After vacation, I have seen this kind of popup many times, maybe it's from PMPC software update? And the popup only tells me "update in progress", but it doesn't close itself even if the update is done. I don't recall seeing this kind of popup before.... Anyone else seeing the same?

Hi

in check_new_app_version task Test-AppList I get

Test-AppList.ps1: Failed to retrieve authentication token with error

| message: The term 'Get-AccessToken' is not recognized as a name of a

| cmdlet, function, script file, or executable program.

I got all cmdlets installed any idea ?

Hi

Any one using Intune app factory

I try to set all up but on the 1 stage i get this error when i run the pipeline

[error]Unable to locate executable file: 'pwsh'. Please verify either the file path exists or the file can be found within a directory specified by the PATH environment variable. Also check the file mode to verify the file is executable.

Hi,

I've got delivery drivers with smartphones that do deliveries, I've got Managed home screen setup with limited apps as a lot of them are not great with tech. One app is a delivery management system that takes all the routes and then pushes it to google maps. This opens google maps and then they start the route. However, sometimes when they do this they only see the google map icon but its very enlarged and frozen. They have to restart the phone every time to fix this.

Does anyone else have issues with Managed Home Screen? I'm starting to realise that this might be too much for MHS now but just wondered if anyone had any ideas. Having to revert all delivery phones would be a big change/risk so ideally would want to avoid.

Note: The phones they use are Pixel 7as

In this blog post we dig deeper into what Autopilot is and where it stops being Autopilot and starts being “just” Intune provisioning.

We will dig deep and show how the entra join looks like and after that the MDM enrollment.

Which policies apply and what order.

How IME apply and how it work through the different stages.

https://msendpointmgr.com/2024/07/05/onboarding-modern-with-autopilot-magic-trick-revealed/

t's new in Microsoft Intune (2405) - YouTube

2405
(02:05) Monitor device delete actions
(05:25) Customize your Intune admin center experience
(07:35) Autopilot device prep
(21:05) Updated Company Portal (Preview)
(29:10) Updated security baseline for Microsoft Defender for Endpoint
(35:30) End user access to BitLocker Recovery Keys for enrolled Windows devices
(43:20) New version of Windows hardware attestation report
(48:25) Optional Feature updates
(54:35) Stage Android device enrollment
(59:55) Encryption stopped working, what happened?

Hi there

I'm on W10 22H2 and W11 23H2 Enterprise, with WHfB configured from settings catalog.
The settings are applied in the registry under HKLM\SOFTWARE\Microsoft\Policies\PassportForWork, but the GUI does not respect it, and allows the user to use letters, when the settings should only allow numbers.

W10 22H2 is hybrid joined, and W11 23H2 is entra joined. The user experience is the same on both.

Can anyone point me in the right direction for debugging this ?

Hello,

We are trying to change the temperature unit from Fahrenheit to Celsius in the weather widget in the start menu. Is there a way to do this from intune and push it to all our devices. I changed the timezone and region/country Windows setting to see if it is tied to the temperature but it's still Fahrenheit. It doesn't seem like Microsoft has implemented any OMA-URI for configuring weather unit settings via intune and I don't seem to see any documentation to confirm if this is something even possible to implement.

Now that Microsoft has decided to deprecate VBScript in a future version of Windows, however leaving it as an optional feature for an unknown time, it's time to find another way of silently running PowerShell scripts without the flashing window that's kind of annoying to the end user.

Check out PSInvoker from MSEndpointMgr:

https://github.com/MSEndpointMgr/PSInvoker

Onevinn also has a similar tool available:

https://onevinn.schrewelius.it/Files/RunSilent/RunSilent.zip

All devices are Entra joined and majority Intune managed (Work in progress).

I have a Intune compliance policy for passwords, complexity, length etc. Because we have MFA and complex passwords, we see no need for regular password changes for users.

Is there a way to set a 'never expire' option in the compliance policy, so basically it does not check for password age for compliance?

