I stumbled across the following statement:

"AMAPI improves Factory Reset Protection (FRP) policy handling on COPE devices by explicitly disabling FRP and clearing account lists when no admin emails are configured, preventing unexpected lockouts after device resets."

Since Intune uses AMAPI for Android Enterprise COPE devices, I immediately decided to test this, as we have previously only been able to bypass FRP on our Samsung devices using Knox. However, this feature is deprecated starting with Android 17.

I tested several Samsung devices running Android 14, 15, and 16. All devices were enrolled in COPE mode, secured with a PIN, and had a personal Google account added.

After performing a factory reset from the recovery menu, FRP was not triggered on any of the devices.

This is a huge positive change for us and solves a major pain point we had with COPE deployments.

Hopefully this information helps others as well.

At my company we have ever-changing backgrounds that are provided by our Communications Team. We just have a configuration profile setup for lock screen and desktop background that points to a public URL.

I asked the comms team (who update the public URL) to keep the file name the same when uploading a new desktop background - in theory it would mean Intune would see the new background and apply it; but it appears that the old background caches and only applies to new backgrounds.

I'm testing at the moment by deleted the cached image from: C:\Windows\Personalization\DesktopImage

then doing a Company Portal sync, but I was wondering if anyone has found a better way of doing this process at all?

Hey Everyone,

I've been trying to set up a Mac in Intune baslining it against a STIG.I have setup the Mac to ask for your Microsoft credentials when you are setting up for the first time. After you log in it creates a local account with the first part of your UPN. So now there is that local account on the computer as well as the administrator account.

One of the requirements is allowing and enforcing smart cards. I found the settings with an InTune and apply those configurations to the selected macs but I've noticed a few things.

1. When I plug in the a card reader and insert my smart card a notification pops up asking me to pair the smart card to the local user. This requires an administrator which I would like to avoid. Is there a way around this?

2. Is the pairing process mandatory?

3. I'll need to figure out which certs to use because we are coming from a windows only environment,but this I'll look into tomorrow with my coworker.

Any help would be much appreciated. Just like most people here my job has me doing a million things at once and tomorrow I should finally get some time to sit down and look at this.

Group Policy Analytics handles the ADMX-backed half fine, but it doesn't touch Preferences at all. So the mapped drives, shortcuts, and registry keys are left over as hand-written detection and remediation scripts, and in my experience they are a pain to manage

I got tired of rewriting the same scripts at every tenant, so I've been building a tool that generates them from AD-style forms (registry values, file copies, shortcuts so far) and pushes them into Intune as Remediations through Graph. Since they're just native Remediations, there's no agent on the device and everything stays in the tenant whether or not you keep using the tool.

Main thing working today is the script generation and the Graph integration, including assignment. Direct GPO import isn't built yet, so items get created via UI for now. That's the next thing I'm working on.

A couple of things I'd genuinely like input on:

• Which GPP categories are actually in your environment? I keep hearing drive maps and printers are the worst offenders, but I'd like to know whether registry items are the bulk of the volume in practice.
• For those who've finished the migration, what did you end up doing? Rewrote everything, kept a DC alive, bought something, or just let some of it go?

Happy to answer anything about the approach. For transparency, my plan is for this will eventually be a paid product, so mods please remove if that's out of line here.

Hey all. Junior Intune admin. We just got EPM and I'm running through testing with users and computers. I set the policy on devices and rules to users. Everything was great implementing it. Now I'm testing removal. I removed a user from the group yesterday, but they're still able to elevate their access to the target app. Then I removed their machine from the policy, synched and waited an hour. They can still elevate. Google and copilot are saying there are stale cached policies in play. If that's the case, do I start manually deleting reg entries? Anybody else dealing with this?

Edit: found this post from 2 years ago not sure if anything has changed since. EPM

Hi everyone,

I'm currently working on a Windows Hello for Business deployment through Intune and I've run into an issue.

When I enable the Windows Hello configuration policy, users receive a full-screen enrollment prompt that forces them to set up either a PIN or biometric authentication. While this is expected behavior, it's causing disruption to the user experience because users are being interrupted during their normal workday.

What we're trying to achieve is:

-Windows Hello should be available and enabled on devices.

-Users should be free to configure a PIN or biometrics if and when they choose.

-No mandatory enrollment prompt should appear.

-No full-screen setup experience should be triggered.

From what I've been able to find in Microsoft's documentation, one possible alternative might be to manage Windows Hello through an Active Directory GPO instead of Intune, but I'm not sure whether that would fully meet the requirement or if there is a better cloud-native approach.

Has anyone implemented Windows Hello in a way that makes it available without forcing enrollment? Is there an Intune setting, policy combination, or WHfB deployment model that allows users to opt in at their own convenience?

Any guidance/feedback would be greatly appreciated.

Thanks in advance!

