/15/automatically-accept-sso-permissions/

Joey Verlinden also has a script here to set the required registry key

https://www.joeyverlinden.com/the-long-awaited-dma-sso-admin-controls/

Jan Bakker covers the requirements and some further background here

https://janbakker.tech/admin-control-for-sso-prompts-in-windows-finally-an-off-switch/

If you want to know exactly what’s happening, we have a great deep dive here from Rudy Ooms

https://call4cloud.nl/continue-to-sign-in-prompt-autoacceptssopermission/

Joery Van den Bosch also looks at how this helps different user personas and also includes a remediation to deploy it

https://intunestuff.com/2026/07/17/admin-control-for-sso-prompts/

The final SSO post comes from Mads Johansen with the easier solution, Settings Catalog

https://evil365.com/intune/Microsoft-EU-SSOHassle/

There is nothing worse than sitting down at a new device and finding the @ is on the wrong key, or the £ is missing altogether. Fortunately, this remediation from Alex Durrant will help you configure regional settings on your devices

https://modernworkspacehub.com/intune-regional-settings-proactive-remediation/

We have a new web based tool from Simon Hartmann Eriksen to quickly inspect MSI packages within the browser

https://www.simsenblog.dk/2026/07/20/web-tool-msiinfo-com/

We have a new tool from Mark Orr as well, this one to quickly assign Access Packages to your users

https://medium.com/@markhunterorr/access-packages-on-demand-assignment-from-powershell-3fdcfacd803e

If you are managing macOS devices, the lack of naming templates may be causing you issues. Fortunately Tobias Eriksson has a solution for you here

https://tob-it.se/how-to-setup-a-device-naming-template-for-macos-in-intune/

On the subject of macOS, Anthon N has created a very useful onboarding toolkit available here

https://github.com/SuperDOS/macos-otk

If you’re managing Windows Kiosk devices, this remediation from Dustin Gullett will be an absolute lifesaver

https://getrubix.com/blog/find-blocked-kiosk-apps-at-scale-with-intune-remediations

If you have E5 licensing and are considering testing EAM, have a look at this post from Jannik Reinhard

https://jannikreinhard.com/intune-enterprise-app-management-auto-update/

If you are using Windows 365 Link devices and need to do a bare metal recovery, try this guide from Dieter Kempeneers

https://kempeneers.eu/2026/07/23/windows-365-link-bare-metal-recovery/

Video Content

Now for the video content starting with two from Chander Mani Pandey, the first assists with troubleshooting, showing where to find the last device check-in time

The second video runs through the Enterprise App Management functionality now available with your E5 licenses

If you are receiving a lot of sign-in requests for your account which are not from you, this video from Dean Ellerby is well worth watching

Learn all about the new Device View in Intune here with Steve Weiner

Also learn how to enable EAM Auto updates in this video from Steve

If you’ve ever attempted Platform SSO on macOS, it’s not as easy as it looks (if you were at Experts Live UK, you know that better than others), fortunately Saurabh Sarkar has created a full in-depth video walkthrough here

Microsoft Content

Onto the Microsoft content we go, starting with the official announcement for the SSO management from Justin Ploegert

https://techcommunity.microsoft.com/t5/windows-it-pro-blog/now-available-admin-control-for-sso-prompts-in-windows/ba-p/4534613

Find AI tools on your macOS devices using MDE by following this guide from Vytas Boyev

https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/hunting-local-ai-tools-on-macos-with-microsoft-defender-for/ba-p/4536965

Chris Morrissey explains all of the Windows updates servicing options here

https://techcommunity.microsoft.com/t5/windows-it-pro-blog/understanding-windows-monthly-updates-servicing-explained/ba-p/4532290

That’s all for this week, have a great weekend!

Community Content

For those of you managing Apple devices, this one is worth reading! Enrollment time grouping is now GA to help speed everything up when deploying a new device. Learn more here from Scott Breen

https://www.linkedin.com/pulse/your-apple-fleet-shouldnt-wait-hours-its-apps-when-enrolling-breen-6ikac/

