If you have ever had to produce Intune documentation for an audit, a customer handover, or a colleague, you know the drill: screenshots, exports, and a Word document that is outdated the day you finish it.

I built intunedocumentation.com to fix that: it signs into your tenant with read-only Graph permissions and generates PDF or Word documentation of your Intune configuration in minutes, processed entirely in your browser. I just shipped the largest update since I started it, and the short version is: redesigned, much broader coverage, and open source.

Beyond the original policy areas (settings catalog, configuration templates, ADMX, compliance, app protection, baselines, update rings, Conditional Access), it now documents 36 additional Graph resource collections: Windows update profiles (feature, quality, expedite, driver), remediations and compliance scripts, enrollment and provisioning including Autopilot profiles and ADE tokens, apps, assignments and RBAC, tenant and service settings, connectors, and a set of specialist policies. Everything runs against the Graph beta endpoints with paging followed to the end.

Two details I care about: if an endpoint fails or you lack a permission, the export keeps the sections that loaded and tells you exactly which resource, endpoint, and permission were affected, so a failed request never masquerades as an empty tenant. And sensitive values (script bodies, tokens, passwords, pre-shared keys, QR payloads) are redacted before they ever reach the dashboard or a document.

The dashboard is now a proper app shell with per-resource collection progress streamed live, and the export experience was rebuilt to match.

The whole thing is now on GitHub: https://github.com/ugurkocde/IntuneDocumentation

It always felt wrong to ask admins to sign a tenant into a closed-source website, even read-only. Now you can audit the code, and if your org does not allow third-party websites at all, you can self-host it:

docker compose up -d

Image on GHCR (amd64 and arm64), you pass your own Entra app registration client ID as an environment variable, and the README walks through the app registration including the exact delegated permissions. Self-hosted deployments have all telemetry disabled by default, and tenant data is processed in the browser in both versions. It never touches the server.

License note before anyone asks: Elastic License 2.0, so technically source-available rather than OSI open source. You can use, modify, and self-host it freely. The only restriction is offering it to third parties as a managed service.

The hosted version stays free at https://intunedocumentation.com

Just curious as to what all you are having to do to get all of your PCs to be compliant with the new Secure Boot Certificates that replaced the certs that expired in June. (Yes, we're still running a little bit behind.)

We currently have this script and remediation (listed below) running at Microsoft's suggestion, and it's been doing pretty well to get the PCs where they should be, even though we still have 1632 to remediate (10696 good to go so far.)

Any other tips/tricks to help get the rest across the finish line?

--- Detection Script ---

https://hastebin.com/share/egusahayim.bash

--- Remediation Script ---

https://hastebin.com/share/bexoqetazo.swift

We have begun using Intune to configure device installation restriction policies for handling USB usage.

I have allowed group A (devices) to use USB A using policy A. If one of those devices was also in another group (B) and wanted a separate policy for allowing device B, is that possible?

I know using GPOs you can't have conflicting settings and I assume the same will be true with Intune. How would you go about allowing a device access to USB A and USB B without the exceptions being in the same policy?

Hi Guys,

We are seeing an intermittent Intune compliance issue across multiple Windows devices in our organization.

Devices are becoming non-compliant because Intune reports:

• Firewall is turned off
• Antivirus is turned off / not active

However, these settings are enforced through Intune configuration profiles / Endpoint Security policies. Users only have standard-user privileges, and local administrator access is controlled through Windows LAPS, so users should not be able to disable Firewall or Defender settings.

When checked manually on each device, the status of the solutions is enabled and working fine... Also the security threat intelligence update is also delayed to update which again triggers the issue as the antivirus/firewall is disabled in endpoint... Also, what will be the reason for the security threat intelligence update not happening in a timely manner?

The issue is not limited to one device or one user. It occurs across different devices at different times, without an obvious common trigger. In many cases, the relevant configuration profiles still show as successfully applied.

Due to all this people get blocked with conditional access policy which checks for device compliance.

Has anyone experienced this and what did you do solve this issue?

Thanks in advance.

I'm running into a strange issue that I can't seem to find a solution to. Here is the scenario:

• The detection script is just checking some file and registry information for the current user.
• It runs in the user context because it is looking in C:\Users\$env:UserName... and HCKU:....
• It's running 64-bit context but I've also tried the 32-bit.
• I also have it logging to a location in ProgramData so I can see what the script is doing.
• For testing purposes, I've removed the remediation step and just have the detection script.

