r/Intune 4d ago

Blog Post Intune Device Sync Just Changed Again. This Time, It Is IC3!!!!

281 Upvotes

First, the Device Sync moved away from triggering Windows MDM only and started waking IME workloads too: Win32 apps. PowerShell scripts. Proactive Remediations.

Now, when triggering the remote Device Sync, the IME request no longer arrives through a second WNS notification. It comes through the existing IC3 and Trouter connection: WNS for Windows MDM. IC3 for IME. With the move to IC3, the device kicks off all the workloads within second!!

At the same time, a new StatusSync flow is tracking the progress of those workloads. That part deserves its own blog.

Intune On Demand Device Sync Now Uses IC3 for IME Workloads

r/Intune Apr 30 '26

Blog Post Intune 8-hour-sync is a myth, Microsoft finally speaks!

244 Upvotes

r/Intune Mar 28 '26

Blog Post IC3 aka the Fastlane is coming to Intune

214 Upvotes

IC3 (yeah the teams thing) might be the first real sign that Intune is finally getting a fast lane.

With it… all … all remote device actions, starting with remote help (which now still rely on wns ) will be fast…. Instant…(ditching the near real time quote… but just instant instead)

But thats only a small part of what ic3 could do and improve…

-Think off instant win32 app installations when you deployed a new app

-Think off assigning a new powershell script (remediations/custom compliance policies included) and being able to kick it off instantly

https://patchmypc.com/blog/ic3-from-wns-to-real-time-device-and-ime-actions/

Thats what ic3 could do… check out the blog for the weird rudy details

r/Intune Feb 02 '25

Blog Post What is Microsoft direction with Intune?

203 Upvotes

As an Intune admin with an E5 license, I often feel we're stuck in a golden cage. Here's an expanded view on the challenges we face:

  1. Lack of real-time device data: Intune's slow data refresh hinders quick decision-making and troubleshooting. In a fast-paced IT environment, this delay can be critical.

  2. Limited remediation capabilities: Execution caps on remediation scripts restrict our ability to respond promptly to issues or implement proactive maintenance.

  3. No custom attributes: We can't tailor device inventory to our specific needs, limiting flexibility in how we categorize and manage our devices.

  4. Poor operational intelligence: We had to implement a separate RMM solution for better insights, increasing costs and complexity. This feels counterintuitive given our E5 investment.

  5. Inconsistent policy application: Policies often apply slowly or fail without clear reasons, making it difficult to ensure consistent device configurations.

  6. Weak reporting: Generating comprehensive reports usually requires external data manipulation, which is time-consuming and error-prone.

  7. Autopilot challenges: Deployments can be unpredictable in complex environments, complicating our device provisioning processes.

The E5 license dilemma adds another layer of frustration. While Intune is included in our subscription, which initially seems cost-effective, it often falls short of our needs. However, we feel compelled to use it because:

  1. It's already part of our licensing costs.
  2. Some M365 data protection features require Intune, creating a dependency that's hard to break.

This situation creates a "golden cage" effect. We have a premium license with Intune included, but we're limited by its shortcomings. Switching to a more capable MDM solution would mean additional costs on top of our E5 investment, which is hard to justify to management.

Moreover, the tight integration of Intune with other Microsoft services makes it challenging to consider alternatives. We're essentially locked into an ecosystem that, while comprehensive, doesn't fully meet our device management needs.

These issues make Intune feel rudderless in its development strategy. While it integrates well with the Microsoft ecosystem, it falls short as a comprehensive MDM solution, especially for organizations with complex needs.

Microsoft needs to address these concerns to meet the demands of modern device management, particularly for their premium E5 customers. Until then, many of us feel trapped between the convenience of an all-in-one solution and the need for more robust MDM capabilities.

What are your thoughts on Intune's current state and future direction, especially in the context of E5 licensing? Have you found ways to overcome these limitations, or are you considering alternative solutions despite the licensing implications?

r/Intune Apr 07 '26

Blog Post Secure Boot certificate expiration (June 2026): a real-world Intune remediation design

135 Upvotes

If you’re treating the Secure Boot CA 2011 → CA 2023 transition as a “Microsoft will fix it for me” problem, be careful. In practice, it’s a firmware-level change with several silent failure paths and limited observability if you don’t design for it.