If you have E5 licensing and want to know more about the Enterprise App Management you now get for free, check out this in-depth post from Thomas Marcussen

https://blog.thomasmarcussen.com/intune-eam-auto-update-enterprise-app-catalog/

Another post covering customizing the start menu on your shared devices from Peter van der Woude, this one looks at the power options and how to hide them

https://petervanderwoude.nl/post/customizing-the-power-options-in-start-layout/

There is a new private preview for AVD to allow you to redirect certain items from the local machine depending on the device/user meeting criteria in CA. You can find out more in this post from Niels Kok

https://www.nielskok.tech/active-directory/avd-context-based-redirections/

Those E5 licenses now also give you access to Security Copilot and this post from Michael Frank covers how to get started with it

https://michaelsendpoint.com/security/SecurityCopilot/SecurityCopilot.html

If you are managing developer devices and missing the Dev Boxes of old, there is now a Developer configuration for Windows 365 available in the gallery as covered here by Niall Brady

https://www.niallbrady.com/2026/07/03/first-looks-at-windows-365s-gallery-image-with-developer-configuration-preview/

Next, Jeroen Burgerhout looks at the different options available for managing your Windows 365 machines

https://www.burgerhout.org/windows-365-wednesdays-understanding-cloud-pc-settings/

Alex Durrant has created a community fork of the AVD Monitoring Baseline with many exciting improvements, one to configure if you manage AVD

https://modernworkspacehub.com/avd-monitoring-baseline-community-edition/

Users will be users and sometimes they need items in the system tray with the correct icons. This remediation from Remy Kuster helps bridge the gap

https://www.iamsysadmin.eu/mobile-device-managment/intune/pin-icons-in-system-tray-with-intune-remediation-script/

This post from Nicklas Olsen shows how to use Properties Catalog to grab more information about your applications

https://www.learnintune.net/properties-catalog-collect-app-information/

Video Content

Now for this weeks video content, starting with a look at the goodies you now get in your E3 and E5 licenses from Chander Mani Pandey

Now Device Query is available on E3 and E5 licenses, Steve Weiner covers how to use it here

Microsoft Content

On to this weeks Microsoft content starting with the news that Windows backup will now be on by default as covered here by Miranda Leschke

https://techcommunity.microsoft.com/t5/windows-it-pro-blog/windows-settings-backup-becoming-a-new-resilience-baseline/ba-p/4530757

If you haven’t yet tried Windows 365 boot, this guide from Michael Hildebrand will set you on your way

https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/windows-365-boot/ba-p/4533696

This post from the Intune Support Team runs through patching strategy to rapidly deal with the ever-growing vulnerabilities

https://techcommunity.microsoft.com/blog/IntuneCustomerSuccess/build-a-patch-strategy-for-today%E2%80%99s-threat-pace-with-microsoft/4535115

RDP Multipath is now GA for AVD and W365 using TCP as covered here by Rinku Dalwani

https://techcommunity.microsoft.com/blog/windows-itpro-blog/rdp-multipath-with-redundant-tcp-is-now-generally-available-for-windows-365-and-/4534610

Discover how to use Win365 for agents to safely control how your agents operate here from Aarthi Sukumar

https://techcommunity.microsoft.com/blog/windows-itpro-blog/windows-365-for-agents-a-secured-execution-environment-for-ai-agents/4529336

That’s all for this week, have an amazing weekend!

But we aren’t here to talk about the weather, that’s purely for small talk in England, you’re here for the incredible content from this week

Community Content

When dealing with Windows 365 machines, it used to be a case of redirect or don’t redirect local items. This was never ideal, especially when using it from a managed device to begin with. Fortunately you can now use context-based redirection to add requirements before redirecting. Learn more in this comprehensive post from Dominiek Verham

https://dominiekverham.com/using-context-based-redirections-for-windows-365/

Multi-admin approval (if turned on) now also impacts Microsoft Graph actions, although you can exclude Enterprise apps. This script and post from Sander Rozemuller digs into it further and can show you what the impact will be in your environment

https://rozemuller.com/avoid-automation-breaks-with-intune-multi-admin-approval/

If you want some control over your AI agents with MDE, check out this post from Jannik Reinhard

https://jannikreinhard.com/2026/06/26/defender-ai-agent-runtime-protection/

With Intune Suite now hitting a lot of tenants, if you are looking to try Remote Help, follow this guide from Nicky De Westelinck

https://www.nickydewestelinck.be/2026/06/29/configuring-remote-help-in-microsoft-intune-a-step-by-step-guide/

Nicky also looks at the new Android Enterprise features added in the 2606 Intune release here

https://www.nickydewestelinck.be/2026/07/01/whats-new-for-android-enterprise-in-microsoft-intune-2606-june-2026-highlights/