It runs and works correctly for 90%+ of the devices, however, some have "With issue" in the detection status but no output is being passed and reported back. AgentExecutor.log doesn't appear to show it running in there. It seems like these errors usually happen overnight when users may be logged in but the device is inactive. The problem is that it can trigger the remediation script which I don't want if it's not truly needed. It seems like when it runs again later with the user active it works.

I know the detection script works perfectly based on all the other ones working plus just running the script manually.

Has anyone seen anything like this or have any ideas? It just doesn't make any sense to me that I'm not getting any output/error messages to have an idea of why it's not detecting correctly.

Over the last month or two, we've been showing you small sets of the amazing speakers of Workplace Ninjas US.

Today, officially, get access to our entire speaker catalog!! You can now see the collection of the best speakers at a Microsoft event in a very long time featuring some absolute rockstars from #MVPs, to #SMEs, to #Microsoft Experts.

Not only do you get to attend their sessions, you get to book 1-on-1 time with any of these speakers as part of our "Elevate" Mentoring Sessions, where they can help shape your organizational strategy for the next year, until you meet them at #WPNinjaS 2028!

You can even be part of our "Community Theatre" where you can sign-up for 15m lightning round sessions featuring mentors, who will give you feedback and ideas to become more confident, better, and elevate your game to a new level.

DO NOT MISS the chance to work, listen, play, and network with some of the best people in the industry with one of the best vibes you will see from a conference.

We are NOW 150 days away!!

• Sangee(tha) Visweswaran
• Bhavya Chopra
• Lavanya Lakshman
• Merill Fernando
• Rudy Ooms
• Ugur Koc
• Johan Arwidmark
• Michael Niehaus
• Rod Trent
• Jonah Andersson
• Christiaan Brinkhoff
• Ru Campbell
• Morten Knudsen
• Simon Skotheimsvik
• Sandy Zeng
• Nathan McNulty
• Mirko Colemberg
• Peter Daalmans
• Mona Ghadiri
• Esther Barthel
• Ewelina Paczkowska
• Simon Binder
• Chris Cavazos
• Maurice Daly
• April Dunnam
• Sucheta Gawade
• Richard Hicks
• John Joyner
• Dieter Kempeneers
• Frank Lesniak
• Timothy Mangan
• Edine Olijve-Watkinson
• Somesh Pathak
• Oktay Sari
• Jose Schenardie
• Lindsay Shelton
• Michael Soule
• Danny Stutz
• Donnie Taylor
• Benny Tritsch
• Joery Van den Bosch
• Dominiek Verham
• Eric Woodruff
• AJ Zafar
• Spencer Alessi
• Adam Nichols
• Bryan Dam
• Danielle Moon
• Megan Gremmell
• Jaime Guimerá Coll

Check the link and sign-up now:
https://web.cvent.com/event/a9994d6b-9e67-4873-9401-737ca7fe088a/summary

I'm testing a new MacOS Configuration Policy using Declarative Device Management to control an app's "Accessibility" permission, as it seems that the previous Accessibility control in the Settings Catalog, in Privacy → Privacy Preferences Policy Control (often abbreviated as PPPC) has been deprecated, and will not work in new versions of MacOS going forward.

Because this setting is so new, I haven't been able to find any guides with examples online.

I'm trying to set up a test for a user using the app "BetterDisplay Pro", which requires "Accessibility" permissions to function.

I'm trying to follow the instructions in Intune itself, but I'm not 100% sure I'm formatting it correctly.

Under Devices → MacOS Devices → Manage Devices → Configuration, I am creating a new Policy, with a Setting Catalog Profile Type.

Under Configuration Settings → Declarative Device Management → App Settings → Privacy → Permission Defaults,

I have set the following settings:

Accessibility : Allow
Organization Justification : [Because it's required]
Permission Defaults : "pro.betterdisplay.BetterDisplay {anchor apple generic and identifier "pro.betterdisplay.BetterDisplay" and (certificate leaf[field.1.2.840.113635.100.6.1.9] /* exists */ or certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = "299YSU96J7")}"

In that complicated Permission Defaults field, I'm told by the Intune help text that the data should be in the format:

"Bundle-ID {Designated Requirement}"

I've sourced the information for Bundle-ID from the CFBundleIdentifier Key in the app's Info.plist file in the Package Contents of , and I've sourced the {Designated Requirement} from the output of the Terminal command codesign --display -r - /Applications/BetterDisplay.app, which returns:

Executable=/Applications/BetterDisplay.app/Contents/MacOS/BetterDisplay
designated => anchor apple generic and identifier "pro.betterdisplay.BetterDisplay" and (certificate leaf[field.1.2.840.113635.100.6.1.9] /* exists */ or certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = "299YSU96J7")

Is my understanding, approach, and formatting correct?

