Hi Team,

I have noticed in our environment, we have country codes per device category and the company portal page always has them all listed in a random order to choose from instead of like alphabetically. So I also did a quick test with my personal tenant and it’s doing the same thing? What am I missing here? As it’s tricky when we have a list to scroll of 40 and trying to spot the our country becomes a bit of annoying activity for our users. Please and thank you.

Setup a multi-app Kiosk via Intune using XML and having an issue with getting simple printing to an HP printer. I allow the settings app and if a user connect the HP printer via USB or other methods, they can see the printer just fine. Using the Settings UI for Print Test gives a "restricted error", same if trying to print from Microsoft Edge. Anyone get this to work properly?

I’m an Intune admin, I sit in the portal pretty much all day, and these drive me up the wall:

• working out what policies, apps, scripts and remediations are actually assigned to a group (there’s still no report for this, I checked)
• syncing more than 100 devices without making temp groups or running a script
• bulk adding devices to a group by name, instead of going and digging up every object ID first
• finding which of my policies set a particular setting, or if anything sets it at all. Basically Lewis Barry’s intunesettings.app, which a lot of us already use, but joined up with a search of your own tenant’s policies

So I built a little browser extension that sits in a side panel next to the admin center and does those things (and a few more, like a conflict finder, fleet baseline/drift, primary device lookup, discovered app rollups). It uses the session you’re already signed in with, so there’s no app registration and nothing for a GA to consent to.

Before anyone asks, yeah I know there are scripts and portals that do bits of this. I’ve used a bunch of them. I just wanted it all in one place, right next to the portal, without setting up Graph modules or an app reg every time. Whether mine’s better is up to you, I’d rather you try it and tell me.

And yes I used AI to help write the code, I’m not going to pretend otherwise. The ideas, the testing and the “why the hell doesn’t Intune do this” all came from sitting in the portal every day.

On the security side, I know “extension that reuses your Intune session” sounds sketchy so I wrote up exactly what it does: what permissions it has and why, what leaves your browser (basically nothing, tokens only ever go to Graph like they do from Intune itself), and the two things it can change (add members to a group, sync devices, both behind a confirm). Code’s unminified too so you can read it. finetune.tools/security

There’s a demo on the site that runs the real extension on a fake tenant if you don’t want to install anything.

Pricing, so nobody feels tricked: it’s free for one person per org for six months, then US$80 once for a licence. No subscription. Anyone else can do a 14 day trial. Recast charge for Right Click Tools too, this is just a lot cheaper. I’m one person building this after work and I want to keep supporting it and adding to it over time, so I do want something out of it to keep the lights on.

Mostly though I want it in as many hands as possible and I want to hear what annoys you. What’s the repetitive stuff you do in Intune that should just be a button? If it’s doable I’ll build it.

finetune.tools (Chrome store listing is in review, unpacked download is on the site for now)

We made the 26H2 update available within the Intune update rings last week, but as of today, the targeted device groups devices have not received it. Has anyone seen any delays with this feature update when managing updates via Intune?

We've never had issues in the past and nothing has changed with our update setup. I checked to make sure there were no local conflicting GPOs under Windows Updates > Advanced options > Configured update policies on one of the devices. All are pointing to MDM or Cloud.

Hey everyone,

Last week, I ran into an issue on both Windows 11 25H2 and 26H2 where a Microsoft Edge policy deployed through the Intune Settings Catalog randomly stopped applying. The policy is supposed to disable access to Edge's built-in password manager.

In Intune, the policy shows as successfully applied (green), and the corresponding registry key is correctly present on the affected devices. However, Edge seems to randomly ignore the policy.

I'm seeing this behavior with Edge version 154.0.4258.62. After restarting the device, everything works as expected again, but the issue eventually comes back. Since these devices have been enrolled and managed for quite some time, I don't think this is a deployment-related issue.

The problem is also clearly visible in the Edge settings. When the policy is working correctly, the password manager setting is greyed out and marked with the briefcase icon indicating that it's managed by the organization. When the issue occurs, the briefcase icon disappears, the setting becomes configurable again, and the password manager is enabled by default, allowing users to use it even though the policy should prevent this.