If you are using multi-admin approval, you have probably noticed you need to live in the Intune portal to see when you have approvals awaiting your consent. Mark Orr has built a solution here to alert you when there are actions awaiting your approval

https://medium.com/@markhunterorr/multi-admin-approval-maa-a-missing-feature-notifications-4b9b5220e2ea

Move your personally owned work profile Android devices to Android Management API in this guide from Peter van der Woude

https://petervanderwoude.nl/post/getting-started-with-android-enterprise-personally-owned-devices-with-work-profile/

We now have a few useful community scripts, starting with a script to create USB sticks for bare-metal imaging from Anthon N

https://github.com/SuperDOS/Intune-USB-Creator

This script from Mert Özsoy creates remediation scripts to uninstall Win32 apps

https://github.com/mertozsoy/IntuneWin32AppUninstall

A very useful script (and descriptive post) from Alex Durrant to quickly rename and change the description on your Intune policies in bulk

https://modernworkspacehub.com/intune-bulk-rename-policies-tool/

If you are picking between Autopilot and Autopilot Device Prep, or just want to learn more about Autopilot in general, try this post from Lewis Barry

https://conditionalaccess.uk/blog/should-i-use-autopilot-device-preparation/

On the subject of Autopilot, for those wanting to safely force updates during ESP, try this script from Somesh Pathak

https://intuneirl.com/forcing-the-windows-updates-during-autopilot-pre-provisioning-esp-technician-phase/

Learn all about win32 apps and intunewin files in this post from Gannon Novak

https://smbtothecloud.com/win32-app-deep-dive-whats-inside-an-intunewin-file-and-how-it-gets-into-intune/

Next, we have the third part of the EPM series from Mattias Melkersen Kalvåg and Simon Skotheimsvik, this one looking at how to create your file rules

https://msendpointmgr.com/2026/07/03/epm-part-3-writing-intune-endpoint-privilege-management-rules-for-the-real-world-file-hash-certificate-and-when-each-one-is-the-wrong-choice/

Video Content

Now for this weeks video content and we start with some tips on how to get your customers/employers to uplift licenses for Intune licenses from Jonathan Edwards

Jonathan also looks at the best way to provide admin access to your customers

We also have the latest secure boot AMA from Arden White, Roy Sasabe and Scott Shell

Learn how to setup Intune Remote Help with your new licenses in this video from Steve Weiner

Microsoft Content

Now for the Microsoft content, starting with a guide on how to enable autofill after using platform SSO on macOS from Chris Kunze

https://techcommunity.microsoft.com/blog/IntuneCustomerSuccess/streamlining-macos-security-automatically-enable-autofill-after-platform-sso-reg/4531908

The all-import Windows News you can Use from Chris Morrissey

https://techcommunity.microsoft.com/t5/windows-it-pro-blog/windows-news-you-can-use-june-2026/ba-p/4532288

That’s it for this week, have a great weekend!

The key announcement this week, down in the Microsoft news, is preparing for 26H2 release, time to get testing. Plenty of great community content this week too

Community Content

We start this week with a guide from Daniel Gebler on how to reset your machines, no matter what state they were in with a custom recovery image using OSDCloud

https://danzi.blog/reset-pc-with-a-custom-recovery-image-part-i/

With part 2 covering how to create a recovery partition automatically

https://danzi.blog/reset-pc-with-a-custom-recovery-image-part-ii/

More start menu adjustments for you to check out in this post covering the account settings options from Peter van der Woude

https://petervanderwoude.nl/post/customizing-the-account-settings-in-start-layout/

If you are looking to add an extra layer of protection against any AI agents running on devices, try this post from Jeffrey Appel

https://jeffreyappel.nl/configure-ai-agent-runtime-protection-preview-with-microsoft-defender-for-endpoint/

Enrolling personal devices with work profiles on Android just became a whole lot easier thanks to the new web-based enrollment feature. Learn more in this comprehensive post from Nicky De Westelinck

https://www.nickydewestelinck.be/2026/06/22/simplifying-android-enrollment-web-based-enrollment-for-personally-owned-work-profiles-in-intune/

Next, we have part two of the EPM guide from Simon Skotheimsvik and Mattias Melkersen Kalvåg. This one looks at how to get started in audit mode

https://msendpointmgr.com/2026/06/22/epm-part-2-before-you-remove-local-admin-how-to-use-intune-endpoint-privilege-management-audit-mode-to-understand-your-environment/

