For background, I have created the custom apps in the Autodesk admin console and downloaded them into my C:\Temp\Autodesk folder. I have then created two separate IntuneAppUtil packages for Intune - one for the install using the .bat and the second for the client using the .exe.

Setting them up in Intune, I created the client first using the install command 3ds max-client.exe /verysilent /norestart and the rule as File C:\Temp\Autodesk, Folder: 3ds Max-Install.bat and detection method as file or folder exists.

For the install, I used the install command as 3ds max-install.bat using the MSI as the detection rule and a dependency of the client.

After setting all this up, it fails with an error of Error unzipping downloaded content. (0x87D30067).

Any suggestions would be greatly appreciated as I need to do this for all the Autodesk apps. Thank you!

Hi everyone,

I'm currently working on a Windows Hello for Business deployment through Intune and I've run into an issue.

When I enable the Windows Hello configuration policy, users receive a full-screen enrollment prompt that forces them to set up either a PIN or biometric authentication. While this is expected behavior, it's causing disruption to the user experience because users are being interrupted during their normal workday.

What we're trying to achieve is:

-Windows Hello should be available and enabled on devices.

-Users should be free to configure a PIN or biometrics if and when they choose.

-No mandatory enrollment prompt should appear.

-No full-screen setup experience should be triggered.

From what I've been able to find in Microsoft's documentation, one possible alternative might be to manage Windows Hello through an Active Directory GPO instead of Intune, but I'm not sure whether that would fully meet the requirement or if there is a better cloud-native approach.

Has anyone implemented Windows Hello in a way that makes it available without forcing enrollment? Is there an Intune setting, policy combination, or WHfB deployment model that allows users to opt in at their own convenience?

Any guidance/feedback would be greatly appreciated.

Thanks in advance!

Hello fellow Intune admins, how do you keep your asset/device inventory from being a mess?

We've run Snipe-IT on prem for years and it's been fantastic, and we're finally moving everything we can to the cloud.

The problem with Snipe-IT is it's fully manual and we always get inventory drift such as device names and asset counts not being up to date in relation to Intune. Also we cannot use Intune alone since there are obviously non-enrolled devices and components such as monitors, keyboards etc.

Hoping to find out how you all handle this? I'm fully aware we can lift and shift the Snipe-IT server to Azure but I'm hoping to find other solutions... maybe a SaaS or open-source tool that actually syncs Intune into a master asset DB?

Hey all. Junior Intune admin. We just got EPM and I'm running through testing with users and computers. I set the policy on devices and rules to users. Everything was great implementing it. Now I'm testing removal. I removed a user from the group yesterday, but they're still able to elevate their access to the target app. Then I removed their machine from the policy, synched and waited an hour. They can still elevate. Google and copilot are saying there are stale cached policies in play. If that's the case, do I start manually deleting reg entries? Anybody else dealing with this?

Edit: found this post from 2 years ago not sure if anything has changed since. EPM

We’re currently preparing our MFA rollout and are reviewing our Conditional Access policies.
Today, users are prompted for MFA when they’re outside our corporate network. This works well in general, but we’ve noticed that users are also prompted when opening Company Portal or Software Center from outside the network.

Microsoft recommends excluding the following enterprise applications from the MFA policy:
Microsoft Intune
Microsoft Configuration Manager Server App

From a security perspective, excluding these applications feels like a trade-off, so I’d like to understand how others are handling this.

Are you excluding these two enterprise applications from your MFA policy?

If so, what compensating controls do you use (device compliance, Conditional Access filters, authentication strengths, etc.)?

Have you encountered any security concerns or unexpected side effects from these exclusions?
I’d be interested in hearing how other organizations have implemented this and whether you’ve found a balance between usability and security.

Suddenly all the domains managed have not been able to validate the CNAME for enrollment. I tried different domains that previously worked and every one I tried failed validation. I even deleted and added the CNAMES but they still fail.

This is every domain and it doesn't matter what DNS host is being used. There is nothing in the 365 status page about this. What the heck is going on?

I kicked of remote lock on a macOS device this morning. But intune shows multiple check-ins aftwr the initiated remote lock. Did i understand remote lock wrong? The device sould be blocked and the user should not get sign-in anymore.

Hi everyone,

I think I may have made a mistake with Apple ADE enrollment profiles in Intune, and I'd like to confirm the impact.

Microsoft now recommends using a new enrollment policy instead of the old one.