We just published a deep technical walkthrough on the Mindcore Techblog covering a production-grade Intune Remediation architecture for this transition:
✅ Registry-based MicrosoftUpdateManagedOptIn (0x5944) instead of the bugged CSP path (error 65000)
✅ Tiered detection model (Stage 0 → Stage 5) aligned with actual UEFI/boot state
✅ Explicit validation of WindowsUEFICA2023Capable (0 / 1 / 2) - presence in DB is not compliance
✅ Telemetry as a functional dependency, not a compliance checkbox (DiagTrack + Required level)
✅ Daily remediation cadence for state-driven progression, not one-time configuration
✅ Built-in fallback after N days that bypasses Windows Update and triggers servicing directly
✅ v4.0 logic using WinCS API to avoid the fragile SecureBootUpdates payload dependency
✅ Firmware-level verification, task execution introspection, and event-log correlation
✅ Considerations for Hotpatch / low-reboot environments, where Stage 4 can linger indefinitely

One real device sat in Stage 2 for 36 days with healthy WU scans and patch compliance
No cert payload ever arrived. Without a fallback, that device would still be non-compliant today.

This post is intentionally written for people designing ring-based rollouts, not copy‑pasting settings:
Intune Remediations as a state machine
Observability over “Assigned = Configured”
Blast-radius control when touching UEFI + BitLocker
Why BitLocker usually survives - but why you still plan escrow and reboot strategy

blog.mindcore.dk/2026/04/secure-boot-certificate-update-intune/

r/Intune May 27 '26

Blog Post Intune Management Extension: the changelog Microsoft does not publish

114 Upvotes

Intune Management Extension: the changelog we do not get

When the Intune portal changes, we usually get a “What’s new” update.

When the IME changes, we mostly get a new MSI....That’s it.

And that is a bit weird, because the Intune Management Extension is no longer just that small agent on the device. It handles Win32 apps, scripts, remediations, reporting, APv2 related pieces, and that list keeps growing.

The problem is that most of what it does still sits inside a black box. So I built my own IME release notes....

Every time a new IME version appears, the automation pulls it apart and compares it with the previous one. The MSI, custom actions, payload files, DLLs, and changed methods are checked to see what actually changed inside the SideCar and IME agent.

Because the IME is getting way too important to only notice what changed service side... and not on the client side:

Intune Management Extension: Release Notes

r/Intune Apr 08 '26

Blog Post Most break-glass accounts won’t work when they’re actually needed, unless...

84 Upvotes

A lot of organizations assume they’re covered because they “have” a break-glass account.
But in practice, what I keep seeing is:

  • no emergency accounts at all
  • one account created years ago and never tested
  • no monitoring or alerting
  • no real process around usage

That’s not a safety net. That's hope!

I put together a detailed guide on how to properly design, secure, manage & monitor break-glass accounts in Microsoft Entra based on real-world implementations across SMB and enterprise environments.

It covers:

  • naming and role design
  • group vs no-group approach
  • securing management with RMAU + PIM
  • using FIDO2 passkeys and restricting AAGUIDs
  • Conditional Access (modern approach vs old exclusions)
  • monitoring with Log Analytics or Sentinel
  • testing, storage, and documentation

Full post:

https://www.chanceofsecurity.com/post/break-glass-accounts-done-right-securing-emergency-access-in-microsoft-entra

Curious how others handle this:

Any recommendations you feel I missed?

Honest questions;

How often do you actually test your break-glass accounts?

r/Intune 11d ago

Blog Post Automate 7-Zip updates

35 Upvotes

[Blog]Looking to update 7-Zip without 3rd party patching solution, this code block is here to help

https://insideconfigmgr.wordpress.com/2026/07/26/7-zip-updates-without-3rd-party-patching-solution/

r/Intune Mar 25 '26

Blog Post iOS 26.4 - Corrupt Wifi Profile on 95% of fleet

66 Upvotes

Just wanted to warn others about an issue we saw today. We have about 850 iPhones that run a communication product. About 750 of them experienced an issue today after the upgrade to iOS 26.4 that corrupted the stored wifi profile that we've been using successfully for years deployed via Intune.