Jan Mulder is quick off the mark, looking at Microsoft Scout, how to install it and more importantly, how to manage it with Intune

https://wolkenman.wordpress.com/2026/06/21/intune-and-ai-microsoft-scout-with-intune-part-i/

Learn how to deploy the Claude Desktop app using Intune in this post from Jóhannes Geir Kristjánsson

https://johannesblog.com/2026/06/21/deploying-claude-desktop-with-intune/

If you are starting out in Intune, want to double check your tenant, or are working as an Intune consultant, this checklist from Lewis Barry is definitely worth a look

https://conditionalaccess.uk/blog/m365-tenant-security-checklist/

This guide from Jannik Reinhard is one everyone should bookmark when troubleshooting Intune, highly recommended

https://jannikreinhard.com/2026/06/23/intune-troubleshooting-guide/

As mentioned earlier, it’s time to start planning for 26H2, look at your deployment options in this post from Thomas Marcussen

https://blog.thomasmarcussen.com/windows-11-26h2-upgrade-autopatch-pilot-to-production/

Video Content

Onto the video content and we start with a useful one if you’re on E3 or E5, how to deploy certs with Cloud PKI from Dean Ellerby

Microsoft Content

Now for this weeks Microsoft and we start with the all important initial announcement of 26H2 from Jason Leznek

https://techcommunity.microsoft.com/t5/windows-it-pro-blog/get-ready-for-windows-11-version-26h2/ba-p/4529367

We finally have a Graph endpoint to grab all Enterprise App Management apps and export them! Learn how in this post from Joe Lurie

https://techcommunity.microsoft.com/blog/IntuneCustomerSuccess/exporting-all-microsoft-intune-enterprise-app-management-catalog-apps-to-csv-usi/4529579

Learn how to use Privacy Preferences Policies on macOS in this post from Chris Kunze

https://techcommunity.microsoft.com/blog/IntuneCustomerSuccess/how-to-configure-macos-privacy-preferences-policy-control-pppc-using-the-intune-/4530406

Next, Nuno Costa covers the best way to deploy your secure boot certificates

https://techcommunity.microsoft.com/blog/windows-itpro-blog/best-practices-for-deploying-secure-boot-certificate-updates/4529884

Point in Time restore for Win 11 is now GA and you can find out more about it here from Lia Vargas

https://techcommunity.microsoft.com/blog/windows-itpro-blog/point-in-time-restore-for-windows-11-is-now-generally-available/4508101

Windows admin actions are undergoing changes to increase hardening. This is one you will want to read by Dashmeet Ajmani

https://techcommunity.microsoft.com/blog/windows-itpro-blog/hardening-administrative-actions-what-it-pros-need-to-know/4503956

A new Windows 365 monitoring and reporting platform is now available in preview as covered here by Doug Cooms

https://techcommunity.microsoft.com/blog/windows-itpro-blog/introducing-the-new-windows-365-monitoring-and-reporting-platform-%E2%80%94-now-in-publi/4505355

After WWDC26, you might be wondering which exciting Apple features are going to be supported by Intune. Fortunately this post from Benjamin Flamm and Iris Yuning Ye runs through what is coming

https://techcommunity.microsoft.com/blog/IntuneCustomerSuccess/microsoft-intune-and-apple-platform-updates-what-to-expect-after-wwdc-2026/4531058

That’s all for this week, have an incredible weekend!

Community Content

Before we delve into the world of Intune suite, Brady Widener has an excellent guide covering app packaging for your macOS devices here

EdTech IRL

App Packaging 101 on MacOS

With the release of the Macbook Neo, many SysAdmins (like myself) are trying to level up on their MacOS skills in preparation. Over the last couple of months, I’ve been doing a deep dive on MacOS app packaging and wanted to share my notes with you! Enjoy…

Read more

5 months ago · 4 likes · Brady Widener

Now we can start with the Intune suite posts and first up is Jörgen Nilsson covering Endpoint Privilege Management (EPM)

https://ccmexec.com/2026/06/microsoft-intune-endpoint-privilege-management-overview/

Florian Salzmann also looks at EPM and how it compares to some of the competitors here

https://scloud.work/intune-endpoint-privilege-management-vs-the-alternatives/

Mattias Melkersen and Simon Skotheimsvik have a whole series covering EPM with part 1 available here

https://msendpointmgr.com/2026/06/15/epm-part-1-the-end-of-local-admin-how-intune-endpoint-privilege-management-solves-a-problem-it-has-lived-with-for-decades/