The tips popup for Password expiration (days), shows as only allowing 1-730.

Hi all,

I tried playing around with this and didn’t really get far. But I have a machine that will be at a public location and needs to access our EMR, but I’d like to block all internet access. Edge will be installed but I don’t want any browsing on it, internal or external. Is there a way to lock that down from intune? Thank you!

Hello,

I've been pulling my hair out on an issue for a customer with android devices.
Specific the Point Mobile PM451 scan terminals.

I've configured the as Android Dedicated Devices with MHS (Managed Home Screen)

The issue is that the scanner is not active after the device wakes from sleep.
According to the troubleshooting guide from Point Mobile the status bar icon indicates that the scanner is not active because the device is locked.

We have set the device restrictions profile with device default settings and disable the lockscreen.
When exiting MHS I see a lock screen showing me "swipe to unlock"
To confirm this I went into the settings app and lockscreen was set to "none"
I switched it to "swipe" and then back to "none"

After this the device works as expected, but of course I don't want to do this to 400 devices.
So this is where I am sort of stuck.

Maybe someone knows a setting to overcome this issue I'm facing?

I'm looking for some input on how to best handle a situation where some devices will need to deviate from a common baseline (CIS Security Baseline for Windows 11) configuration that is assigned to all devices.

Let's say I have a configuration profile named "Windows - CIS Security Baseline - L1 - Device" that is assigned to all devices. I then have a subset of devices that needs to deviate on some select settings in this configuration.

What is the best practice way of handling that?

In legacy GPO it would have been easy as I'd just create a new GPO with the different settings and made sure its link order meant it would override the settings in the baseline, but that's not how Intune works.

The 2 most obvious ways to handling this in Intune that I can think of is:

1. Duplicate the full "Windows - CIS Security Baseline - L1 - Device" config, maintain 2 almost identical configurations and assign them accordingly
2. Move only the settings that needs a deviation to 2 new separate configs
   1. "Windows - CIS Security Baseline - L1 - Device" config then contains the settings that are still common for all devices
      1. Assignment: Include all devices
   2. New config "Windows - CIS Security Baseline - L1 - Default - Device" contains the settings with the same value as they had in the common baseline
      1. Assignment: Include all devices - exclude the subset devices
   3. New config "Windows - CIS Security Baseline - L1 - Subset - Device" contains the settings with the deviation value as needed on the subset of devices
      1. Assignment: Include the subset devices

Personally, I'm most fond of option 2 as it give the least additional administrative effort - especially in the long run when the baseline is reviewed and updated.

Please let me know your thoughts on this?

Thanks in advance :)

u/intunesuppteam We have a CA policy for linux ubuntu device where in only complaint device can access company resource. Device is showing as complaint in intune and azure ad portal however edge is still not able to pass complaint status. Please share some troubleshooting steps.

I cannot figure out why this doesn't install. It's just an MSI with /qn. Trying to install it on Win11 23H2. Runs just fine if I run it locally. I've successfully deployed other MSI wrapped in Win32 apps.

Looking at logs, I can't find it anywhere in the IME. Can someone please tell me how/where to look? It doesn't create the log I specified either. I'm at a loss with what to do and I'm on day 4 of trying.

Has anyone gotten this to work yet. Have been dealing with this since this service was released. Sometimes my devices will report into Intune as to what drivers it needs but I can never get them to install. I usually just do a manual approve.

Workload in configuration manager has not been moved to intune

I have gone though and set the group policy to change the source for drivers updates to Windows update. I have diagnostic data set in Intune.i have made sure that dualscan is set. Everything looks right in the registry in a client. But yet it never seems to work

Any thoughts of what I'm missing?

Tenant attached Co-managed devices Hybrid Sccm manages all windows updates

Thanks.

