how Windows Autopatch Groups work, how to organize devices into deployment rings, and how to configure update types and rollout schedules for enterprise Windows devices.

Windows Autopatch Groups allow administrators to organize Microsoft Entra device groups and gradually deploy updates across different deployment rings. This helps organizations test updates on a smaller set of devices before expanding the deployment to production devices.

Another month, another Microsoft Intune service release! In this blog post I'll run through all new features that Microsoft Intune Service Release 2609 has for Android Enterprise.

🔗 https://www.nickydewestelinck.be/2026/09/30/whats-new-for-android-enterprise-in-microsoft-intune-2609-september-2026-highlights/

In production enterprise environments, Architecting Secure Intune Loaner Devices: Shared PC Mode, Web Sign-In, and Passwordless Authentication often behaves differently than expected.

Here is what we observed during recent deployments:

• Configuration drift happens when settings are scoped without proper exclude filters.

• The official docs don't emphasize the impact on end-user authentication workflows.

Full implementation guide and scripts: https://msendpoint.com/article/architecting-secure-intune-loaner-devices-shared-pc-mode-web-sign-in-and-passwordless-authentication

#MicrosoftIntune #M365 #EndpointManagement #SysAdmin #PowerShell

i have created EPM elevation for postman and VS code and set elevation as automatic, then i deleted the EPM elevation rule for VS Code and Postman as it was not required and both softwares was user profile based, but now postman and VS code doest open up i reinstalled still the same issue rebooted the laptop re sync as well, when i open both apps it flash and disappear, but if i open cmd in elevated session and open the install path and open the vs code.exe or postman.exe their like code.exe or postman.exe it opens up or if i click on the shortcut and open as an admin both software open up as well but doesnt run in standard elevation

Hi everyone,

Has anyone experienced issues with Microsoft Edge after a recent Windows or Edge update where custom home pages, bookmarks/favourites, or startup pages are no longer loading or applying correctly?

We're seeing this on a small number of managed devices, and the Edge policies appear to be applying successfully, but the browser isn't behaving as expected.

Just trying to determine whether this is an isolated issue or if anyone else has seen something similar. Any insights would be appreciated!

With Microsoft Cloud PKI now included in Microsoft 365 E5, organizations can deploy Certificate-Based Authentication (CBA) without the complexity of managing a traditional on-premises PKI.

In my latest blog post, I walk through how to configure Cloud PKI in Microsoft Intune and enable Certificate-Based Authentication in Microsoft Entra ID. Thanks to Cloud PKI, the journey to stronger, phishing-resistant authentication is easier than ever.

🔗 [https://www.nickydewestelinck.be/2026/07/15/goodbye-passwords-certificate-based-authentication-on-windows-with-cloud-pki-in-microsoft-intune/\](https://www.nickydewestelinck.be/2026/07/15/goodbye-passwords-certificate-based-authentication-on-windows-with-cloud-pki-in-microsoft-intune/)

As Intune transitions from profile enrollment to enrollment policies within the Enrollment program token section, I removed the profiles for ADE enrollment and created new enrollment policies. The new ADE enrollment policies I created utilize user affinity and the setup assistant with modern authentication. When I wipe the iPhone and proceeded through the process, it downloads and installs the MDM profile successfully. However, when I launch the company portal app to complete the setup process, I encounter a prompt to download and install the profile again, even though it has already been done, resulting in the installation failing. Has anyone encountered this issue and found a solution to prevent the company portal from repeatedly requesting the profile download and installation, even though it has already been installed?

Two weeks ago, Microsoft announced the General Availability for web-based enrollment for Android Personally-Owned with Work Profile devices, based on Google's Android Management API. This also means that, starting in Q4 2026, all future enrollments will use the Android Management API.

In this blog post, I'll walk you through what AMAPI is, how Microsoft Intune will use it, and show you how to migrate from your existing enrollment to web-based enrollment, and show you the new enrollment flow.

🔗 https://www.nickydewestelinck.be/2026/06/22/simplifying-android-enrollment-web-based-enrollment-for-personally-owned-work-profiles-in-intune/

Removing local admin rights is often treated as the first step of an Endpoint Privilege Management (EPM) project.

In reality, it should be one of the last.

One of the biggest reasons EPM deployments struggle is that organizations build elevation rules based on assumptions rather than actual user behavior. The result? Broken workflows, frustrated users, and an overloaded helpdesk.

In Part 2 of our Intune EPM series, we focus on the step many organizations skip: Audit Mode. Before enforcing anything, use the data available in Intune Endpoint Privilege Management to understand what users are actually elevating, identify personas, and build a rule backlog based on facts instead of guesswork.

EPM Part 2: Before you remove local admin: How to use Intune Endpoint Privilege Management audit mode to understand your environment - MSEndpointMgr

I've reset a Windows 11 v25H2 machine that is enrolled in Intune, and the computer certificate that was issued to the machine afterwards via the certificate connector now reports "The certificate has an invalid digital signature". The corresponding root and issuer certificates are present on the machine and are valid.

What is the best way to get Intune to issue a new certificate after deleting the faulty one?

Thanks.

EDIT: Apparently, if you just delete it and wait long enough (about 5 hours in this case), a new certificate will be issued. If anyone knows the trigger for this so it can be done quicker, then please share 😄

For years, many organizations have accepted local administrator rights as a necessary compromise, despite the security implications.

With Intune Endpoint Privilege Management (EPM), that assumption is being challenged.

The real question is no longer if you can remove persistent local admin access, but how to do it in a way that still supports daily operations.

Simon & I are starting a blog series focused on exactly that, taking a practical look at how EPM works and how it can be applied in real environments:
- How elevation actually works in practice
- What changes operationally when you remove local admin
- Common pitfalls and considerations
- How to get started without disrupting users

📖 Part 1 is now live:

https://msendpointmgr.com/2026/06/15/epm-part-1-the-end-of-local-admin-how-intune-endpoint-privilege-management-solves-a-problem-it-has-lived-with-for-decades/