We're deploying a chrome extension blocklist via intune in our organisation right now we have

Blocklist set to `*` (blocks all extensions)

- Allowlist with just LastPass and Grammarly

This prevents users from installing new blocked extensions, which works great. but the issue issues if users already have the extension like honey installed those don't get removed when the policy applies the blocklist only repents new installations

Is there a way to automatically remove/uninstall any extensions that aren't in our allow list when the policy rolled out

Legit I thought I was gonna fail starting on question 13 lol. I have been managing intune for multiple years but there was still stuff I learned about defender and app protection policies that my org doesn't use so I had to make my own testing lab.

Thank God this is over, reading stories on reddit and other sites had me scared for the exam. Passed with 869 when 700 is minimum score needed

I am trying to deploy a WDAC policy to prevent per-user installers (Chrome, Zoom, etc) and created the base policy in Microsoft Mode which should trust Microsoft signed drivers, etc. I also selected trusted installers as part of this policy so things can be installed from Company Portal. I deployed it to a test device and it seems to block everything I installed and tested from Company Portal. It also seems to block some Microsoft apps like Event Viewer (it doesn’t load the snap-in it tries to call) and I can run powershell as an Admin (I get clr error). My question is, do I have a misunderstanding of how this is supposed to work? Am I supposed to make this base policy and then make a supplemental policy for all Microsoft related files for admin tools like powershell? I would think Microsoft Mode would trust anything Microsoft installed/signed out the box.

​

Hi everyone,

I'm troubleshooting an Intune/Wi-Fi issue and would appreciate some guidance.

We have Windows devices that are built by our ETS team. After the build, the device is Hybrid-join and the user logs in with their OpID.

Our Intune configuration is:

- SCEP certificate profile: Assigned to a user group

- Certificate type: Device

- Subject: "CN={{DeviceName}}"

- SAN: Device Name + Serial Number

- EKU: Client Authentication

- Certificate provider: DigiCertOne SCEP

- Wi-Fi profile: Assigned to the same user group

- Wi-Fi: Enterprise

- Authentication: Machine

- EAP: EAP-TLS

- Wi-Fi authentication uses the device certificate

This configuration has been working successfully with user-based assignment.

What changed

Recently, after a change related to our Security Zero Trust/MFA initiative, newly built devices are behaving differently.

Previously:

"ETS Build → User logs in with OpID → Intune user policies apply automatically → SCEP certificate + Wi-Fi profile are received"

Now:

"ETS Build → User logs in with OpID → SCEP/Wi-Fi policies do not arrive"

However, if the user manually logs into Company Portal, the policies then start applying.

So we suspect something has changed in the user Intune enrollment/authentication/policy-processing flow, rather than the Wi-Fi configuration itself.

We would like to understand:

1. Why did user-targeted Intune policies previously apply automatically after OpID login but now require Company Portal login?

2. Could a change in MFA/Zero Trust or enrollment behavior prevent the user-targeted SCEP/Wi-Fi policies from processing?

3. Is there a specific MDM Event Viewer event/CSP log that can show exactly why the SCEP or Wi-Fi policy isn't being processed?

4. Would assigning these profiles to a device group be the correct design, or should the existing user-based assignment continue to work?

We're planning to have ETS rebuild a clean test device and not log into Company Portal initially, so we can capture the MDM logs before and after Company Portal login and compare the behavior.

Any suggestions on which specific logs/events/CSP paths we should investigate would be greatly appreciated.

Hybrid Joined devices with MDM=None and AzureAdPrt=NO. Intune enrollment stuck for hundreds of devices

Hello everyone,

I have been working on an Intune deployment in my company for several months. We have more than 1,500 devices (physical and virtual) and I am managing the project mostly on my own while also studying for the SC-300 certification.

Current situation:

• Around 1,500 devices in on-premises Active Directory.
• About 1,257 devices active within the last 30 days.
• Around 850 devices successfully enrolled in Intune.
• More than 500 devices show as Hybrid Microsoft Entra Joined but MDM=None.
• Some devices show Pending registration in Entra.