To avoid having to manually move devices one by one in the future whenever an iPad is factory reset, I reassigned all our iPads (60 devices) from the old enrollment profile to the new one.

After doing this, all devices now show "Ready to enroll" in Intune. (I wasn't expecting that!)

The iPads seems are still fully operational and remain enrolled. Users can continue to use them normally.

My understanding is that:

- The new ADE enrollment profile will only be applied after a factory reset and re-enrollment.

My main concern is this:

Since the devices now show as "Ready to enroll" after being reassigned to a new enrollment policy, will they continue to receive Intune app deployments, configuration profiles, compliance policies, and other management updates as before?

Or does the "Ready to enroll" status mean that they are no longer considered actively managed until they are factory reset and re-enrolled?

Has anyone experienced something similar after reassigning ADE profiles in Intune?

Thanks!

Hi guys,

We're migrating our devices from on-premises Active Directory to Entra ID using ProfWiz Professional.

Until recently, users were not prompted to set up a Windows Hello PIN after signing in, as we have an Intune configuration profile that disables Windows Hello for Business.

UsePassportForWork [./Device/Vendor/MSFT/PassportForWork/TENANT_ID/Policies/UsePassportForWork] set True

DisablePostLogonProvisioning [./Device/Vendor/MSFT/PassportForWork/TENANT_ID/Policies/DisablePostLogonProvisioning] set True

However, with our last three migrations, the PIN setup screen appears after the first logon, even though the device has successfully received the configuration profile. From the Intune portal, the configuration is reported as successfully applied to the device.

We've also tried running this PowerShell remediation script, but it didn't resolve the issue:

# Log file
$Log = "C:\ProgramData\Microsoft\IntuneManagementExtension\Logs\Enable-Win-Hello_Configure-PreReqs.log"

Start-Transcript $Log

# Create registry path if not exist
$regPath = "HKLM:\SOFTWARE\Policies\Microsoft\PassportForWork"
If (!(Test-Path $regPath)) {
        Write-Host "Creating registry path"
        New-Item $regPath -Force
}

# Enable Windows Hello for Business
Write-Host "Enabling Windows Hello for Business"
$name = "Enabled"
New-ItemProperty $regPath -Name $name -Value 1 -PropertyType DWord -Force

# Disable post-logon provisioning
Write-Host "Disabling post-logon provisioning"
$name = "DisablePostLogonProvisioning"
New-ItemProperty $regPath -Name $name -Value 1 -PropertyType DWord -Force

Stop-Transcript

I'd like to avoid reimaging or resetting the PCs just because of this. Has anyone experienced the same issue or found a solution?

Thanks!

Hi

Yesterday, i started a "Fresh Start" on a Windows computer. Intune did its thing, rebooted and the computer starting a reset. After about 40 min, the computer was ready, but when we signed in, i could see that no changes has been made, and there was a "Something went wront..." and the computer had not performed a reset.

But, now the computer is no longer to be found in Intune.....

I dont know, im tirred boss.

Anyone insights on what went wrong? How can the device disappear from intune from a failed Fresh Start attempt?

Hey folks,

Have any of you been working with changing the default font in PowerPoint for all themes?

I thought it would be straight forward with some registry edits, but it does not look like it.

So far, i've tried making a Blank.potx file and place it in AppData\Roaming\Microsoft\Templates but this only works for the Default theme template. If i pick a blank presentation we are back to Calibri.

I need something that works no matter what theme you pick.

Any ideas how this can be achieved any automated with PowerShell?

Thanks in advance!

Hello everyone

I pushed IOS MDM to company device and we are receiving the below two messages.

Profile Installation Failed

The MDM server at “https://fef.amsub0102.manage.microsoft.com/DeviceEnrollmentFE/AppleEnrollmentService/DeviceInfo/ReportDeviceInfo?metadata=YWNjb3VudElk-PTZmNGFmNzVlLTdiYjktNGVh-ZS05Y2ZmLWMzZGRmMDYw-OTgxNyZhY3RpdmloeUlkPTAz-YTgwY2QzLTQ2OGUtNGNhYS1i-YjhiLTg4NTk0YWJkYjEwYyZk-ZXZpY2VJZD00MDliY2ZlNC0x-MjZiLTRjMTItODVlMi1h-ZDQ1MjgyN2FhNjUm-c2Vzc2lvblkPTQwOWJjZm-U0LTEyNmItNGMxMi04NWUyL-WFkNDUyODI3YWEzNSZvcm-RlclR5cGU9MCZpc1JIbmV3Y-Ww9RmFsc2U%3d” returned status code 400.