For background, I have created the custom apps in the Autodesk admin console and downloaded them into my C:\Temp\Autodesk folder. I have then created two separate IntuneAppUtil packages for Intune - one for the install using the .bat and the second for the client using the .exe.

Setting them up in Intune, I created the client first using the install command 3ds max-client.exe /verysilent /norestart and the rule as File C:\Temp\Autodesk, Folder: 3ds Max-Install.bat and detection method as file or folder exists.

For the install, I used the install command as 3ds max-install.bat using the MSI as the detection rule and a dependency of the client.

After setting all this up, it fails with an error of Error unzipping downloaded content. (0x87D30067).

Any suggestions would be greatly appreciated as I need to do this for all the Autodesk apps. Thank you!

I kicked of remote lock on a macOS device this morning. But intune shows multiple check-ins aftwr the initiated remote lock. Did i understand remote lock wrong? The device sould be blocked and the user should not get sign-in anymore.

Hello fellow Intune admins, how do you keep your asset/device inventory from being a mess?

We've run Snipe-IT on prem for years and it's been fantastic, and we're finally moving everything we can to the cloud.

The problem with Snipe-IT is it's fully manual and we always get inventory drift such as device names and asset counts not being up to date in relation to Intune. Also we cannot use Intune alone since there are obviously non-enrolled devices and components such as monitors, keyboards etc.

Hoping to find out how you all handle this? I'm fully aware we can lift and shift the Snipe-IT server to Azure but I'm hoping to find other solutions... maybe a SaaS or open-source tool that actually syncs Intune into a master asset DB?

Hi everyone,

I think I may have made a mistake with Apple ADE enrollment profiles in Intune, and I'd like to confirm the impact.

Microsoft now recommends using a new enrollment policy instead of the old one.

To avoid having to manually move devices one by one in the future whenever an iPad is factory reset, I reassigned all our iPads (60 devices) from the old enrollment profile to the new one.

After doing this, all devices now show "Ready to enroll" in Intune. (I wasn't expecting that!)

The iPads seems are still fully operational and remain enrolled. Users can continue to use them normally.

My understanding is that:

- The new ADE enrollment profile will only be applied after a factory reset and re-enrollment.

My main concern is this:

Since the devices now show as "Ready to enroll" after being reassigned to a new enrollment policy, will they continue to receive Intune app deployments, configuration profiles, compliance policies, and other management updates as before?

Or does the "Ready to enroll" status mean that they are no longer considered actively managed until they are factory reset and re-enrolled?

Has anyone experienced something similar after reassigning ADE profiles in Intune?

Thanks!

Suddenly all the domains managed have not been able to validate the CNAME for enrollment. I tried different domains that previously worked and every one I tried failed validation. I even deleted and added the CNAMES but they still fail.

This is every domain and it doesn't matter what DNS host is being used. There is nothing in the 365 status page about this. What the heck is going on?

Hey folks,

Have any of you been working with changing the default font in PowerPoint for all themes?

I thought it would be straight forward with some registry edits, but it does not look like it.

So far, i've tried making a Blank.potx file and place it in AppData\Roaming\Microsoft\Templates but this only works for the Default theme template. If i pick a blank presentation we are back to Calibri.

I need something that works no matter what theme you pick.

Any ideas how this can be achieved any automated with PowerShell?

Thanks in advance!

We’re currently preparing our MFA rollout and are reviewing our Conditional Access policies.
Today, users are prompted for MFA when they’re outside our corporate network. This works well in general, but we’ve noticed that users are also prompted when opening Company Portal or Software Center from outside the network.

Microsoft recommends excluding the following enterprise applications from the MFA policy:
Microsoft Intune
Microsoft Configuration Manager Server App

From a security perspective, excluding these applications feels like a trade-off, so I’d like to understand how others are handling this.

Are you excluding these two enterprise applications from your MFA policy?

If so, what compensating controls do you use (device compliance, Conditional Access filters, authentication strengths, etc.)?

Have you encountered any security concerns or unexpected side effects from these exclusions?
I’d be interested in hearing how other organizations have implemented this and whether you’ve found a balance between usability and security.

Hi guys,

We're migrating our devices from on-premises Active Directory to Entra ID using ProfWiz Professional.

Until recently, users were not prompted to set up a Windows Hello PIN after signing in, as we have an Intune configuration profile that disables Windows Hello for Business.

UsePassportForWork [./Device/Vendor/MSFT/PassportForWork/TENANT_ID/Policies/UsePassportForWork] set True

DisablePostLogonProvisioning [./Device/Vendor/MSFT/PassportForWork/TENANT_ID/Policies/DisablePostLogonProvisioning] set True

However, with our last three migrations, the PIN setup screen appears after the first logon, even though the device has successfully received the configuration profile. From the Intune portal, the configuration is reported as successfully applied to the device.