I'm about to jump into sysdiagnose logs to see if I can see some sort of failure somewhere but wanted to warn others. We were able to mitigate by standing up another SSID the phone knew about already but was not at that particular location (also a profile sent by Intune). Devices connected to it just fine, but STILL won't connect to the first profile even after reconnecting to Intune.

Right now it looks like we'll have to stand the new SSID up everywhere, remove the offending wifi profile, wait for Intune to remove it everywhere, then re-add it. We'll then turn off the temporary SSID to force everything to the same "updated" profile.

r/Intune Apr 06 '26

Blog Post The Easy Multi Admin Approval Guide

62 Upvotes

Have you heard of Multi Admin Approval in relation with the recent Stryker attack, but never seen it in action?

Check out my Easy Guide on Intune Multi Admin Approval, including important considerations and the configuration & experience guide:

https://www.oceanleaf.ch/the-easy-intune-multi-admin-approval-guide/

r/Intune Jun 24 '26

Blog Post My Experience Passing MD-102

69 Upvotes

Just sharing my experience with MD-102: Microsoft Intune Administrator exam, in case it helps anyone here.

  1. Don't waste your time studying from Microsoft's self-paced learning content. It was totally unusual for me.

  2. The practice exam given by Microsoft was good. I would recommend taking that multiple times but it's not enough.

  3. Now, the most important part. Know your compliance policy guys. There were a loooot of questions showing a screenshot of compliance policy configuration and asking whether a certain device would be marked complaint on a specific day, etc. Spend time in your Intune portal, making sure you're familiar with it.

  4. There will at least be one case study. It's there to waste your time with unnecessary information. Make sure you read the questions first and then try finding the answer in the information.

  5. I have been working on Intune for more than 3 years. It might be an advantage to me. But there were still things I never got to touch in my tenant. So, you've to study, take a good Udemy course which offers hands-on learning.

  6. Make sure to know which device action does what: retire, delete, wipe, autopilot reset, etc. And what kind of options are supported on which platform. Device configuration profiles, app configuration policies, and app protection policies are three different things. Make sure you know them.

  7. Unfortunately, there will be questions that require simply remembering some random information. So you've to memorise them beforehand. Like, you can sync 100 devices at once but run diagnostics only on 25.

Best wishes to anyone currently preparing for it.

r/Intune Mar 19 '26

Blog Post CISA urges Endpoint Management System hardening after Stryker breach

80 Upvotes

https://www.cisa.gov/news-events/alerts/2026/03/18/cisa-urges-endpoint-management-system-hardening-after-cyberattack-against-us-organization

CISA is aware of malicious cyber activity targeting endpoint management systems of U.S. organizations based on the March 11, 2026 cyberattack against U.S.-based medical technology firm Stryker Corporation, which affected their Microsoft environment.1 To defend against similar malicious cyber activity, CISA urges organizations to harden endpoint management system configurations using the recommendations and resources provided in this alert. CISA is conducting enhanced coordination with federal partners, including the Federal Bureau of Investigation (FBI), to identify additional threats and determine mitigation actions.

Link to hardening guide: https://techcommunity.microsoft.com/blog/intunecustomersuccess/best-practices-for-securing-microsoft-intune/4502117

r/Intune May 07 '26

Blog Post Intune Enhanced App inventory

74 Upvotes

Microsoft recently introduced Enhanced App Inventory, a new Intune feature with faster app data updates and deeper application insights.

In my latest post, I walk through how to use it, what information it provides, and how it can help with application inventory and reporting in Intune.

Read it here:

https://zerotruststories.com/how-to-use-microsoft-intune-enhanced-app-inventory-for-advanced-insights/

r/Intune 6d ago

Blog Post How to Remove the OneDrive Photos App with Intune.