I've already checked the local device logs but couldn't find anything unusual that would explain this behavior.

Has anyone else experienced something similar with Edge policies randomly not being enforced, even though Intune reports them as successfully applied and the registry keys are present? I'm curious whether this might be an Edge-specific bug or if others are seeing the same behavior.

Thanks in advance for any feedback or insights :)

Currently we are managing devices via Intune through Entra Connect and I’m wondering whether it would be possible to switch to Entra Cloud Sync or Device Sync instead as we have 3 locations using the same tenant.

I couldn't find any information online regarding Windows Autopilot.

Has anyone had experience with this setup or successfully implemented it? I’d appreciate any insights or recommendations.

Hi everyone,

I'm currently working in an environment that historically used SCCM for Windows deployment and device imaging.

With SCCM, the IT team was used to defining a set of applications to install during the imaging process through Task Sequences, without automatically deploying those same applications to devices already in production.

We're now using Intune and Windows Autopilot, and we're trying to achieve something similar.

Our current setup:

• Most applications are assigned as Required to device groups.
• Most of these groups are dynamic, based on Autopilot Group Tags or criteria such as Windows 11 devices or devices names.
• Applications are installed during Autopilot provisioning, we don't use the Enrollment Status Page (ESP) option to 'Block device use until all apps and profiles are installed'
• Once provisioning is complete, devices remain members of these dynamic groups and continue receiving any new Required applications assigned to them.

What we're trying to achieve:

We want to be able to update our standard application baseline for newly provisioned devices without impacting existing production devices.

For example:

• Today, we decide to add Application X to our Autopilot provisioning baseline.
• We want Application X to be automatically installed on all newly provisioned devices.
• However, we don't want Application X to be automatically pushed to the 2,000 devices already in production.

The goal is not to stop managing applications through Intune after provisioning. We simply want to separate initial device provisioning from ongoing application deployments, similar to what was possible with SCCM Task Sequences.

My questions:

1. Is there a recommended way to achieve this with Intune and Autopilot?
2. How do you separate applications required during initial provisioning from applications deployed to existing devices?
3. Do you use temporary device groups, Microsoft Graph automation, Win32 app requirement scripts, or another approach?
4. For those who migrated from SCCM to Intune, how did you handle this change in deployment strategy?

I'm particularly interested in real-world experiences and solutions that are relatively simple to maintain at scale.

Any feedback, recommendations, or lessons learned would be greatly appreciated !

Thanks in advance guys !

Our corporate iOS devices have started acting strange after being wiped. They are displaying the exact issue outlined in the blue "Important" notice on Microsoft's article about transitioning from userless to user affinity (Linked HERE). The Company Portal prompts the user to sign in and attempts to download a management policy that has already been automatically applied during enrollment. We are using the new Enrollment Policies set to Enroll with User Affinity and Setup Assistant with modern authentication. There are no options to "Install Company Portal" to leave unchecked like Microsoft indicates.

The device has never been enrolled without user affinity, so I don't know why it is confused. I've fully wiped the device several times, and even removed it from the organization in ABM and re-captured it with the Configurator app. This has happened to the last two devices we have needed to set up. We need the company portal app for "available" app installs.

Anyone run across this issue?

I have a problem with a windows device. I want to install a new image. Normally i would to that with a USB stick. I think a wipe isnt a clean install, onlyna reset? Can i use cloud rebuild feature? When i click cloud rebuild, how would the device handle that when it is intune joined? I think i should disable bitlocker?

Intune Portal home broken again. All status's showing Unknown.

AsiaPacific 0101

I am new to Intune… We have a large fleet with some sub-fleets. The one sub-fleet changes users frequently because these phones are used for specific international travel. Is there a way to preload the user to save set-up time with a dynamic group? Also curious if anyone has experience with pushing/deploying and activating an eSIM through Intune?

Hitting an odd issue with android app protection MAM-WE, no device enrollment and wondering if anyone else has seen it.

On non-Samsung phone, shows Samsung device attestation warning on app launch. The OK button can’t be pressed.

Has anyone seen this on non-Samsung android and what fixed it?