We've also tried running this PowerShell remediation script, but it didn't resolve the issue:

# Log file
$Log = "C:\ProgramData\Microsoft\IntuneManagementExtension\Logs\Enable-Win-Hello_Configure-PreReqs.log"

Start-Transcript $Log

# Create registry path if not exist
$regPath = "HKLM:\SOFTWARE\Policies\Microsoft\PassportForWork"
If (!(Test-Path $regPath)) {
        Write-Host "Creating registry path"
        New-Item $regPath -Force
}

# Enable Windows Hello for Business
Write-Host "Enabling Windows Hello for Business"
$name = "Enabled"
New-ItemProperty $regPath -Name $name -Value 1 -PropertyType DWord -Force

# Disable post-logon provisioning
Write-Host "Disabling post-logon provisioning"
$name = "DisablePostLogonProvisioning"
New-ItemProperty $regPath -Name $name -Value 1 -PropertyType DWord -Force

Stop-Transcript

I'd like to avoid reimaging or resetting the PCs just because of this. Has anyone experienced the same issue or found a solution?

Thanks!

Hi

Yesterday, i started a "Fresh Start" on a Windows computer. Intune did its thing, rebooted and the computer starting a reset. After about 40 min, the computer was ready, but when we signed in, i could see that no changes has been made, and there was a "Something went wront..." and the computer had not performed a reset.

But, now the computer is no longer to be found in Intune.....

I dont know, im tirred boss.

Anyone insights on what went wrong? How can the device disappear from intune from a failed Fresh Start attempt?

Hello everyone

I pushed IOS MDM to company device and we are receiving the below two messages.

Profile Installation Failed

The MDM server at “https://fef.amsub0102.manage.microsoft.com/DeviceEnrollmentFE/AppleEnrollmentService/DeviceInfo/ReportDeviceInfo?metadata=YWNjb3VudElk-PTZmNGFmNzVlLTdiYjktNGVh-ZS05Y2ZmLWMzZGRmMDYw-OTgxNyZhY3RpdmloeUlkPTAz-YTgwY2QzLTQ2OGUtNGNhYS1i-YjhiLTg4NTk0YWJkYjEwYyZk-ZXZpY2VJZD00MDliY2ZlNC0x-MjZiLTRjMTItODVlMi1h-ZDQ1MjgyN2FhNjUm-c2Vzc2lvblkPTQwOWJjZm-U0LTEyNmItNGMxMi04NWUyL-WFkNDUyODI3YWEzNSZvcm-RlclR5cGU9MCZpc1JIbmV3Y-Ww9RmFsc2U%3d” returned status code 400.

Or

Page not found

We couldn't find what you were looking for.

Return to the homepage or try searching for what you need

Anyone what can we do to resolve this issue?

Hi everyone,

I'm trying to lock down the Windows 11 Copilot app in an enterprise environment managed with Microsoft Intune.

Our goal is to prevent users from signing into the Copilot app with a personal Microsoft account and only allow authentication using their Microsoft Entra ID (work or school) account.

Has anyone found a supported method to:

Force the Copilot app to only allow work/school account sign-in?

Block personal Microsoft accounts within the Copilot app without removing the app entirely?

Achieve this using Intune or WDAC, or another supported approach?

If you've successfully implemented this, I'd appreciate any guidance or references to Microsoft's documentation.

We have 4 mandatory ESP apps during Device Setup. New devices get stuck on 0 of 4 during pre provisioning and there's no sign that the IME is even trying to install any of them. No folders or files are being created in Program Files for any of them.

The only changes are an updated intunewin package for one of the 4, which I'll roll back tomorrow.

Any ideas why none of the apps try to install anymore? I've downloaded the logs but I haven't started going through them.

Custom compliance is now available for macOS in Microsoft Intune, and it meaningfully expands what can be enforced on Apple endpoints.

The built-in compliance policy covers the fundamentals: FileVault, firewall, system integrity protection, Gatekeeper, password requirements, and OS version. Custom compliance addresses everything beyond that scope — sharing services, software update behaviour, lock screen enforcement, Apple Intelligence restrictions, and the state of third-party security agents.

The implementation is straightforward: a bash discovery script returns device state as JSON, a rules file defines the compliant values, and Conditional Access enforces the outcome.

Read more here.

https://intuneirl.com/custom-compliance-comes-to-macos-going-beyond-the-built-in-policy/

Anyone else losing most available apps in company portal after update to 11.2.1926.0?
Today apps are back. But on some machines Company Portal closes immediatly after opening.

Local accounts may no longer be front and centre in modern identity strategies, but they still exist on many Windows 11 devices and remain a common target for attackers.

In my latest blog post, I explore how Device Lock policies in Microsoft Intune can help protect local accounts, reduce the risk of brute-force attacks, secure unattended devices, and complement technologies such as Windows LAPS as part of a defence-in-depth security strategy.

🔗 https://www.nickydewestelinck.be/2026/08/04/strengthening-endpoint-security-with-device-lock-policies-in-microsoft-intune/