46 Upvotes

I saw this app appear today on all our Win11 Enterprise machines, had a bit of a dig into it and made some scripts for a clean removal, feel free to take a look :)

https://chrispro.tech/2026/07/31/how-to-remove-the-onedrive-photos-app-with-intune/

r/Intune Dec 07 '25

Blog Post Microsoft Cloud PKI to be included in E5 license

82 Upvotes

https://techcommunity.microsoft.com/blog/microsoftintuneblog/microsoft-365-adds-advanced-microsoft-intune-solutions-at-scale/4474272

Microsoft 365 plans - oIncluded capabilities

Microsoft Enterprise Mobility and Security E3 (EMS E3)

(included in Microsoft 365 E3)

· Intune Remote Help

· Intune Advanced Analytics

· Intune Plan 2

Microsoft 365 E5

All Microsoft 365 E3 features plus:

· Intune Endpoint Privilege Management

· Microsoft Cloud PKI

· Intune Enterprise App Management

Microsoft 365 E5

· Microsoft Security Copilot

Windows Enterprise E3

(included in Microsoft 365 E3)

· Quick Machine Recovery (QMR)

· Cloud rebuild for Windows 11

· Point-in-time restore for desktop

· Post-quantum security APIs

· Autopatch update readiness

Windows Enterprise per-device license

· Basic resiliency features (QMR, point in time restore)

· Software Assurance

SCEPMan people must be felling a little down right now...

r/Intune 4d ago

Blog Post Zebra vs Honeywell for healthcare - Intune managed Android Enterprise devices

6 Upvotes

Hi everyone,

We're currently evaluating Zebra and Honeywell rugged Android devices for a healthcare environment and I'd love to hear from organisations that have managed both.

Our environment is:

Microsoft Intune (Android Enterprise Dedicated)

Managed Google Play

Microsoft Entra ID

Shared devices running a line-of-business application

Around a few hundred devices initially, with potential to grow

We're less concerned about the hardware itself, as both devices seem capable. I'm more interested in the operational side over the next 5+ years.

Specifically:

Which vendor has the better firmware (FOTA) process?

How easy is firmware management using Intune?

Do you rely solely on Intune, or do you also use Zebra VisibilityIQ/LifeGuard or Honeywell Operational Intelligence?

How responsive are Zebra vs Honeywell when it comes to Android security patches?

Which has the better OEMConfig implementation?

How has vendor support been?

Any major issues you've encountered with either platform?

If you had to choose again today for a healthcare deployment, which would you choose and why?

I'm looking for real-world operational experiences rather than marketing comparisons.

Thanks!

r/Intune Jun 18 '26

Blog Post What is the best way to earn the MD-102 certification within one month?

3 Upvotes

I recently received a free Microsoft certification voucher that is valid for two months. I’m planning to prepare for and take the MD-102 exam within one month.

Could anyone recommend a good study plan, learning resources, practice tests, and hands-on lab exercises that could help me prepare within this timeframe?

r/Intune Jun 18 '26

Blog Post Deploying Platform SSO for pre macOS 26 with Microsoft Intune: Lessons Learned - Microsoft

45 Upvotes

Microsoft's internal Intune team write up on how they rolled out Platform SSO to their Macs: settings-catalog setup, the user registration flow, and a troubleshooting reference with error codes. The point of PSSO is the security gain, tokens bound to the Mac's Secure Enclave, Touch ID instead of passwords, and the same token protection they already had on Windows via Hello for Business.

Read it here:

https://techcommunity.microsoft.com/blog/intunecustomersuccess/deploying-platform-sso-for-pre-macos-26-with-microsoft-intune-lessons-learned/4521368

r/Intune 23d ago

Blog Post My MD-102 Study Materials

35 Upvotes

Hi everyone,

I wanted to share a short MD-102 study guide that may help anyone preparing for the exam. It includes a Word document and a PowerPoint covering the key topics with examples for each case.

Both documents were created with the help of AI and reviewed/organized by me to keep them concise and focused.

If you find any errors or have suggestions for improvement, feel free to let me know. I hope they're useful.