First time onboarding ABM. Got the confirmation that my organization was successfully enrolled, but I’m stuck at the Terms & Conditions screen. Every time I click Agree, I get “An error occurred while saving. Try again later.”

Tried multiple times. Still fucking broken.

Has anyone experienced this before? How did you resolve it? Would appreciate hearing your experiences.

Thanks,

I'm trying to get the "Scanner" "System App" installed on a Xiaomi Redmi phone.

The Scanner app is necessary to enable QR Code scanning functionality in the default Xiaomi Camera app.

I've created an Android App in Intune:

• App Type:
  
  • Category: Referenced app
  • App type: Android Enterprise system app
• Add App:
  
  • Name: Xiaomi: Scanner App
  • Publisher: Xiaomi
    
  • Package name: com.xiaomi.scanner

I've created a Device Group in Entra for Xiaomi phones and added the phone to that Group.

I've assigned the Android App in Intune as a "Required" app for the Xiaomi Device Group.

I can see the app attempting to install for the assigned device in Intune, but it is failing with the following information:

Device platform: Android 16
Status: Failed
Status details: The application failed to install, possibly because of insufficient storage or an unreliable network connection. The installation will be retried automatically. (0xC7D24FBA)

But this is a brand new, just-provisioned device with plenty of free space, the Scanner app is small, and there is no problem with the network (Intune had no problem installing a couple dozen other required and optional "normal" apps from the Managed Google Play store).

There aren't many settings for me to play around with here, and nothing seems obviously wrong. Microsoft's guidance doesn't offer me any new information: I am assigning the App to the Device group (not the user) as Required, not Available.

I found this guide which also seems to follow the same steps I already figured out myself.

I am having the same issue trying to add the System Apps of Xiaomi Compass (com.miui.compass) and Xiaomi Calculator (com.miui.calculator).

Does anyone have any experience with a similar situation?

https://techcommunity.microsoft.com/event/windowsevents/windows-office-hours-october-15-2026/4529260
"Every third thursday we will have these chats.
Post your questions in the Comments early and throughout the one-hour event.
This is a chat-based event. There is no video or live meeting component."

I'm struggling with the Company Portal. What is the correct way to roll out that app during Autopilot? Right now, it seems to be throwing errors that break my enrollment (just the generic errors about an app failed to install) and while it's a given I'm doing something wrong, I'm wondering how to rectify it.

Happy Friday Everyone!

We’re happy to provide some details today about the Workplace Ninjas US Hackathon on the preday of January 11, 2027 at the event sponsored by WorkspaceDNA

Firstly, our 5 captains are 5 special experts (3 MVPs and 2 former MSFT employees):

🪄 Merill Fernando, the master of Maester who was a judge last year, joins us as a team captain.

🔥 Ugur Koc, the reigning champion who absolutely crushed the competition last year delivering both an app and an agent will return looking to repeat.

⚗️ Michael Niehaus the creator of DeployR, hybrid autopilot lover, and the godfather of MDT will captain the 3rd team

🍺 Joery Van den Bosch graduates from team member to captain, hoping to unseat Ugur Koc and build something magical to celebrate his new role at Robopack

👩‍💻 Jonah Andersson, the brilliant new addition to our event and the hackathon will join us as the 5th captain. She’s an amazing talent and one of the biggest threats to taking down Ugur!

We also have some surprises coming, like a hacker team that will red team the hackathon teams to mess with them and have some fun at their expense, which is currently being formed led by Nathan McNulty and a few other surprise guests who will add a wrinkle or two to the event.

We’ll have some additional tricks or treats to make the competition interesting, because it wouldn’t be an event without a bit of entertainment.

Our major change this year, our captains will pick their teams from the people who attend the hackathon in a round robin format. We will be drawing the draft order soon, but this will primarily be live to give more people the amazing opportunity to be part of it.

One other thing, meet our amazing referee in Lindsay Shelton who will be making sure teams don’t try to cheat again this year. She’s ready to dole out all sorts of punishments for rule breakers!!

It wouldn’t be an event at WPNUS without great food and drinks.