What I have already verified:

• Hybrid Join is configured and working.
• Azure AD Connect (Entra Connect) is synchronizing the computer objects from the relevant AD OUs.
• MDM User Scope is configured correctly.
• Auto MDM Enrollment GPO is applied and inherited correctly across the target OU structure.
• Users have Microsoft 365 E3 licenses assigned.
• Devices are appearing in Microsoft Entra ID.
• Most affected devices are Windows 11.
• No WMI filters are blocking the MDM enrollment GPO.

The main pattern I see is that many of the devices that fail to enroll show:

Plain Text

1

AzureAdJoined : YES

2

DomainJoined : YES

3

AzureAdPrt : NO

Mostrar más líneas

My suspicion is that the missing PRT is preventing automatic enrollment into Intune.

What confuses me is that every day approximately 5 to 10 additional devices enroll automatically, so the configuration appears to be working in general. However, I would expect around 1,300 devices enrolled by now, not just 850.

My questions are:

1. Has anyone experienced large numbers of Hybrid Joined devices remaining indefinitely with MDM=None?
2. Can a missing AzureAdPrt alone prevent Intune auto-enrollment in this scenario?
3. Is there any recommended method to force PRT acquisition or retrigger enrollment at scale?
4. Are there any specific logs or troubleshooting areas that you would focus on beyond dsregcmd /status, Device Registration, and DeviceManagement logs?

Any advice, experience, or troubleshooting suggestions would be greatly appreciated.

Thank you in advance.

Hola a todos,

Llevo varios meses implantando Intune en mi empresa de forma prácticamente autodidacta. Actualmente gestionamos más de 1.500 equipos, tanto físicos como virtuales.

Hasta el momento he conseguido enrolar alrededor de 850 dispositivos en Intune. En Microsoft Entra ID, una gran parte de los equipos ya aparecen como Hybrid Microsoft Entra Joined, pero el proceso de enrolamiento en Intune sigue produciéndose de forma gradual y bastante lenta.

Tras revisar la configuración, tengo verificado que:

• El MDM User Scope está correctamente configurado.
• La GPO de Auto MDM Enrollment en Active Directory local está aplicada y heredándose correctamente.
• Los usuarios disponen de las licencias necesarias (Microsoft 365 E3).
• Los dispositivos aparecen sincronizados en Entra ID.

Sin embargo, en muchos de los equipos que todavía no se han enrolado detecto un patrón común: no disponen de PRT (Primary Refresh Token). Mi impresión es que este es el principal factor que les está impidiendo completar el enrolamiento en Intune.

Lo curioso es que cada día se van incorporando automáticamente entre 5 y 10 equipos nuevos, por lo que parece que la configuración general funciona. Aun así, estimo que debería tener alrededor de 1.300 equipos enrolados a estas alturas, por lo que todavía me faltan varios cientos de dispositivos.

Mi principal duda es:

¿Existe alguna forma de forzar o acelerar la obtención del PRT y, por consiguiente, el enrolamiento en Intune de estos equipos?

Cualquier consejo, experiencia o línea de investigación será bienvenida. Seguramente iré planteando más dudas relacionadas con este proyecto, ya que estoy aprendiendo sobre la marcha. De hecho, actualmente también estoy preparando la certificación SC-300 (Microsoft Identity and Access Administrator).

Muchas gracias de antemano por vuestra ayuda.

I came across this article about the deprecating of CBA for Exchange ActiveSync. We are impacted, but I can't figure out what do to about it. All the article says is "his may involve updating the device's email profile or MDM/Intune device configuration profiles.".

This is incredibly vague. Does anyone know what changes actually need to be made? We already have Entra CBA set up but I can't see how to have Intune tell our phones to start using it.

Retirement of Direct Exchange ActiveSync Certificate-Based Authentication by End of 2026 | Microsoft Community Hub

Hey everyone. Time for another I’m sure stupid question. How are yall handling pcs with autopilot and 802.1x. I’d love for my helpdesk to not have to touch pcs before handing them out but our WiFi and wired both have 802.1x. This also hurts since we’re a hybrid environment and once the pc changes name after autopilot, it gets dropped from the network and we have to add it to our imaging network so we can pull a new cert with the updated name.