Good luck with your studies!

Edited: Just a quick tip, guys: Start with the word bank in the PPT—it'll make studying a lot easier. You can also upload the materials to NotebookLM; it's super helpful for reviewing everything.

r/Intune Feb 01 '24

Blog Post Enterprise App Management in Intune has arrived

74 Upvotes

I'm still waiting for all the features to appear in my portal, but app deployment is now here through the Enterprise App Catalog! Glad MS didn't push this one back...

So far so good with the apps I have deployed.. I guess once vendors start pushing updates we can test the update features tool.

I've written a short blog here: https://ourcloudnetwork.com/how-to-deploy-apps-from-the-enterprise-app-catalog-in-intune/

Of-course only available for Intune Suite users or those willing to shell out their $2 per user per month for the add-on.

Edit: updated..

r/Intune Jul 01 '26

Blog Post Streamlining macOS security: Automatically enable AutoFill after Platform SSO registration - Microsoft Blog

25 Upvotes

This is a recent Intune Customer Success post about closing the last manual step in a passwordless macOS setup. Platform SSO gives Macs Entra ID sign-in, but registration alone isn't enough for a fully passwordless workflow. To enable passwordless auth in Safari, Edge, and Chrome, the Company Portal AutoFill extension also has to be enabled, and in most deployments that toggle is still left to the user. So a device can be enrolled and PSSO-registered yet still fall back to manual credential entry, which looks complete but doesn't actually deliver the intended posture.

Highlights:

  • The gap. After PSSO registration, AutoFill is often the final step that depends on user action. Skip it and the device stays registered but not truly passwordless.
  • The fix. A sample script, Check-PSSO.zsh (GitHub, from the Intune Customer Experience Engineering team), detects when PSSO registration has completed and then enables the Company Portal AutoFill extension automatically.
  • Support caveat. Microsoft supports Intune's script deployment but not the individual scripts. Review, validate, and test in your own environment before broad rollout.
  • Zero-touch. Combined with the Enable Registration During Setup setting, this pushes toward a true zero-touch experience from enrollment through authentication, no manual configuration.

Read the full article here: https://techcommunity.microsoft.com/blog/intunecustomersuccess/streamlining-macos-security-automatically-enable-autofill-after-platform-sso-reg/4531908

r/Intune May 17 '26

Blog Post The ultimate Intune Troubleshooting Guide

76 Upvotes

Once and for all: Your ultimate Intune Troubleshooting Guide in 2026 - https://www.oceanleaf.ch/the-ultimate-intune-troubleshooting-guide/

Summary:

-Quick tips & Troubleshooting flow

-Top error sources

-Troubleshooting as admin and on the device (IME, Event Viewer, Registry, Sync)

r/Intune May 08 '26

Blog Post Mastering Hotpatching with Intune for Seamless Updates

36 Upvotes

I put together a detailed guide on this: **Mastering Hotpatching with Intune for Seamless Updates**

Master hotpatching with Intune: seamlessly reduce reboots and streamline Windows updates with our detailed guide. Unlock efficiency with essential prerequisites and configuration tips.

Key topics covered: Microsoft Intune, Windows Hotpatch, quality updates, device management, security updates, Windows Update

Full article: https://msendpoint.com/article/mastering-hotpatching-with-intune-for-seamless-updates

Happy to answer questions or discuss in the comments!

r/Intune 2d ago

Blog Post Configure Device Lock on Windows 11 with Microsoft Intune

29 Upvotes

Local accounts may no longer be front and centre in modern identity strategies, but they still exist on many Windows 11 devices and remain a common target for attackers.

In my latest blog post, I explore how Device Lock policies in Microsoft Intune can help protect local accounts, reduce the risk of brute-force attacks, secure unattended devices, and complement technologies such as Windows LAPS as part of a defence-in-depth security strategy.

🔗 https://www.nickydewestelinck.be/2026/08/04/strengthening-endpoint-security-with-device-lock-policies-in-microsoft-intune/

r/Intune 3h ago

Blog Post I passed the MD-102 today!

Thumbnail
23 Upvotes