Another useful tool, especially with unattended access now included (not so great for iOS users though) is Remote Help, covered in-depth here by Gerry Hampson

http://gerryhampsoncm.blogspot.com/2026/06/you-have-intune-remote-help-already-you.html

Nicklas Ahlberg also looks at how to use Remote Help from within the tenant

https://www.rockenroll.tech/2026/06/14/microsoft-intune-remote-help-my-overview/

My favourite part of the suite, Advanced Analytics. This set of reports gives you the ability to really improve the user experience and be proactive fixing issues, your users will love you! Jannik Reinhard looks at what it can do and how it compares to other options here

https://jannikreinhard.com/2026/06/13/intune-advanced-analytics-market-comparison/

Sander Rozemuller looks at some of the key reports to watch for when using Endpoint Analytics here

https://rozemuller.com/microsoft-intune-advance-analytics-more-than-endpoint-analytics/

Panu Saukko digs into Device Query and Multi-Device query here, also included with Advanced Analytics for even granular data

https://www.linkedin.com/pulse/using-intune-suite-advanced-analytics-solve-issues-faster-panu-saukko-0qcsf/

This post from Jeroen Burgerhout looks at the suite as a whole and the value it offers for both Intune and W365

https://www.burgerhout.org/windows-365-wednesdays-windows-365-x-intune-suite-looking-beyond-the-feature-list/

Joery Van den Bosch also looks at everything you now get in both your E3 and E5 licenses

https://intunestuff.com/2026/06/19/microsoft-intune-suite-m365e5-e3/

Not Intune Suite, but another useful product in your license which many don’t use is Microsoft Defender. This post from Lewis Barry looks at why it should be your AV of choice

https://conditionalaccess.uk/blog/microsoft-defender-is-good-enough/

If you are using App Control policies and want to take your security to the next level, you can sign the policies themselves to stop anyone tampering with them. Learn how here with Niels Kok

https://www.nielskok.tech/intune/signed-policies-for-app-control/

Next, Roman Padrun confirms what many MVPs have been telling you for years, why you shouldn’t be using Security Baselines

https://www.cloudcook.ch/intune-security-baselines-why-your-tenant-is-probably-still-living-in-2023/

If you now have access to device query, Damien Van Robaeys has some useful KQL queries here to look for old BIOS versions across the estate

https://www.systanddeploy.com/2026/06/monitor-intune-devices-with-old-bios.html

If you are using an Entra account with your multi-app kiosk, this custom OMA-URI policy will stop any notifications about the account from appearing. Peter van der Woude runs through configuring it here

https://petervanderwoude.nl/post/turning-off-account-notifications-in-start-and-multi-app-kiosk-mode/

Find out what Intune release 2605 brings for Android Enterprise in this post from Nicky De Westelinck

https://www.nickydewestelinck.be/2026/06/17/whats-new-for-android-enterprise-in-microsoft-intune-2605-may-2026-highlights/

I am a big fan of Windows 365 reserve, it’s like an insurance policy for your users productivity. If you want to know more about how it works and what it costs, try this post from Dieter Kempeneers

https://kempeneers.eu/2026/06/17/windows-365-reserve-explained-setup-licensing-and-limitations/

T-Bone has updated the excellent drive mapping script so it doesn’t hit your domain controllers quite as heavily, check it out here

https://www.tbone.se/2026/06/17/t-bone-map-drives-fixed-the-problem-with-high-load-on-dc/

Video Content

Now for this weeks video content and we start with one which should be the first thing you do on a new tenant, block personal devices. Learn how here with Jonathan Edwards

The latest Intune for MSPs meetup is now live and looks at macOS management with Andy Rostad, Lior Bela and Ugur Koc

Dean Ellerby looks at what is soon to be included in your E3 and E5 subscription here

Learn how to protect company data on unmanaged devices using app protection in this video from Steve Weiner

Microsoft Content

Onto the Microsoft content starting with information about the new Windows Ready Print functionality from Ellie Sekine

https://techcommunity.microsoft.com/t5/windows-it-pro-blog/introducing-windows-ready-print-and-modernized-driver-selection/ba-p/4527563