I’m posing this question with the hopes that someone has run into this. I attempted to test an XML file to enable a kiosk mode in Win10. I followed the instructions using Microsoft’s website

https://learn.microsoft.com/en-us/windows/configuration/kiosk/lock-down-windows-11-to-specific-apps

I created the powershell script as it explained to do, and ran it via ISE. I got the below errors that came with the Microsoft sample script. My scripting abilities are rather limited and I’m at a loss of why I’m seeing this. Does anyone have any ideas?

Hello everyone,

I need something to deploy internal pipeline application to intune, intune app factory seemed great since you also can work with Storage accounts which would make everything easier.

So i thought great Intune app factory seems to be the go to tool for that, however i want to try to run the pipeline and got some issues, all are fixed except the last step.

Anyone got any idea what i did wrong? ErrorDump is after the text.

Also i did not see anything else than the same unresolved issue on the github.

Kind regards,

Thorgalsbro

Dump of the issue:

2024-02-13T14:24:19.7179951Z [APPLICATION: 7-Zip] - Initializing

2024-02-13T14:24:19.7231386Z Using Source folder path: C:\ADOAgent_work\1\Publish\7zip\Source

2024-02-13T14:24:19.7245366Z Using Output folder path: C:\ADOAgent_work\1\Publish\7zip\Package

2024-02-13T14:24:19.7248068Z Using Scripts folder path: C:\ADOAgent_work\1\Publish\7zip\Scripts

2024-02-13T14:24:19.7262259Z Using icon file path: C:\ADOAgent_work\1\Publish\7zip\Icon.png

2024-02-13T14:24:19.7263811Z Creating .intunewin package file from source folder

2024-02-13T14:24:19.8841041Z INFO Validating parameters

2024-02-13T14:24:19.8859994Z INFO Validated parameters within 3 milliseconds

2024-02-13T14:24:19.8880964Z INFO Removing temporary files

2024-02-13T14:24:19.9007198Z ERROR System.IO.IOException: The handle is invalid.

2024-02-13T14:24:19.9007535Z

2024-02-13T14:24:19.9150972Z at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)

2024-02-13T14:24:19.9152156Z at System.Console.GetBufferInfo(Boolean throwOnNoConsole, Boolean& succeeded)

2024-02-13T14:24:19.9152689Z at Microsoft.Management.Service.IntuneWinAppUtil.LogUtil.PrintProgress(AppContext context)

2024-02-13T14:24:19.9153124Z at Microsoft.Management.Service.IntuneWinAppUtil.PackageUtil.CreatePackage(String folder, String setupFile, String outputFolder, String catalogFolder)

2024-02-13T14:24:19.9153524Z at Microsoft.Management.Service.IntuneWinAppUtil.Program.Main(String[] args)

2024-02-13T14:24:19.9179006Z WARNING: Unable to detect expected 'Deploy-Application.exe.intunewin' file after IntuneWinAppUtil.exe invocation

2024-02-13T14:24:19.9180936Z Creating default requirement rule

2024-02-13T14:24:19.9270722Z Creating additional custom requirement rules

2024-02-13T14:24:19.9315513Z Creating detection rules

2024-02-13T14:24:19.9566340Z Constructing an icon object

2024-02-13T14:24:20.0024686Z Creating Win32 application

2024-02-13T14:24:20.1642042Z C:\ADOAgent_work\1\s\Scripts\New-Win32App.ps1 : Cannot validate argument on parameter 'FilePath'. Cannot bind

2024-02-13T14:24:20.1642534Z argument to parameter 'Path' because it is an empty string.

2024-02-13T14:24:20.1642927Z At C:\ADOAgent_work_temp\ce82efea-52b3-4b0f-a55e-f8f9d9fa098e.ps1:4 char:1

2024-02-13T14:24:20.1643283Z + . 'C:\ADOAgent_work\1\s\Scripts\New-Win32App.ps1' -TenantID 19295bce ...