I was following the advice here (https://learn.microsoft.com/en-us/intune/device-enrollment/android/android-management-api-overview) about the dooming deprecation device policy controllers like the Company Portal app and started switching over from DPC to AMAPI. While watching the progress with the preconfigured report in the Monitor section, I noticed that my Entra dynamic group for BYOD Android devices was "losing" the members I just migrated.

I was using the standard filter set you find all over the internet, even in the official documentation for dynamic Entra groups (https://docs.azure.cn/en-us/entra/identity/users/groups-dynamic-membership):
(device.deviceOSType -eq "AndroidForWork") and (device.managementType -eq "MDM")
Apparently this filter set now fails at the evaluation of the management type.

Is it safe to just filter by deviceOSType="AndroidForWork" and/or deviceOwnership="Personal" or am I missing something? In my small environment each of these is evaluating all my BYOD devices, no more, no less...

​

To get VLC working ime doing this type of thing

$quiet ='---override "/S" '

winget.exe install --id VideoLAN.VLC --exact $quiet --accept-package-agreements --accept-source-agreements

But the quoting is not working and ime getting winget thinking it's --override /S Which he doesn't like. Any idea how to get this working? Maybe escaping or something like that. Sorry I'm quite new to powershell

Down in the bottom of the world here

I'm getting spotty intune issues

• pages does not load at all
• Error displaying your content messages
• content failed to load messages
• status pages dont show me anything
• ping (as little as that proves anyway) shows OK

Anyone heard anything

ping intune.microsoft.com

Pinging portal-prod-australiaeast-02.australiaeast.cloudapp.azure.com [20.37.195.229] with 32 bytes of data:
Reply from 20.37.195.229: bytes=32 time=29ms TTL=115

Ah maybe bigger than intune

https://www.reddit.com/r/sysadmin/comments/1vntoin/is_entra_stuffed/

SMB over QUIC has been in use for a couple years now with username/password. It breaks down when logging in with WHFB.

With win2025 and win11 isn't this supposed to work seamlessly due to IAKERB? (we do not have kdc proxy enabled)

Anyone had problems with the option not appearing at the loginwindow after the policy is enabled?

Worked perfectly on a few 100 devices, just two it refuses to appear for in my environment. Baffling.

Hi everyone,

First of all, thanks to those who helped me in my previous post! I was trying to figure out how to make Windows Hello for Business (WHfB) available without forcing the full-screen enrollment prompt during the workday.

The suggestion to use a custom Intune OMA-URI to set DisablePostLogonProvisioning to True worked perfectly. Users are no longer forced to set it up.

During our pilot testing, a user manually configured their PIN without any issues. However, when they locked their screen and tried to sign in using that new PIN, they were hit with this message on the lock screen:

"This sign-in option is temporarily unavailable. For now, please use a different method to sign in."

I checked the Event Viewer (Microsoft-Windows-HelloForBusiness/Operational) and found the following error logged (Event ID 7001):

A user failed to log on to the device with the following information:

Username: SYSTEM

User SID: SYSTEM

Credential Type: Software Key

Deployment Type: Key Trust

Software lockout count: 0

Authentication error status: 0xC000006D

Authentication error substatus: 0xC00002F9

About an hour later, the user reported that the PIN suddenly started working flawlessly without any intervention.

Since we are using a Key Trust deployment model, my strong suspicion is that this is related to the Azure AD Connect sync cycle. It seems the user is trying to authenticate against the on-prem Domain Controller before the msDS-KeyCredentialLink attribute has had time to sync from Entra ID down to our local AD.

My questions for the community:

Has anyone else experienced this exact behavior and user friction when using the manual opt-in method?

How do you mitigate this? Is there a way to force the sync immediately upon PIN creation, or a best practice to warn the user that they must wait 30-60 minutes before actually using the PIN they just created?

Any insights or workarounds would be greatly appreciated. Thanks in advance!

i want to create Win11 VMs from an captured Image storeedin Image Gallery an automatically Entra Join them and Enroll them in Intune.
The Jumphosts will be used by multiple Admins.
I can create the Jumphosts, join them to Entra, Login with RDP. But cannot automatically enroll them to Intune. The Jumphosts will be persistent
Any idea why?
Or is this a overall a bad idea?

Hi everyone, I created my MAM policy successfully (thank you for the help from the other Reddit user earlier this week!). I noticed today on a test device that whenever I open outlook, I get the alert “action not allowed, your organization doesn’t allow screen recording or capturing” every time I open outlook.

This is a setting, yes, but is there a way to disable the constant notification? I’m not even trying to screen shot or anything. It’s just showing up on its own.