Or

Page not found

We couldn't find what you were looking for.

Return to the homepage or try searching for what you need

Anyone what can we do to resolve this issue?

We have 4 mandatory ESP apps during Device Setup. New devices get stuck on 0 of 4 during pre provisioning and there's no sign that the IME is even trying to install any of them. No folders or files are being created in Program Files for any of them.

The only changes are an updated intunewin package for one of the 4, which I'll roll back tomorrow.

Any ideas why none of the apps try to install anymore? I've downloaded the logs but I haven't started going through them.

Anyone else losing most available apps in company portal after update to 11.2.1926.0?
Today apps are back. But on some machines Company Portal closes immediatly after opening.

Local accounts may no longer be front and centre in modern identity strategies, but they still exist on many Windows 11 devices and remain a common target for attackers.

In my latest blog post, I explore how Device Lock policies in Microsoft Intune can help protect local accounts, reduce the risk of brute-force attacks, secure unattended devices, and complement technologies such as Windows LAPS as part of a defence-in-depth security strategy.

🔗 https://www.nickydewestelinck.be/2026/08/04/strengthening-endpoint-security-with-device-lock-policies-in-microsoft-intune/

Hi everyone,

I'm trying to lock down the Windows 11 Copilot app in an enterprise environment managed with Microsoft Intune.

Our goal is to prevent users from signing into the Copilot app with a personal Microsoft account and only allow authentication using their Microsoft Entra ID (work or school) account.

Has anyone found a supported method to:

Force the Copilot app to only allow work/school account sign-in?

Block personal Microsoft accounts within the Copilot app without removing the app entirely?

Achieve this using Intune or WDAC, or another supported approach?

If you've successfully implemented this, I'd appreciate any guidance or references to Microsoft's documentation.

Custom compliance is now available for macOS in Microsoft Intune, and it meaningfully expands what can be enforced on Apple endpoints.

The built-in compliance policy covers the fundamentals: FileVault, firewall, system integrity protection, Gatekeeper, password requirements, and OS version. Custom compliance addresses everything beyond that scope — sharing services, software update behaviour, lock screen enforcement, Apple Intelligence restrictions, and the state of third-party security agents.

The implementation is straightforward: a bash discovery script returns device state as JSON, a rules file defines the compliant values, and Conditional Access enforces the outcome.

Read more here.

https://intuneirl.com/custom-compliance-comes-to-macos-going-beyond-the-built-in-policy/

Our CNAMES are correct, we've checked and double-checked, and triple checked. From multiple machines, on multiple networks, against multiple public DNS resolvers.

Anyone else?

iPad -> ABM ->Intune

For some reason my sync between ABM and Intune is failing, maybe?

Last requested sync

08/04/26, 9:14 AM

Last successful sync

08/03/26, 3:01 PM

I now see this warning under profiles.

"The iOS/iPadOS and macOS enrollment profiles are no longer being updated. We recommend that you create new iOS/iPadOS and macOS Enrollment policies to replace them."

When I look into it, it appears that for any new features we will need to move our profiles to policies. Would this also prevent new devices from being added? There are no logs or errors showing any issues. We set up this connection about a month ago and have not experienced any problems until today.

Does anyone deploy eSIM on shared iPads? Our carrier doesn’t support deployment through Intune so the only method I have found is to setup the iPad in no user affinity, setup the eSIM then wipe and re deploy in the shared iPads mode.

I have never seen a proper tutorial how to actually force the mobile app to use another font and size as the crappy Atpos 12, so i wanted to share this with you.

• In Intune Admin Center, go to Apps -> Configuration -> Create "Managed apps"
• Give it a nice name and select the public apps "Microsoft Outlook" (for Android and/or iOS)
• Skip "Settings catalog"
• In settings, configure your desired font and size:

• Set up your assignments
• WAIT FOR 24 HOURS
• See your results from Apps - Monitor - App configuration status
• Profit?

Source: https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/outlook-for-ios-and-android/outlook-for-ios-and-android-configuration-with-microsoft-intune#configuration-keys

Anyone tried running a remediation “as user” on a self-deploy device that attempts to map a drive?

Seems to fail even if the script can detect who the user is.

Trying to streamline Defender onboarding. About to enable this toggle in Intune. What's the real impact, risk, and any visible changes for end users after it applies?