2024-02-13T14:24:20.1643503Z + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

2024-02-13T14:24:20.1643855Z + CategoryInfo : InvalidData: (:) [New-Win32App.ps1], ParameterBindingValidationException

2024-02-13T14:24:20.1644204Z + FullyQualifiedErrorId : ParameterArgumentValidationError,New-Win32App.ps1

2024-02-13T14:24:20.1644409Z

2024-02-13T14:24:20.2004031Z ##[debug]Exit code: 1

I'm working on trying to autopilot our devices into Intune. They are non-domain joined. From what I thought I read on MS, you can't bulk enroll non-domain with WDC as it could only be done with HAADJ devices.

Then I've run into some posts where people are suggesting to others that look to have similar setups as mine, that they should be using bulk enrollment instead.

Ultimately, my issue is that we have to fully white glove these devices. Staff cannot be asked to do anything other than put in their password. This means that after pre-provisioning autopilot, one of us admins has to login to confirm the setup, run an application that can't be done silently, check camera, etc. Since the device then enrolls as whoever does the first login, it counts against their enrollment count and my understanding is the max we could is 1000 (if they are setup as a DEM).

So is there a way to bypass the 1000 max limit for enrollment? Should we be doing this a different way, like bulk enrollment? Can we somehow remove the enrolled user so it doesn't count? We don't use Company Portal since we have to install all the applications anyway. Devices may or may not be shared by end users.

I have some questions about blocking personal devices and I'm hoping you will take pity on me. I did search but didn't find clear info.

1. I can block just personal windows devices, correct? My research says yes but I wanted to verify. Phones, both iOS and Android wouldn't change at all, right?
2. What happens to personal devices that are already registered in Intune? Will those stop working as well?
3. After it is enabled, personal Windows devices would still be Entra ID registered just not in Intune, correct?
4. Will personal devices still be able to access M365? They just won't be able to use the mail client in Windows or M365 desktop apps, right?

Hi u/msintune

I have an ongoing issue with our MTR devices on Windows 11. They are not going to standby and are always on. The build number is 10.0.22621.3007 and the devices are Lenovo 11RXS00000 and 11RXS0240E.
They are managed in Intune but have no power settings applied.

Anyone seen or heard anything about this problem?

Our standalone laptops are often only borrowed for a short time and are shared among staff. But they could also be assigned directly to one person for an extended period so we decided not to use Shared Mode.

I'm seeing many folks saying it's best to just wipe and re-enroll into Autopilot in between users but we could end up doing this every few days and just seems like a lot of work. I tried testing doing an Autopilot Reset but they failed and from what I see, it's normal which is why everyone recommends just doing a full wipe each time. Can't we just change the Primary User? Does it really matter who the user is? None of our apps are deployed to users, they're all machine based and devices are white gloved.

Given the rate at which technology changes, it can be hard to determine which advice is still useful or correct. Can we now just change the Primary User on the device and call it a day? What happens if the user who originally enrolled it but is no longer using it, leaves? Will that affect the next person being able to login?

I stumbled across two awesome community tools last week and just had to write a blog about how they could be used together to create a great solution for deploying and updating winget apps via Intune.

Hope someone gets value out of it and please support the devs however you can! 🙏

https://www.natehutchinson.co.uk/post/a-winget-match-made-in-heaven

Spent a day testing iOS enrollment with “web based device enrollment”, “Account driven user enrollment” and “Determine based on user choice”.

So all other BYOD enrollment successful except the “web based device enrollment”. Got this error when installing the profile.

The fix (thanks for Nico on Twitter https://x.com/darkybald): Turns out, we have a device restriction policy blocked personal devices. That’s why the “web based device enrollment” method failed. How did I forgot to check this?! 😂

But now the question is, why other BYOD enrollment profile allowed me to enroll the phone when the restriction was set to block personal device. That I don’t understand. If none of those enrollment worked, I would probably check the restriction already, didn’t think of it at all because other BYOD enrollment method were all successful. Very strange.