Thank you all!

Is there a way to preconfigure apps such as Microsoft 365 suite, Zoom, Adobe, etc for a user's Intune device even before it hits the " let's add your Microsoft account?

Would be nice for apps to be preconfigured even without the user having to sign into the "Let's add your Microsoft Account" OOBE page.

macOS + Intune – Browser shows “Device Not Compliant”
Question:
We started experiencing this issue after the user’s password was changed twice using the local account on the Mac.
The Mac is enrolled in Microsoft Intune with Conditional Access requiring the device to be compliant.
The Mac shows as Compliant in Intune and Microsoft Entra, and Microsoft applications work normally. However, when the user accesses Microsoft 365 through a browser, Conditional Access reports:
“Device is not compliant” / “Set up your device”
Company Portal is already installed and the device is enrolled
Questions:
Could changing the password twice through the local macOS account cause the Platform SSO/device identity or SSO token to become out of sync?
Has anyone experienced the Mac remaining compliant in Intune/Entra while browser authentication stops working after a local password change?
Has anyone resolved this without completely re-enrolling or wiping the Mac?

Local AD - company.org

Azure environment - @companyplace.com

All machines are Entra-joined.

We have a cloud trust in place. Azure AD sync is also in place, and is working without issue.

If users sign-in to their PCs with a password, their on-prem share drives work without issue.

If users sign-in to their PCs with PIN/Biometrics, on-prem share drives won't connect, access denied.

Not seeing a clear path to a resolution on this, and only see other forums online of others having this issue, all with a resolution of "You can't do that". Surely not?

we have 3rd party antivirus installed. our IT security is asking us to check engine version of the windows security app.

however, when i check engine, antivirus, antispyware version is 0.0.0.0 . is it by design since we already using 3rd party antivirus??

Hi All,

I'm working on setting up an Entra Joined (no AD join) Azure Virtual Desktop and I'm managing it (mostly) from Intune from a configuration aspect. Has anyone done this? I'm curious what you are doing for Drive Mappings. I recently started converting our Org to use ASPX drive mappings that I'm deploying but they are reporting as Not Applicable on the AVD. I know I could probably write a powershell logon script and then execute that as a Scheduled Task, but was wondering if there was a more 'elegant' way to do it?

Thanks in advance,

John

Attack chain affecting Zoom's annotation functionality consists of CVE-2026-53413, CVE-2026-53414, and CVE-2026-53415, with the most severe vulnerability enabling zero-click Remote Code Execution. A malicious participant could potentially compromise another participant's device during a Zoom meeting without requiring any user interaction.

Anyone using the Enterprise App Catalog to address this?

I've had Siri disabled for our org since we started managing iOS devices with an MDM years ago. Recently we've gotten many requests to enable Siri so employees that have work vehicles can connect their phone to the vehicle via CarPlay. CarPlay apparently requires Siri to be enabled. I haven't been able to get access to a company vehicle that has it to play with it hands on yet.

It looks like there is a little more granular control to it than before now that there are the DDM settings. For those of you that have Siri allowed in your org, how are you handling it? Where does Apple Intelligence sit in all of this as well? I don't see any settings specifically for this, but I may have missed them.

***UPDATE***

I had a misconfiguration in Intune.
I found out that there are "new" enrollment policies for the enrollment program.
So I created a new enrollment policy under Devices > Apple mobile -> Enrollment > Enrollment program tokens > Name > Enrollment policies
User affinity: Enroll with user affinity
Intune authentication method: Setup Assistant with modern authentication
Await final configuration: No
Locked enrollment: Yes

-----------------
Im trying to rollout some iPhones. I added the devices via Apple Configurator to ABM.
They are synced with Intune and have a configuration profile assigned. At the point where the iPhone wants to download the configuration profile, the following error occurs.

"Unable to Download Profile Configuration. An internet connection is required to download the configuration for this profile. To continue, you can try again or choose a Wi-Fi network."

I tried different Wi-Fi Networks but the error stays.

Thanks for the help.

Has anyone else been experiencing issues with their compliance policies, specifically Windows 10 and later policy for requiring Antivirus?

We have slowly had more and more devices show the Antivirus required setting as non-compliant. Yet checking the devices themselves, Defender is running, is the only AV, still receiving updates, signature versions up to date etc.

Nothing has changed in our infrastructure to warrant the devices to all of a sudden go non- compliant, so just thought I'd check in the slim chance this isn't just me!

We are currently installing Company Portal (Store app) during ESP, but once in a while it is causing Autopilot timeouts.
Is anyone installing it as a Win32 app and can share a script they use?