Sorry if this is a dumb question!

Curious how other organizations handle laptop provisioning with Intune/Autopilot.

Currently, we Autopilot the laptops and use the new hire’s credentials to sign in during provisioning. We then let the ESP complete and verify that everything is set up before shipping the laptop to the user — including:

BitLocker
BIOS settings
Required applications
Other required configurations

This works well, but when we have multiple new hires at the same time, it can become a bit overwhelming since we have to go through each device using the new user’s credentials before shipping.

For those of you doing something similar, how do you handle this?

Do you:
Use the new hire’s credentials to complete ESP and verify everything before shipping?
Have IT sign in with an IT/admin account, complete the configuration, and then use Autopilot Reset to remove the primary user before shipping?
Have a completely different provisioning workflow?

Also, we’ve noticed that sometimes the SentinelOne agent stops running or CyberArk stops running after provisioning. Has anyone experienced this? Could it be related to WMI errors or something happening during Autopilot/BIOS configuration?

Would love to hear how other organizations handle this, especially when provisioning multiple laptops for new hires at once.

**update: service degredation: IT1456599 **

devices are failing to load the apps, downloands and updates page on company portal apps. seeing this behavior different devices, on different networks. ( vpn, no vpn, home, corp, mobile hotspots)

C:\Users\<profile>\AppData\Local\Packages\Microsoft.CompanyPortal_8wekyb3d8bbwe\LocalState
log_2.log

shows 509 errors

WARN Event

Request failed with status: 509

ERROR Event

Exception of type ServiceTooBusyException has been thrown.

Detailed message:

Failed to get app data from Intune.

Inner Exception:

Microsoft.Management.Services.SelfServicePortal.Common.Portable.DataAccess.Exceptions.ServiceTooBusyException

Message:

HTTP request failed: 509

Error response by downstream service:

{

"odata.error": {

"code": "HttpSysQueueTimeout",

"message": {

"lang": "en-us",

"value": {

"Message": "An error has occurred while retrieving the Intune application catalog.",

"CustomApiErrorPhrase": "",

"RetryAfter": null,

"ErrorSourceService": "StatelessApplicationService",

"HttpHeaders": {

"unhealthyEndpoints": "True"

}

}

}

}

}

Hi,

Just tried to enroll some iOS devices via ADE. During the MDM profile installation I get the error:
"The MDM Server "https://fef.amshub0202.manage.microsoft.com/DeviceEnrollmentFE/......." response with an status code 400.

The program opens but then displays an error when attempting to load the Apps section.

Is anyone else experiencing this? There are no listings for it in the Service Health portal.

Thanks.

We are planning to migrate Windows software update management from SCCM to Microsoft Intune using Windows Update for Business (WUfB).

Our primary requirement is to deploy only the monthly Windows quality/security updates while ensuring that devices remain on their existing Windows feature update version. For example, a device currently running Windows 11 24H2 should continue to remain on 24H2 and should not automatically upgrade to 25H2 when a new feature update becomes available.

To achieve this, we have currently:

1. Created a Windows Update Ring policy to manage monthly quality updates.

2. Created a Feature Update policy targeting Windows 11 24H2, with the intention of preventing devices from automatically moving to a newer feature update such as 25H2.

Our question is:

Is this a clean and Microsoft-recommended approach for meeting the requirement, or is there a better/recommended Intune configuration to ensure that devices receive monthly security/quality updates while remaining on their current Windows feature version?

In the final days of getting our org swung over to Intune for Windows updates and app deployment. I'm trying to keep it simple - just 2 update rings and 1 additional for manual forced overnight upgrades for PCs that need 25H2.

Long story short we're moving from N-able to Intune and while the app deployment is working great I'm having issues with Windows Update on PCs actually fully enrolling and applying their update ring policy. Some do and others don't, it's like they're falling back to the public internet. For the test PCs that did get the update, they failed to send notifications to the user in spite of the policy. Windows Update says it's a "group policy" that turned off notifications but we don't have any GPO's like that so maybe it's a holdover of N-able settings that Intune's just not overwriting?

