Stop me if I'm reading this wrong, but it seems to me that in order to use any of the features in the new AutoPilot device association feature you would have to remove every single device from their box, power it on, and perform a registration and/or export of TPM data. That seems to defeat the whole point of AutoPilot, especially when you have hundreds of laptops to deploy.

Cross-posting from the Defender subreddit as there’s a like-minded crowd here managing similar IT stacks.

This morning, a large number of our Intune-managed Windows 11 devices displayed a toast notification saying Defender signatures were out of date. However, the Defender portal shows those devices as up to date and healthy. We’re expecting some user concern given the conflicting information.

We had an issue in August, resolved in September, where Defender was incorrectly reported as disabled due to a Windows Security Center (WSC) signal issue. That also caused Intune compliance issues, as the check for whether Defender was active relied on those signals.This feels potentially similar.

Anyone else seeing these notifications today, or noticing any corresponding changes in device compliance?

I'm starting an effort to migrate local admin privileges to a managed tool. Since EPM is included, I'm obligated to try it out before saying CyberArk is the only way.

The environment is simple. You have you standard account and if you have local admin, you have an admin account.

So now that the audit policy has been running for a couple weeks, why do I have events like regular accounts running chrome.exe as an unmanaged elevation? Or cmd.exd having over 32k elevated events

And then I cant export the reports?

I feel like I have to be doing something wrong because this experience is just horrible.

Hi All,

We've recently moved to using Autopilot for all builds & are seeing some inconsistency with regional/language/keyboard settings.

I've had our service support team run through some builds specifically testing for following the same process & they are assuring me they are selecting the US, followed by Australia, which should give the intended result... However on 2 devices they tesed, one ended up correct & the other ended up giving them a En-GB keyboard layout (which throws out special character mapping on keyboard).

Is there a good guide out there for making sure we end up with correct settings for an Australian system? Would be good to make sure its correct during AUtopilot plus also enforcing it after the fact via Remediations.

Greetings Intune admins. I am setting up Autopilot and I was wondering if anyone has used the WriteToHkcuFromSystem.ps1 script with Autopilot with success.

I am still troubleshooting but it appears that it is failing.

SCCM has been my thing for years, this is new. Other apps install fine.

Thank you for your feedback.

Regarding : https://techcommunity.microsoft.com/blog/microsoft-entra-blog/platform-sso-during-automated-device-enrollment-is-now-generally-available-for-m/4436813

I've introduced the setting RegistrationDuringSetup (Enabled). It's in a configuration profile that a mac is getting when enrolling thru Enrollment program tokens.

It doesn't work... I still have to use the Company Portal prompt to complete the Platform SSO.

I didn't find any other documentation beside that article.

Have you tried that setting ?

Hey Reddit,

Several users have reported getting stuck in pending driver update loops, even after rebooting their PCs. I’m not sure how to fix this, since the usual solutions I’ve tried haven’t worked.

Background on our environment:

1. We have Autopatch set up and enabled, with recommended drivers approved automatically. This worked well until about a month ago. We’re not sure whether the drivers released through Intune are causing the issue.

2. I paused updates for HP drivers, which fixed the issue for those drivers, but the Intel drivers seem to cause the same problem, even after being paused.

3. I created a script to create a new SoftwareDistribution folder. It works, but I need a fix that doesn’t require deploying it to every user.

Has anyone else reported this in the community, or am I the only one? Should I turn off automatic approvals for recommended driver updates and approve them manually? I know drivers can be wonky, and a consultant recommended that we turn automatic approvals on.

Please let me know.

My bios’s have a license key for pro education but I can’t see that as an edition for osd cloud. Anyone know a way of having it automatically use that key?

I had a users laptop's SSD die yesterday and am trying to plan out the repair. Since the SSD died, I could not send a wipe command. What is the best way to replace the failed hardware and re-join the PC?

Since the SSD is the only thing that died (and replaced) the hardware hash should still be OK....correct? If that is the case, what is the recommended method to re-join? Just manually delete the device object in Intune and then replace the SSD and re-join via Autopilot? I think that this should work, but it almost seems too easy. Am I correct with the methodology? If not, please help bring me up to speed on best practices for handling this.

TIA

Who is using EPM in large enterprise environments? How was your experience through deployment? Any gotchas or roadblocks? Anyone tried to use it and found it so lacking that you didn’t go to prod?

Based on the Microsoft Learn documentation, leaf certificates issued by Intune Cloud PKI should be revoked when the Configuration Policy settings (except for Name and Description) are changed.

I wanted to test this by changing the Subject name format value in the SCEP settings but my one issued certificate stayed valid although it did get removed from the device. However, this is contrary to what it says here Remove SCEP or PKCS certificates in Microsoft Intune - Microsoft Intune | Microsoft Learn.

On there, it says:

"A SCEP certificate is revoked when:

• An administrator changes or updates the SCEP profile."

I then removed my test device from the group that the SCEP profile is assigned but this still hasn't revoked the certificate, which again, is what should have happened based on the documentation.

"A SCEP certificate is revoked and removed when:

• A user unenrolls.
• An administrator runs the wipe action.
• An administrator runs the retire action.
• The device is removed from a Microsoft Entra group.
• A certificate profile is removed from the group assignment."

Anybody else run into this?

I’m setting up 12 company-owned Lenovo Android tablets for a childcare customer. Each tablet will remain in its assigned classroom and will be shared by the different teachers/staff working in that classroom throughout the day.

These are not individually assigned devices. Teachers will simply use a PIN to unlock the tablet, and the tablet is intended to run only Procare. We do not need each teacher signing into Intune or having their own device profile.
I’ve already connected Managed Google Play to Intune and created an Android Enterprise Corporate-Owned Dedicated Device enrollment profile. My plan is to deploy Procare as a required Managed Google Play app and configure the tablets in single-app kiosk mode, essentially making each tablet a dedicated Procare device.

The licensing is where I’m looking for advice. The customer currently only has one Intune-licensed user and has a very limited budget. I know using a single user license to cover 12 devices may not be the correct licensing model, even if enrollment technically works.
For those who have deployed something similar:

Is there a supported way to handle this without purchasing 12 full Intune/M365 user licenses?

Is Android Enterprise Dedicated Device + single-app kiosk the approach you would use?

Can the devices remain userless while teachers simply unlock them with a common/device PIN and authenticate within Procare as needed?

I’m mainly trying to find the most cost-effective supported solution for a small customerh rather than a licensing workaround. Any experience with this type of classroom/shared-device deployment would be appreciated.

Has anyone deployed Office 2024 LTSC via intune and even doing it via autopilot? I've managed to sort the setup out and the config so I can run the

setup /configure config.xml

at a command prompt, then it will install from what was downloaded earlier.

But not sure how you'd package that up to push out via intune or use it in an autopilot roll out.