Learn more about the security behind enterprise app management in this post from Joe Lurie

https://techcommunity.microsoft.com/blog/IntuneCustomerSuccess/how-enterprise-app-management-secures-your-app-catalog-from-ingestion-to-device/4528361

The new Vulnerability Remediation agent is in public preview and you can find out more about it here from the Intune Support Team

https://techcommunity.microsoft.com/blog/IntuneCustomerSuccess/triage-vulnerabilities-with-the-vulnerability-remediation-agent-now-in-public-pr/4528646

We could certainly have used this post at Experts Live UK last week (if you were there, you’ll know), how to setup Platform SSO for your macOS devices from Naveen Akkugari and Michael Griswold

https://techcommunity.microsoft.com/blog/IntuneCustomerSuccess/deploying-platform-sso-for-pre-macos-26-with-microsoft-intune-lessons-learned/4521368

That’s all for this week, have a great weekend!

A special thanks to everyone who attended the Intune pre-day workshop:

This has been put together in trains, hotel rooms and conference rooms so whilst I think I have everything, if I have missed something, I will include it next week!

Community Content

We start this week with a guide on how to convert any Azure VM into a Windows 365 image using only Graph commands from Andrei Shchetkin

https://shchetkin.dev/windows-365-migration-graph-api/

For those of you running cloud native but still needing drive mappings, or the dreaded printers, this script from T-Bone should be the lifeline you are looking for.

https://www.tbone.se/2026/06/05/modern-drive-and-printer-mapping-for-cloud-native-windows-with-intune-and-powershell/

Autopatch does an excellent job of handling your updates carefully with the ring based system. But what if you could also use those rings for your own use? Follow this guide from Mads Johansen to learn how

https://evil365.com/intune/UsingAutopatch-RingSystem/

A treat for Lenovo users everywhere, the Lenovo Client Update (LCU) PowerShell module can now be used to get your drivers updated during pre-prov. No more handing out laptops needing driver updates! Learn more here from Philip Jorgensen

https://blog.lenovocdrt.com/autopilot-pre-provisioning-current-drivers-firmware-bios-lcu/

If you are (correctly) using Defender for Cloud Apps to block unsanctioned software but drowning in alerts, this post from Jeffrey Appel will help clear things

https://jeffreyappel.nl/disable-alert-generation-for-unsanctioned-apps-in-microsoft-defender-for-cloud-apps/

CMTrace was always a hidden secret, but this is 2026 and we have to move on (although you will never remove Doom from any of my machines!). Fortunately Florian Salzmann and Jannik Reinhard have created an excellent new cloud based alternative!

https://cmtrace.dev/

When running multi-app kiosks, you definitely don’t want your users accessing apps they shouldn’t be able to access and ideally they shouldn’t be able to see them either. This post from Peter van der Woude shows how to hide those pesky recommended apps

https://petervanderwoude.nl/post/hiding-the-recommended-section-from-the-start-layout-and-multi-app-kiosk-mode/

Whilst not Intune related (yet), keeping track with what’s new in macOS is always useful because it will reach Intune eventually. Look at what has been announced in this post from Simon Hartmann Eriksen

https://www.simsenblog.dk/2026/06/10/wwdc26-news-on-mac-management/

If you’re looking at expanding your IT book library, there is an excellent humble bundle here including my book:

https://www.humblebundle.com/books/ultimate-linux-sysadmin-bundle-books?hmb_source=&hmb_medium=product_tile&hmb_campaign=mosaic_section_1_layout_index_3_layout_type_threes_tile_index_1_c_ultimatelinuxsysadminbundle_bookbundle

Video Content

Now for this weeks video content with a look at some exciting new settings available in Settings Catalog from Craig Camacho

Microsoft Content

If you want to implement Zero Trust for your Intune admin roles themselves, follow this guide from Chris Vetter

https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/implementing-intune-rbac-and-scope-tags-for-zero-trust-and-least/ba-p/4506889

It’s a big day, MDOP is now out of support, it will be missed. Learn what this means for you here from Joe Lurie

https://techcommunity.microsoft.com/blog/IntuneCustomerSuccess/mdop-is-out-of-support-what-to-do-next-with-microsoft-intune/4526024

Learn how to use GitHub Copilot to analyze your Intune logs here with Stefan Röll

https://techcommunity.microsoft.com/blog/coreinfrastructureandsecurityblog/analyse-intune-diagnostics-logs-with-github-copilot/4527500

That’s all for this week, have an amazing weekend!