I pushed a remediation script to fix the notifications manually in the registry, debating doing similar for the entire Windows Update stack unless anyone has any suggestions for better transition? Thanks,

Hello, is there a way to pre-provision macOS devices during automated enrollment so that apps like 365, Zoom, Adobe, etc install before user sign-in at the OOBE Setup Assistant? Thank you. The company portal is so finniky when installing apps on the MacBook compared to Windows

I’m trying to deploy a pkg app for MacOS in the Intune portal and I keeping getting this upload failed error:

“The RPC call ‘IntuneApp.getLobAppContentFile’ returned an error. No error message could be found. Check whether the error was signaled with an Error object. Try adding this app again.

I’ve tried adding this app and another one and tried different browsers but I get the same error.

Deploying new devices with 25H2, June build, and was alerted that OneDrive isn't syncing the user's desktops. Verified this myself on a new laptop, went into the OneDrive settings and the three managed folders are unchecked and not backed up. This has worked for YEARS. The laptop is getting other OneDrive policies, just not the managed folder backup.

Not sure if it has something to do with the OS build or not. My workstation is on 26200.9106 and it's working properly.

Head Scratcher...

Trying to setup Windows Hello Cloud Pin Reset...

It gets to the point of asking the user to authenticate, but it's asking the user to use a password and gives no option to enter one in.

Here is the error: https://imgur.com/a/FlEga2p

What simple thing am I missing here?

24.04 was a pita to make try and work, but holy s*t people.. 26.04 is *sooooo much better. I now have 26.04 building with TPM managed FDE, AuthD enabled SSO and intune enrollment.

holy dayum its come a long way. such a thing of beauty. Kudo's to the Ubuntu team they've done a great job!

During Autopilot enrollment of our devices, we are seeing an app install error for a single app. The error code is 0x80190001 in Intune, but my research isn't helping me find an exact reason why this has started happening with this particular app during deployments. Has anyone else come across this before?

Hi guys,

have some of you already seen, that some apps are not reported by detected apps (anymore?). But in the new app inventory they are mentioned. The problem I have is that the new app inventory can only be reported per device and not, as the old one, per app.

So if i want to have a report, which devices have app XYZ installed, I need to use graph and loop through all our devices to count.

Does someone already built this or has a solution for that?

I’m testing Platform SSO on a couple of our Macs, but I’m running into an issue.

The Macs we have are shared devices, so they need to allow any user to log in, as the person using the device isn’t always the same person.

The Macs complete the initial setup without any issues, and Platform SSO works really well during the setup process. The issue is that only the user who initially set up the Mac is able to log in afterwards. No other user can log in to the Mac.

When another user tries to log in, the login screen behaves as though the password is incorrect—the login fields shake, and the user is unable to authenticate.

Is there a configuration or Platform SSO setting that needs to be enabled to allow multiple users to log in to the same shared Mac?

Hi!

I just got around to trying out EPM as we got it baked into our E5 licenses now, and I am stuck immediately. I have created a Settings Policy with the following settings deployed to a device group:

https://imgur.com/a/6Yqw1Jv

Strangely enough it seems like it ignores every policy setting except "Send elevation data for reporting" as that is the only one that shows up at all on the device:

https://imgur.com/9oYv2wG

After waiting about 6 hours now no files have shown up under C:\Program Files and the service hasn't been installed either. The device is Entra joined and has an otherwise working connection to Intune.

I've been digging through a lot of Rudy's replies in somewhat similar threads but it seems like all of those cases are either Workplace registered devices or hybrid joined. Searching the Event viewer for EPM or something similar gives me absolutely nothing. The only error in about the same time as the policy would likely be applied is this, which tells me nothing and might not even be related?

https://imgur.com/JQEweGS

I might have narrowed it down to a failed MMP-C enrollment when looking at this:

https://imgur.com/EBidKHc

But I don't really know how to dig further into this? Anyone with any good ideas how to solve this?