We will be providing an open bar and an amazing “South of the Border” buffet with:

🍗 Chicken Tinga
🐷 Pork Carnitas
🥩 Carne Asada
🥗 Cilantro Rice, Pinto Beans, Cheese, Sour Cream, Salsa and much more!
🍟Churros with Mexican Chocolate

The winning teams will receive all sorts of amazing prizes post event including one of our 📎Clippy Awards!!

Register now: https://web.cvent.com/event/a9994d6b-9e67-4873-9401-737ca7fe088a/websitePage:84ea0617-1d40-48d4-81a3-cf4ea689d8fa

Just wanted to know how IT admins have had any downloads issues when using edge , where downloads will hang then shortly finish. I am not sure if this is a pua issue or smart screen or maybe both . Would love any feedback

I'm struggling with a fairly minor inconvenience related to Power Apps.

Goal: Have a one-click app that immediately moves our users to the created and deployed power app. Not the actual power apps app but the canvas-app I created in it.

Struggle/issue: The created webapp asks first if they want to open it in the app or the browser.

I cannot for the life of me seem to figure out how to change this behaviour.

Things I've tried: App settings to set standard and supported links. These settings don't seem to work or they somehow miss the app launch.

I have attempted to alter my URL to several things along the lines of ms-apps:// and so on. The managed google play web app does not like any of these links.

If I can't find a solution I'll probably have to just package the thing and push it that way but this will make future maintenance and management of this app more tedious.

Is there anyone with similar issues in the past that has managed to overcome them?

Wondering if anyone has advice for getting sharepoint document libraries to sync quicker on new user logins. Got a client where users are frequently switching devices and experiencing pain with their document libraries not syncing to explorer in a timely manner due to the up to 8 hour built in delay.

Windows laptop which are exclusively intune managed and using shared pc with onedrive config policy. Different users have different document library access so programming a script to open specific libraries with odopen: doesn't seem like the right option

I've got the folder sync set as a device policy currently because user policies can take ages to apply for shared devices.

Tried a platform script that sets the automount timer shorter but I'm not an expert in scripting so if anyone has something that works well or advice on getting it to work better that'd be amazing.

Any advice is appreciated. I know a common response to this is user training on pressing the sync button, but it isn't really feasible in this specific case and it feels like a solvable problem. I've read a million forums and posts about this issue, hoping having a live post to reply to may help

Thanks!

-update The amount of morons commenting you just shouldn't use auto sync is ridiculous, we're in IT to make systems work well and be functional to end users - companies moving from mapped file servers to SharePoint need functionality to continue working in desktop applications as seemlessly as before, otherwise we're going backwards and creating inconvenience. Thanks to 2 people with actual suggestions for automount timer scripts

Anyone else seeing some UI issues with the Intune Admin Center? Examples include:

• The Status section of the Home page just displaying "Unknown" for the various options.
• The Status section of the Devices > Overview section also not loading.

I don't see any reports in Service Health. There are some reporting advisories for M365 Admin portals, but nothing stands out as flagging Intune. I've tested in Chrome/Edge, incognito and I even purged my entire cache. Same behavior.

I have a strange serial number on my Autopilot devices. It’s just an “n.”
What does that mean? Could this just be a temporary error?

The device has been in Intune since October 2, 2026, and added itself as an Autopilot device because I configured it that way after migrating it from SCCM. For all other devices, you can see their serial numbers as usual, but for this one, only an “n” is displayed. Unfortunately, I don’t have physical access to the device because I can’t even identify exactly which device it is right now.

Just took the MD-102 exam today and unfortunately failed with a 662 (passing is 700). Honestly, I found the exam pretty tough.

How I prepared:

I put in about 20-30 hours of studying. I set up a free tenant, completed a few hands-on lab assignments, and generated a comprehensive study guide + practice exam using Claude AI (which I passed).

My weak areas according to the score report:

Deploy and update apps

Monitor and optimize health

Configure endpoint security

It feels like the AI study guide and free tenant labs gave me a solid foundation, but the exam questions were way more tricky and specific than I anticipated.

For those who passed (or also struggled), what resources would you recommend for my retake? Specifically for those three weak areas? Any highly recommended practice tests or specific MS Learn modules that accurately reflect the real exam's difficulty?

Any advice is much appreciated!